Analysis
-
max time kernel
132s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
20/08/2024, 12:27
General
-
Target
af36ccb0908853fc901ccd1a6d0aea85_JaffaCakes118.exe
-
Size
401KB
-
MD5
af36ccb0908853fc901ccd1a6d0aea85
-
SHA1
3ff76c04a2a1536b6e8280f15ed4ec33c52c863d
-
SHA256
49cb2b9ee93c363d77b970e01e101a1145d08dc94a10cd899e97eea6cb7f7eae
-
SHA512
f4cbe3075c63b04f465b056779e0fb1abd7005d058e3e2a6e1e44b4ab7ce007caa7eb1067838045727b484b1ede56513e1a182e985a9813e8c4d7cf747e1b9ac
-
SSDEEP
12288:/Au09QHyKJYrx9P0J3TxHWT1nnyqLeUhMD668:/8+Hy4Yrx9s1ThWByiL
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
-
Loads dropped DLL 2 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 2 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\af36ccb0908853fc901ccd1a6d0aea85_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\af36ccb0908853fc901ccd1a6d0aea85_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
211B
MD5775c9842cab9f31e23840e908558b622
SHA1b42931412f4c0c6d7c50d1bdca5add8440f67eb0
SHA2562e1753878926211701a5f798b15a384cae60678c5d77008de8d75bf0e7db4068
SHA5120c7a69d30be407bb028464d5bd44cefadf1fca67eefef06bfad6ada6f1fd3f553fd9b9a0c8556fbabeb62468ec684ceca3168e92f27b4419421308f352cc5407
-
Filesize
172KB
MD5685f1cbd4af30a1d0c25f252d399a666
SHA16a1b978f5e6150b88c8634146f1406ed97d2f134
SHA2560e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA5126555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9
-
Filesize
228KB
-
Filesize
460KB
-
Filesize
460KB
-
Filesize
460KB
-
Filesize
228KB