Analysis

  • max time kernel
    121s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    15/10/2024, 23:55

General

  • Target

    4a8e5af317ef801fabd917bea86e1ba1_JaffaCakes118.exe

  • Size

    4.1MB

  • MD5

    4a8e5af317ef801fabd917bea86e1ba1

  • SHA1

    5f925a41267a79107fccc3573e9acbd59b83af4a

  • SHA256

    7fefe061be5be2911741da8959486dc21bfee0ec207259a663872f74b4f4ba27

  • SHA512

    8990bc37b9dbec2e9339771c82d8184497460948380c6e983f7cc75873996d512685153bdd8facdc7f77aa39cca0f3c72fa9cc5ab0f72cbfb2aa754cce53d797

  • SSDEEP

    98304:5j/USOW8BaU5qnJMSyafbjd1SPrbjd1SPjbjd1SPabjd1SP37Gmwa8Ipv93w4A8O:kivJfbjd1SPrbjd1SPjbjd1SPabjd1Sb

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Drops file in System32 directory 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4a8e5af317ef801fabd917bea86e1ba1_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\4a8e5af317ef801fabd917bea86e1ba1_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Writes to the Master Boot Record (MBR)
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2868

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • \Windows\SysWOW64\SkinH_EL.dll

          Filesize

          688KB

          MD5

          bd42ef63fc0f79fdaaeca95d62a96bbb

          SHA1

          97ca8ccb0e6f7ffeb05dc441b2427feb0b634033

          SHA256

          573cf4e4dfa8fe51fc8b80b79cd626cb861260d26b6e4f627841e11b4dce2f48

          SHA512

          431b5487003add16865538de428bf518046ee97ab6423d88f92cda4ff263f971c0cf3827049465b9288a219cc32698fd687939c7c648870dd7d8d6776735c93c

        • memory/2868-0-0x0000000000400000-0x0000000000818000-memory.dmp

          Filesize

          4.1MB

        • memory/2868-6-0x0000000000400000-0x0000000000818000-memory.dmp

          Filesize

          4.1MB