Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
19-09-2024 06:18
General
-
Target
eabf3816d619c186afdd0a57e5ef138b_JaffaCakes118.exe
-
Size
252KB
-
MD5
eabf3816d619c186afdd0a57e5ef138b
-
SHA1
fc33d9b6cea1a9d460418d7514a58ae0cc30e853
-
SHA256
175a3c84c67e0017ec64848aca432b9ecc37328a2cd5c426cbe5d2a58ed536f3
-
SHA512
235a35acfad17b556544baafd7529f6fa5b0a26513fc93190201f9ccf454c406b036c91b6133557a1c1c14647ae63063323faef272110b2eeedee36a4836f877
-
SSDEEP
3072:cJ9Zqle2tsu5oehGHA/pqQLxgdolApXu7Tq/pY+SFuK0Rg:cJ9ZqAyoehfLmdHpeeHc3
Malware Config
Signatures
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Suspicious use of SetThreadContext 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 9 IoCs
-
Suspicious use of AdjustPrivilegeToken 25 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\eabf3816d619c186afdd0a57e5ef138b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\eabf3816d619c186afdd0a57e5ef138b_JaffaCakes118.exe"1⤵
- Maps connected drives based on registry
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\eabf3816d619c186afdd0a57e5ef138b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\eabf3816d619c186afdd0a57e5ef138b_JaffaCakes118.exe2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
52KB
-
Filesize
120KB
-
Filesize
8KB
-
Filesize
36KB
-
Filesize
100KB
-
Filesize
100KB
-
Filesize
308KB
-
Filesize
180KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
44KB
-
Filesize
196KB
-
Filesize
144KB
-
Filesize
72KB
-
Filesize
428KB
-
Filesize
44KB
-
Filesize
612KB
-
Filesize
452KB
-
Filesize
32KB
-
Filesize
36KB
-
Filesize
664KB
-
Filesize
36KB
-
Filesize
36KB
-
Filesize
36KB
-
Filesize
4KB