Analysis

  • max time kernel
    140s
  • max time network
    131s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/10/2024, 23:36

General

  • Target

    4fa3508374ea34a12c02b9c5cc8a7145_JaffaCakes118.exe

  • Size

    517KB

  • MD5

    4fa3508374ea34a12c02b9c5cc8a7145

  • SHA1

    9c91138e50f407b01e95379341afaeb7482264cd

  • SHA256

    7617c422fe1837ba06d336ebdce9ff053490760ce751b2457ed19d291245055b

  • SHA512

    dc46c9a2564d42c61c48fa398917604d802233cd57a345b6be7d6f133f0c1d6e246724bafb2708d0a70da3315e1d10e3626c3e16da00fb67fd414dddd0979593

  • SSDEEP

    12288:myJVkvuf92tKdubUAnN7vRv0tpRsbQ5QVW1meyUGpCBwvGHeEHm9Lf:mOxf92tKdu4AnN7vF0tpRsbQ5QVW1HGT

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
  • Modifies registry class 3 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4fa3508374ea34a12c02b9c5cc8a7145_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\4fa3508374ea34a12c02b9c5cc8a7145_JaffaCakes118.exe"
    1⤵
    • Adds Run key to start application
    • Writes to the Master Boot Record (MBR)
    • System Location Discovery: System Language Discovery
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of SetWindowsHookEx
    PID:1772

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/1772-0-0x0000000000400000-0x000000000050D000-memory.dmp

          Filesize

          1.1MB

        • memory/1772-2-0x0000000002240000-0x0000000002256000-memory.dmp

          Filesize

          88KB

        • memory/1772-16-0x00000000022A0000-0x00000000022A1000-memory.dmp

          Filesize

          4KB

        • memory/1772-29-0x0000000002210000-0x0000000002211000-memory.dmp

          Filesize

          4KB

        • memory/1772-28-0x0000000002150000-0x0000000002151000-memory.dmp

          Filesize

          4KB

        • memory/1772-27-0x0000000002290000-0x0000000002291000-memory.dmp

          Filesize

          4KB

        • memory/1772-26-0x0000000002290000-0x0000000002291000-memory.dmp

          Filesize

          4KB

        • memory/1772-25-0x0000000002290000-0x0000000002291000-memory.dmp

          Filesize

          4KB

        • memory/1772-24-0x0000000002290000-0x0000000002291000-memory.dmp

          Filesize

          4KB

        • memory/1772-23-0x0000000002290000-0x0000000002291000-memory.dmp

          Filesize

          4KB

        • memory/1772-22-0x0000000002290000-0x0000000002291000-memory.dmp

          Filesize

          4KB

        • memory/1772-21-0x0000000002290000-0x0000000002291000-memory.dmp

          Filesize

          4KB

        • memory/1772-20-0x0000000002290000-0x0000000002291000-memory.dmp

          Filesize

          4KB

        • memory/1772-19-0x0000000002290000-0x0000000002291000-memory.dmp

          Filesize

          4KB

        • memory/1772-18-0x0000000002290000-0x0000000002291000-memory.dmp

          Filesize

          4KB

        • memory/1772-17-0x0000000002290000-0x0000000002291000-memory.dmp

          Filesize

          4KB

        • memory/1772-15-0x00000000022A0000-0x00000000022A1000-memory.dmp

          Filesize

          4KB

        • memory/1772-14-0x00000000022A0000-0x00000000022A1000-memory.dmp

          Filesize

          4KB

        • memory/1772-13-0x00000000022A0000-0x00000000022A1000-memory.dmp

          Filesize

          4KB

        • memory/1772-12-0x00000000022A0000-0x00000000022A1000-memory.dmp

          Filesize

          4KB

        • memory/1772-11-0x00000000022A0000-0x00000000022A1000-memory.dmp

          Filesize

          4KB

        • memory/1772-10-0x00000000022A0000-0x00000000022A1000-memory.dmp

          Filesize

          4KB

        • memory/1772-9-0x00000000022A0000-0x00000000022A1000-memory.dmp

          Filesize

          4KB

        • memory/1772-8-0x00000000022A0000-0x00000000022A1000-memory.dmp

          Filesize

          4KB

        • memory/1772-7-0x00000000022A0000-0x00000000022A1000-memory.dmp

          Filesize

          4KB

        • memory/1772-6-0x00000000022A0000-0x00000000022A1000-memory.dmp

          Filesize

          4KB

        • memory/1772-5-0x00000000022A0000-0x00000000022A1000-memory.dmp

          Filesize

          4KB

        • memory/1772-4-0x00000000022A0000-0x00000000022A1000-memory.dmp

          Filesize

          4KB

        • memory/1772-3-0x0000000002290000-0x0000000002291000-memory.dmp

          Filesize

          4KB

        • memory/1772-1-0x0000000002220000-0x0000000002221000-memory.dmp

          Filesize

          4KB

        • memory/1772-32-0x0000000002120000-0x0000000002121000-memory.dmp

          Filesize

          4KB

        • memory/1772-33-0x0000000002140000-0x0000000002141000-memory.dmp

          Filesize

          4KB

        • memory/1772-35-0x00000000021C0000-0x00000000021C1000-memory.dmp

          Filesize

          4KB

        • memory/1772-38-0x0000000002290000-0x0000000002291000-memory.dmp

          Filesize

          4KB

        • memory/1772-37-0x00000000022A0000-0x00000000022A1000-memory.dmp

          Filesize

          4KB

        • memory/1772-36-0x0000000002180000-0x0000000002181000-memory.dmp

          Filesize

          4KB

        • memory/1772-34-0x0000000002260000-0x0000000002261000-memory.dmp

          Filesize

          4KB

        • memory/1772-41-0x00000000022D0000-0x00000000022D1000-memory.dmp

          Filesize

          4KB

        • memory/1772-52-0x0000000002C70000-0x0000000002C71000-memory.dmp

          Filesize

          4KB

        • memory/1772-51-0x0000000002C50000-0x0000000002C51000-memory.dmp

          Filesize

          4KB

        • memory/1772-50-0x0000000002C30000-0x0000000002C31000-memory.dmp

          Filesize

          4KB

        • memory/1772-49-0x0000000002CC0000-0x0000000002CC1000-memory.dmp

          Filesize

          4KB

        • memory/1772-48-0x0000000002CE0000-0x0000000002CE1000-memory.dmp

          Filesize

          4KB

        • memory/1772-47-0x0000000002CA0000-0x0000000002CA1000-memory.dmp

          Filesize

          4KB

        • memory/1772-46-0x0000000002CB0000-0x0000000002CB1000-memory.dmp

          Filesize

          4KB

        • memory/1772-45-0x0000000002C80000-0x0000000002C81000-memory.dmp

          Filesize

          4KB

        • memory/1772-44-0x0000000002C90000-0x0000000002C91000-memory.dmp

          Filesize

          4KB

        • memory/1772-42-0x0000000002C40000-0x0000000002C41000-memory.dmp

          Filesize

          4KB

        • memory/1772-43-0x0000000002C60000-0x0000000002C61000-memory.dmp

          Filesize

          4KB

        • memory/1772-40-0x00000000022B0000-0x00000000022B1000-memory.dmp

          Filesize

          4KB

        • memory/1772-39-0x00000000022C0000-0x00000000022C1000-memory.dmp

          Filesize

          4KB

        • memory/1772-53-0x0000000000400000-0x000000000050D000-memory.dmp

          Filesize

          1.1MB

        • memory/1772-55-0x0000000002150000-0x0000000002151000-memory.dmp

          Filesize

          4KB

        • memory/1772-66-0x0000000000400000-0x000000000050D000-memory.dmp

          Filesize

          1.1MB