Analysis
-
max time kernel
119s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
18-10-2024 09:43
General
-
Target
56bbde7cf490ccabf4c5ee11e021ba40_JaffaCakes118.exe
-
Size
420KB
-
MD5
56bbde7cf490ccabf4c5ee11e021ba40
-
SHA1
4e1dab7e6507ec8336bc86f42fd5f4d1c63c4def
-
SHA256
c2d307ca069370489f033ce5d8859290462e66f6b6ecbd6fb5a1b6aa266adc3a
-
SHA512
f8dd905b19a55bcabddb9849616cc16a96fab5d120d52eb85bc48e1933137bbeb90af51bca261a46dbed68aee7d5d27507efcf6484eb56dd58224e015a5c5ca6
-
SSDEEP
6144:SEx6AROKJHi8zKRKfdlO4C4jF9GZJMtGOkq84BVM:SVARxJHi0KRKm4jFAZ9hq84BVM
Malware Config
Signatures
-
Modifies firewall policy service 3 TTPs 2 IoCs
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Suspicious use of SetThreadContext 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 46 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\56bbde7cf490ccabf4c5ee11e021ba40_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\56bbde7cf490ccabf4c5ee11e021ba40_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\56bbde7cf490ccabf4c5ee11e021ba40_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\56bbde7cf490ccabf4c5ee11e021ba40_JaffaCakes118.exe2⤵
- Modifies firewall policy service
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\56bbde7cf490ccabf4c5ee11e021ba40_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\56bbde7cf490ccabf4c5ee11e021ba40_JaffaCakes118.exe -f3⤵
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152KB
-
Filesize
152KB
-
Filesize
152KB
-
Filesize
152KB
-
Filesize
4KB
-
Filesize
152KB
-
Filesize
152KB
-
Filesize
152KB
-
Filesize
152KB
-
Filesize
8KB
-
Filesize
196KB
-
Filesize
296KB
-
Filesize
296KB
-
Filesize
296KB
-
Filesize
296KB
-
Filesize
296KB
-
Filesize
84KB
-
Filesize
84KB
-
Filesize
96KB
-
Filesize
96KB
-
Filesize
56KB
-
Filesize
100KB
-
Filesize
36KB
-
Filesize
36KB
-
Filesize
100KB
-
Filesize
804KB
-
Filesize
96KB
-
Filesize
52KB
-
Filesize
52KB
-
Filesize
56KB
-
Filesize
96KB
-
Filesize
804KB
-
Filesize
84KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
296KB
-
Filesize
100KB
-
Filesize
100KB
-
Filesize
180KB
-
Filesize
180KB
-
Filesize
296KB
-
Filesize
308KB
-
Filesize
804KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
36KB
-
Filesize
296KB
-
Filesize
428KB
-
Filesize
196KB
-
Filesize
196KB
-
Filesize
180KB
-
Filesize
180KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
120KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
120KB
-
Filesize
120KB
-
Filesize
308KB
-
Filesize
144KB
-
Filesize
72KB
-
Filesize
144KB
-
Filesize
120KB
-
Filesize
428KB
-
Filesize
72KB
-
Filesize
308KB
-
Filesize
664KB
-
Filesize
612KB
-
Filesize
612KB
-
Filesize
664KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
296KB
-
Filesize
296KB
-
Filesize
296KB
-
Filesize
296KB
-
Filesize
452KB
-
Filesize
452KB
-
Filesize
308KB
-
Filesize
32KB
-
Filesize
196KB
-
Filesize
296KB