Analysis
-
max time kernel
141s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
17/10/2024, 16:21
General
-
Target
52996a3127163f873d0c636dbf3f9b18_JaffaCakes118.exe
-
Size
110KB
-
MD5
52996a3127163f873d0c636dbf3f9b18
-
SHA1
72bc4fa68521a3280c8b14207f950c3ce9c42e3a
-
SHA256
f5e03c01478ea2c3599be47fd10492651ec0b8fce41ce5cb02f9acb88aa71e1b
-
SHA512
be58662efdccff6b896130e7c6899e5f40b416ca8e39a5e9cd533428e4faee30069ecc3bb1462f0682a389708e9deaabb23ccc964cd812c22203bcbc55d43ddb
-
SSDEEP
1536:SFzamKJ/9x9LUGwZt0Ej5+k7uArgqXxwqxzLRsvr2DW44Rjq4v9lWyiKY7tZ26w+:S9amc9x9gr0xkXxz1svKDL4R1qpQ2U3
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Drops file in System32 directory 2 IoCs
-
Drops file in Windows directory 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: LoadsDriver 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\52996a3127163f873d0c636dbf3f9b18_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\52996a3127163f873d0c636dbf3f9b18_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c delplme.bat2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
-
-
C:\Windows\avp.exeC:\Windows\avp.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
306B
MD533a074fea862f4a620bde29a305e0f0d
SHA1e59af972119de138d8f2bc9b355bb202f19c3a97
SHA25696ca9a452eb4a734e6abca2b7da56f61f391ed28d1a5559bc85a61ed29cf09ff
SHA5126bbff8fa613722010f39c9c3b521dc93e0ca43db1dd157c662c2303b91e69e338568917213da5db0a8446e1823ce5a524dd13291e521e5077dbc815c0efdd3eb
-
Filesize
18KB
MD51c005db3de9c9adc32f4e74dbc278dac
SHA1d0711580dcd2eaf24329ef9e08f06971c0cbd16a
SHA256611e13801520f05f2aaf4387e9c77dd38133cb3ca5d45d3d8dad06432c87341e
SHA51224e34f8caf205dfc619b4af2e92cf2f233e6c4f303b926a2bbcc5d071f124ce8ca3afe969aec4cba260b209745c39d5968ee420ee29e017ecbd0e274046e363f
-
Filesize
238KB
MD593c75be57b0d7b0ddfb72a87eca94631
SHA15db66fd54bcc8541d9398b2c0e631d42e28c7669
SHA256650bbd920701bcb32a135fc4ef0b7fec510c1771fca44f773afd534d19b31e07
SHA512f2e8b9346263b2b82c02ca87f8ff702802e5956adbf8070ebeab734772916465294fd5ffe2ebd2c345b01db3cbd4ef8dbc10381e17c49526363044f9459d7310
-
Filesize
468KB
-
Filesize
288KB
-
Filesize
468KB
-
Filesize
48KB
-
Filesize
48KB
-
Filesize
48KB
-
Filesize
48KB
-
Filesize
48KB
-
Filesize
48KB
-
Filesize
48KB
-
Filesize
48KB
-
Filesize
48KB
-
Filesize
48KB
-
Filesize
48KB
-
Filesize
48KB