Analysis
-
max time kernel
141s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
11/07/2024, 09:09
General
-
Target
38827b3f7a2a2b5900a2d39535e40bb9_JaffaCakes118.exe
-
Size
493KB
-
MD5
38827b3f7a2a2b5900a2d39535e40bb9
-
SHA1
7431c1a32e7dd4bc4ebd0585d07208565fbe5c05
-
SHA256
fbf8364648f0fdec49c54a654e29d159fc675803d73d476adee7cb3535214261
-
SHA512
decb07fdffe0e7eeadf39c422a6bd764384df428fbb425208f5c110dfc5d4d7716260016340aa0237deebba6b7ebc9d1282808825e604173b2fa6ffa551e665a
-
SSDEEP
12288:V1Ra1rN4wopVauKAxZkhwrygNtTirdorX:VDrp4XAx+hwry4TEdo
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Drops file in Windows directory 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\38827b3f7a2a2b5900a2d39535e40bb9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\38827b3f7a2a2b5900a2d39535e40bb9_JaffaCakes118.exe"1⤵
- Writes to the Master Boot Record (MBR)
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\GDNSRV.exeC:\Windows\GDNSRV.exe1⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE"2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
493KB
MD538827b3f7a2a2b5900a2d39535e40bb9
SHA17431c1a32e7dd4bc4ebd0585d07208565fbe5c05
SHA256fbf8364648f0fdec49c54a654e29d159fc675803d73d476adee7cb3535214261
SHA512decb07fdffe0e7eeadf39c422a6bd764384df428fbb425208f5c110dfc5d4d7716260016340aa0237deebba6b7ebc9d1282808825e604173b2fa6ffa551e665a
-
Filesize
268KB
-
Filesize
975KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
12KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
975KB
-
Filesize
268KB
-
Filesize
975KB
-
Filesize
268KB
-
Filesize
975KB
-
Filesize
268KB