Analysis
-
max time kernel
138s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
-
submitted
25/08/2024, 03:27
General
-
Target
bfed528f4c3a1ef498e9fd2ba581a5af_JaffaCakes118.exe
-
Size
884KB
-
MD5
bfed528f4c3a1ef498e9fd2ba581a5af
-
SHA1
f1cc6c40cd39d30e9020b1f38d4a86051ef6cd53
-
SHA256
9dd0d261bffd5aa0df5ae3d2bde9247a2087e20763c08de505e2fe00aab93271
-
SHA512
a37acc56f2f55f242a0fb71da6edac3cf8feff4a237537e8967970655e12460988cecc1aa669b69ed1acb8892fb810b414d5af2033c2db80cb1eb30e1b55b0e2
-
SSDEEP
24576:1L47NgWYdynKh6PxSE3WcZJEiIbEC7jvRIsJYTcTMf9q:1LWN2ynCE3W+Orv6s2ITwq
Malware Config
Signatures
-
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious use of SetWindowsHookEx 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\bfed528f4c3a1ef498e9fd2ba581a5af_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\bfed528f4c3a1ef498e9fd2ba581a5af_JaffaCakes118.exe"1⤵
- Checks BIOS information in registry
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx