Analysis
-
max time kernel
0s -
max time network
1s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
21-08-2024 21:49
General
-
Target
b52d97a5d03dc4e75a48f53febb6efd3_JaffaCakes118.exe
-
Size
226KB
-
MD5
b52d97a5d03dc4e75a48f53febb6efd3
-
SHA1
81324cee5d0fda2650314f43e05054442ca8d758
-
SHA256
90eb3e7d7720fb7de0ee2e167bffc7f07c9b239abdfc76c89c42ed7b84f6dcdf
-
SHA512
4ee9387762dee424e56926d64a2c75d5d19992f26f5c4f960f7d7d63c2a2d81895234c95aa17a6b4d3c9c29fb3e68f73862d148221784c399aa95ce35a22e4c8
-
SSDEEP
6144:VSJD6izvODPjq5YlpJqrOxPPBStuM2RNhT7RHmuy6JapB0K:VSJ2YWbe5YlS6lPQuR7hxr8H0K
Score
6/10
Malware Config
Signatures
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b52d97a5d03dc4e75a48f53febb6efd3_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b52d97a5d03dc4e75a48f53febb6efd3_JaffaCakes118.exe"1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
360KB
-
Filesize
4KB
-
Filesize
360KB
-
Filesize
360KB