487f4e09df11d865e63fed8d0a92540591bd82a133e9ff7b3218bde78231fc60

Analysis

max time kernel
0s
max time network
3s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
01/08/2024, 21:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

81cbec1007b0e73d3928a70e3942c686_JaffaCakes118.exe
Size

200KB
MD5

81cbec1007b0e73d3928a70e3942c686
SHA1

70115b899a4c41a5a036b369cfe2374c6cc62001
SHA256

487f4e09df11d865e63fed8d0a92540591bd82a133e9ff7b3218bde78231fc60
SHA512

eb8a3c884685fae9b6b71599f4ac59778ca49afe28a7cba3e6880b980818ec4b3e190159c8e220d4c69f21786bf8c69b0d6b2b4c641f0c482c485678265ffcd9
SSDEEP

3072:xoPjHXkZCTAYKAf5HET9U4sUbHJo3/qL9H/zzX2N6r22+OT7mUY2f8V7HQg4K:2PjHdV4U4x96M/zzLr2AHmU0ZH+K

Score

6^/10

bootkit persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\physicaldrive0	81cbec1007b0e73d3928a70e3942c686_JaffaCakes118.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2240	81cbec1007b0e73d3928a70e3942c686_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2240	81cbec1007b0e73d3928a70e3942c686_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\81cbec1007b0e73d3928a70e3942c686_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\81cbec1007b0e73d3928a70e3942c686_JaffaCakes118.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
PID:2240

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2240-0-0x0000000000409000-0x000000000040C000-memory.dmp

Filesize
12KB

Download
memory/2240-1-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/2240-2-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads