Analysis
-
max time kernel
1s -
max time network
3s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
06/09/2024, 01:07
Errors
Reason
Machine shutdown
General
-
Target
ce4d31957ca331e7f0b359359e97dc87_JaffaCakes118.exe
-
Size
196KB
-
MD5
ce4d31957ca331e7f0b359359e97dc87
-
SHA1
3f89e93cb817f8049b6e2cf077fc25f778990c79
-
SHA256
9869437456ce1dd12e8f7fda22d9db0a8e875646dc8f9c8b7fa3c176bbf82a2e
-
SHA512
f522eb94de456f7dd9035d890eb0e364e69955dee7093e219e2641c80f908b5ddcb47e467d226df1c5c986bd81ec8998ce8b8d5558e34b763edc872f05f5f3d1
-
SSDEEP
3072:w1iu+spTBssOiXLAPt/vsQlRH6UkZog4l6Ov6eoiqZd5dP0Kx3F48DvIR7S5:WDHdSsO4gvsQlRaNZoXzS3jPvTDvIRe
Score
6/10
Malware Config
Signatures
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ce4d31957ca331e7f0b359359e97dc87_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ce4d31957ca331e7f0b359359e97dc87_JaffaCakes118.exe"1⤵
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12KB
-
Filesize
296KB
-
Filesize
296KB