5759c68e3a2de8b1c3d0b7354dee1649e866db095a528d27258755117dde221f

Analysis

max time kernel
94s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2024 07:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ead1f95448133e4d40f64b9ba0c5452d_JaffaCakes118.exe
Size

8.1MB
MD5

ead1f95448133e4d40f64b9ba0c5452d
SHA1

db53670ae742cc2feee28103001844e225871788
SHA256

5759c68e3a2de8b1c3d0b7354dee1649e866db095a528d27258755117dde221f
SHA512

33e611baf861b40c13519c624f6440a6129781c5ea6dd677315d14aa712e6a4a00be176cbbd349dc96ce05fbb9c538799a5d1d7c3cac5a95cb782dde56ae2a9d
SSDEEP

196608:aGZLI7RTol+Q2Lg5Eds4iHgDuEXnfIuf/tKWc6adHog/NTCxFD:FKhjvds4SmjXTf/tKW/adIsNTCx5

Score

6^/10

bootkit discovery persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	ead1f95448133e4d40f64b9ba0c5452d_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ead1f95448133e4d40f64b9ba0c5452d_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2688	ead1f95448133e4d40f64b9ba0c5452d_JaffaCakes118.exe
2688	ead1f95448133e4d40f64b9ba0c5452d_JaffaCakes118.exe
2688	ead1f95448133e4d40f64b9ba0c5452d_JaffaCakes118.exe
2688	ead1f95448133e4d40f64b9ba0c5452d_JaffaCakes118.exe
2688	ead1f95448133e4d40f64b9ba0c5452d_JaffaCakes118.exe
2688	ead1f95448133e4d40f64b9ba0c5452d_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\ead1f95448133e4d40f64b9ba0c5452d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ead1f95448133e4d40f64b9ba0c5452d_JaffaCakes118.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2688-0-0x0000000010000000-0x000000001009C000-memory.dmp

Filesize
624KB

Download
memory/2688-5-0x0000000003A40000-0x0000000003BA9000-memory.dmp

Filesize
1.4MB

Download
memory/2688-15-0x0000000003F10000-0x0000000003F20000-memory.dmp

Filesize
64KB

Download
memory/2688-20-0x0000000003F10000-0x0000000003F20000-memory.dmp

Filesize
64KB

Download