Analysis
-
max time kernel
140s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
22-07-2024 15:24
Static task
static1
Behavioral task
behavioral1
Sample
63b9285ce92df9b85633c1293b0f2fea_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
63b9285ce92df9b85633c1293b0f2fea_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
63b9285ce92df9b85633c1293b0f2fea_JaffaCakes118.exe
-
Size
357KB
-
MD5
63b9285ce92df9b85633c1293b0f2fea
-
SHA1
380a3c1156c6de9afc4017b7092e16293c1e4e8e
-
SHA256
5e008d012f221e042a355199f11be86cb237fba85ae3a45494c53dc1e9f5cee2
-
SHA512
3b49a6f2da2524f3e4c678a3860af4beff49975a9403626ec177ecfe0e0d55540db2a102968b13ce1c9b7023c7cea72a40fdab28452b63bc58be1cfc43425a7b
-
SSDEEP
6144:k4U97exBwk4OhLfkLWJCfjLO15n+aCP0vdZhhL0MTYl6NR7MU5:kmL2s2wWPCZHBYwNR7MU5
Malware Config
Signatures
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 63b9285ce92df9b85633c1293b0f2fea_JaffaCakes118.exe -
Modifies registry class 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key 63b9285ce92df9b85633c1293b0f2fea_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ 63b9285ce92df9b85633c1293b0f2fea_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" 63b9285ce92df9b85633c1293b0f2fea_JaffaCakes118.exe