Overview

overview

6

Static

static

3

bd4b8a7ba0...18.exe

windows7-x64

6

bd4b8a7ba0...18.exe

windows10-2004-x64

6

Analysis

  • max time kernel
    138s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/08/2024, 21:53

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    bd4b8a7ba031bc8667692b9c7451c948_JaffaCakes118.exe

  • Size

    19KB

  • MD5

    bd4b8a7ba031bc8667692b9c7451c948

  • SHA1

    f0bca684bc364e39c8370a9dd1a823cd18bf4c12

  • SHA256

    dfd809aea45196579c41dd8910310a4bff96281bd60e81f22c5b21cab4cd79e8

  • SHA512

    dfb127919baf93df26622a2b7480001f1331a8d795da068ed6a1d5ca25c5b761c8a2cce93446330e4e85d072620fe20f6025dfb3ad95f0c5c88eb3616de19c45

  • SSDEEP

    384:yL+2kiihbprsCjMEyt2/f9bANDMz7Tk3Zglw7qqTFKA0RxzGXI:yK2e9XJyYf2DMHTk3OlIzpJ0Rx

Score
6/10
bootkitdiscoverypersistence

Malware Config

Signatures

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bd4b8a7ba031bc8667692b9c7451c948_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\bd4b8a7ba031bc8667692b9c7451c948_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4664
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"
      2⤵
      • Writes to the Master Boot Record (MBR)
      • System Location Discovery: System Language Discovery
      PID:3092

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3092-1-0x0000000013140000-0x00000000131D8000-memory.dmp

    Filesize

    608KB

    Download

  • memory/4664-0-0x0000000014140000-0x0000000014149000-memory.dmp

    Filesize

    36KB

    Download