fb843b3a48d44aa116cb3e06dffc39da97d6cf1485d8e8e4ee0345a0f0c86db4

Analysis

max time kernel
140s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
21/08/2024, 17:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b46937098aa7df60ae3f99011eab6d37_JaffaCakes118.exe
Size

361KB
MD5

b46937098aa7df60ae3f99011eab6d37
SHA1

c692736b3bf5b91c2860fc9ef291c3a630b96b30
SHA256

fb843b3a48d44aa116cb3e06dffc39da97d6cf1485d8e8e4ee0345a0f0c86db4
SHA512

28345243b31541857c41e92a4ce6fa4f97ee2cde8f0db58dd4e51633e30d2f49708ace59dcdcb75a6a09fa093cf407305e3f318792be4f9092aaca09df8ce640
SSDEEP

6144:CZtRjiGaRO22aIkbG6Z0e7HdYPOZ5FyZGONif6MDn+aCP0vdZhhL0MT1DcR5bRd1:wzGb2+b7V7NFyMrWPCZHB1QRD

Score

6^/10

bootkit discovery persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	b46937098aa7df60ae3f99011eab6d37_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b46937098aa7df60ae3f99011eab6d37_JaffaCakes118.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	b46937098aa7df60ae3f99011eab6d37_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	b46937098aa7df60ae3f99011eab6d37_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	b46937098aa7df60ae3f99011eab6d37_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\b46937098aa7df60ae3f99011eab6d37_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b46937098aa7df60ae3f99011eab6d37_JaffaCakes118.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2972-1-0x0000000000260000-0x0000000000295000-memory.dmp

Filesize
212KB

Download
memory/2972-0-0x0000000019960000-0x0000000019A05000-memory.dmp

Filesize
660KB

Download
memory/2972-26-0x0000000000360000-0x0000000000361000-memory.dmp

Filesize
4KB

Download
memory/2972-33-0x0000000000360000-0x0000000000362000-memory.dmp

Filesize
8KB

Download
memory/2972-32-0x0000000000360000-0x0000000000361000-memory.dmp

Filesize
4KB

Download
memory/2972-31-0x0000000000360000-0x0000000000361000-memory.dmp

Filesize
4KB

Download
memory/2972-30-0x0000000000360000-0x0000000000361000-memory.dmp

Filesize
4KB

Download
memory/2972-29-0x0000000000360000-0x0000000000361000-memory.dmp

Filesize
4KB

Download
memory/2972-28-0x0000000000360000-0x0000000000361000-memory.dmp

Filesize
4KB

Download
memory/2972-39-0x0000000000380000-0x0000000000381000-memory.dmp

Filesize
4KB

Download
memory/2972-40-0x0000000000370000-0x0000000000371000-memory.dmp

Filesize
4KB

Download
memory/2972-38-0x0000000000510000-0x0000000000511000-memory.dmp

Filesize
4KB

Download
memory/2972-37-0x0000000000560000-0x0000000000561000-memory.dmp

Filesize
4KB

Download
memory/2972-36-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2972-35-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2972-34-0x0000000000350000-0x0000000000353000-memory.dmp

Filesize
12KB

Download
memory/2972-27-0x0000000000360000-0x0000000000361000-memory.dmp

Filesize
4KB

Download
memory/2972-25-0x0000000000360000-0x0000000000361000-memory.dmp

Filesize
4KB

Download
memory/2972-24-0x0000000000360000-0x0000000000361000-memory.dmp

Filesize
4KB

Download
memory/2972-23-0x0000000000360000-0x0000000000361000-memory.dmp

Filesize
4KB

Download
memory/2972-22-0x0000000000360000-0x0000000000361000-memory.dmp

Filesize
4KB

Download
memory/2972-21-0x0000000000360000-0x0000000000361000-memory.dmp

Filesize
4KB

Download
memory/2972-20-0x0000000000360000-0x0000000000361000-memory.dmp

Filesize
4KB

Download
memory/2972-19-0x0000000000360000-0x0000000000361000-memory.dmp

Filesize
4KB

Download
memory/2972-18-0x0000000000360000-0x0000000000361000-memory.dmp

Filesize
4KB

Download
memory/2972-17-0x0000000000360000-0x0000000000361000-memory.dmp

Filesize
4KB

Download
memory/2972-16-0x0000000000360000-0x0000000000361000-memory.dmp

Filesize
4KB

Download
memory/2972-15-0x0000000000370000-0x0000000000371000-memory.dmp

Filesize
4KB

Download
memory/2972-14-0x0000000000370000-0x0000000000371000-memory.dmp

Filesize
4KB

Download
memory/2972-13-0x0000000000370000-0x0000000000371000-memory.dmp

Filesize
4KB

Download
memory/2972-12-0x0000000000370000-0x0000000000371000-memory.dmp

Filesize
4KB

Download
memory/2972-11-0x0000000000370000-0x0000000000371000-memory.dmp

Filesize
4KB

Download
memory/2972-10-0x0000000000370000-0x0000000000371000-memory.dmp

Filesize
4KB

Download
memory/2972-9-0x0000000000370000-0x0000000000371000-memory.dmp

Filesize
4KB

Download
memory/2972-8-0x0000000000370000-0x0000000000371000-memory.dmp

Filesize
4KB

Download
memory/2972-7-0x0000000000370000-0x0000000000371000-memory.dmp

Filesize
4KB

Download
memory/2972-6-0x0000000000370000-0x0000000000371000-memory.dmp

Filesize
4KB

Download
memory/2972-5-0x0000000000370000-0x0000000000371000-memory.dmp

Filesize
4KB

Download
memory/2972-4-0x0000000000360000-0x0000000000361000-memory.dmp

Filesize
4KB

Download
memory/2972-3-0x0000000000360000-0x0000000000361000-memory.dmp

Filesize
4KB

Download
memory/2972-2-0x0000000000360000-0x0000000000361000-memory.dmp

Filesize
4KB

Download
memory/2972-41-0x0000000019960000-0x0000000019A05000-memory.dmp

Filesize
660KB

Download
memory/2972-42-0x0000000000260000-0x0000000000295000-memory.dmp

Filesize
212KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads