Analysis
-
max time kernel
141s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
12-09-2024 21:48
General
-
Target
dd1c56f48b4c085f72e4461e8887d2b6_JaffaCakes118.exe
-
Size
91KB
-
MD5
dd1c56f48b4c085f72e4461e8887d2b6
-
SHA1
c5448e37a799ba30ba50f7b533e5fafe56a5c311
-
SHA256
317a8c0d5c7125c48a31b968245c20dbe73387e1a660231022f967819c0df385
-
SHA512
d6c7368bc613cc59b51754a99702f7172dfdcbf8eb0845c5d37b73235586e9e93944e9fcd6c6530bf9c4d351e1d3823bd6522894ff359a032890700875e0fff9
-
SSDEEP
1536:4SSS+7f0OYCciVcnhhfN8WFHevNj2g8m0ixW2IMjSO53Sb6qZu4:4B3MLxZnH18OHG2w0avtSy3M6qZu4
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Drops file in System32 directory 2 IoCs
-
Drops file in Windows directory 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: LoadsDriver 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\dd1c56f48b4c085f72e4461e8887d2b6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\dd1c56f48b4c085f72e4461e8887d2b6_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c delplme.bat2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
-
-
C:\Windows\avp.exeC:\Windows\avp.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
306B
MD566d11b8b7707fdbd2bc59a74b993e04d
SHA12eb9f1fb100df73e2bc90143c7dba50ad5009db1
SHA256aa367ecedc96dcbc3ad6fafe69f940838a270c066767e4cef6f3e839ddec0bd5
SHA5129788a05b893dac6413e776fa74fdf71c64cdd4b462de5421f9330109b76a45ea3fd24d6b09a235572cd57d8c41014b9860ad803392dbe0c81a0af9643edca77b
-
Filesize
34KB
MD5b822623575caba26800f1f8ce379b259
SHA1c8ad5f6cb5979d7f302fa8a1a261df618c7133ca
SHA2563e6a0635a395e2a8fee7e69f76e15711fb922575c47fc1acd9968b5e29ef06ee
SHA512358f9dfa4fb1783857f8d4359d8f2e9c1ec7e272ed44e7f2b2bb07e8cd36e1275a8b914a4739b6addbee9651c469c87edea249c1129e77bab6f18679cb723475
-
Filesize
197KB
MD59af5968c578ac225280cb049199fa5cd
SHA1572be9fab2ec252b5b6b450a61a998c80fb1d63b
SHA2561006f6e9ac1d31dd5ff70652f8558d8788ad8087935aa1bc2ea4b7a6b18d7cb8
SHA5129d8db081f6cad117d304030e367b1491d345c306725ca0cb02e223c3fdfd20f245f8e63bd98767c9154a9d2e9b48191c4c5cf2fc0770f11b061bac1f7fd9012e
-
Filesize
308KB
-
Filesize
8KB
-
Filesize
228KB
-
Filesize
308KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
60KB