Analysis

  • max time kernel
    117s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    16/10/2024, 20:46

General

  • Target

    4ef048492244f4133c3d706c7637d410_JaffaCakes118.dll

  • Size

    168KB

  • MD5

    4ef048492244f4133c3d706c7637d410

  • SHA1

    4dcb034f48036747c5da9718a69a63e8bc4476fe

  • SHA256

    57b240b0d5f67ecea128750855a72ee96e9e4ace6cbde11d1c9808d8b350ad11

  • SHA512

    68ba48a61a6d4d686e598e375d014ebf83318d7011566c9c3e5b0c1497a76c29ddcf5edd62081fb89d1928136ca8916e3c37eb3405c43798641baf4c200f1946

  • SSDEEP

    3072:lC54Wp/CQb6rfAsbbrMbvT0q8O1cZPzQ7IXMBc+AMP+QfQEhxFyVU7rQDjz:leRp/LI9wvP6bQ7yMP+DE827rM

Malware Config

Signatures

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 13 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\4ef048492244f4133c3d706c7637d410_JaffaCakes118.dll
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1708
    • C:\Windows\SysWOW64\regsvr32.exe
      /s C:\Users\Admin\AppData\Local\Temp\4ef048492244f4133c3d706c7637d410_JaffaCakes118.dll
      2⤵
      • Writes to the Master Boot Record (MBR)
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      PID:2484

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/2484-0-0x0000000010000000-0x000000001003B000-memory.dmp

          Filesize

          236KB

        • memory/2484-1-0x00000000003D0000-0x0000000000400000-memory.dmp

          Filesize

          192KB

        • memory/2484-2-0x0000000000280000-0x0000000000282000-memory.dmp

          Filesize

          8KB