Analysis

  • max time kernel
    122s
  • max time network
    128s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    31/10/2024, 13:54

General

  • Target

    83358ea41c0b423fa18db219ebd82ee7_JaffaCakes118.exe

  • Size

    448KB

  • MD5

    83358ea41c0b423fa18db219ebd82ee7

  • SHA1

    d756717c0912dcf2ebe29b8ea6839fbcf3e6a98e

  • SHA256

    80c4f47b95d503b844e8eed23b1298b757fb63e2a0ec40e578f86db8e778278a

  • SHA512

    4ef3a423037d7945d70670c38ef8098e68fedda8c1aeea37848e94d0ee48b5ed2ec117d93eff4da27f17fd4f6c59bcaf2d2211b578534a7da01c2f1065c7a93e

  • SSDEEP

    12288:dg1DKqQ3tz9jshL/PLo6WwfPWFnHUo3pm:m1Dd8HiLnLrzWK0pm

Malware Config

Signatures

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\83358ea41c0b423fa18db219ebd82ee7_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\83358ea41c0b423fa18db219ebd82ee7_JaffaCakes118.exe"
    1⤵
    • Writes to the Master Boot Record (MBR)
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    PID:2872

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\eIntaller\581C551253694edc9F37C03841D2DF8C\Config.ini

          Filesize

          335B

          MD5

          f76305592e685e01ef57d14fde2aa28d

          SHA1

          0791781f1e510069ebe756aeaa53831c0995bea4

          SHA256

          7e6610923ae8706ccead6afb7eb783884c9c7565ff1dd2e8b2b7cebd2d5f4a2a

          SHA512

          0334f7eca562f272666d254e6594d0402980139971cec3f3e6cd9d24fbc7b84579bd56e2849e2c9bad90f4f0b708c1af21a033227e7c8e6a01cc5ab56dcb8a9a

        • memory/2872-2-0x0000000000930000-0x0000000000931000-memory.dmp

          Filesize

          4KB

        • memory/2872-5-0x0000000000930000-0x0000000000931000-memory.dmp

          Filesize

          4KB

        • memory/2872-11-0x0000000000930000-0x0000000000931000-memory.dmp

          Filesize

          4KB

        • memory/2872-10-0x0000000000930000-0x0000000000931000-memory.dmp

          Filesize

          4KB

        • memory/2872-9-0x0000000000930000-0x0000000000931000-memory.dmp

          Filesize

          4KB

        • memory/2872-8-0x0000000000930000-0x0000000000931000-memory.dmp

          Filesize

          4KB

        • memory/2872-7-0x0000000000930000-0x0000000000931000-memory.dmp

          Filesize

          4KB

        • memory/2872-1-0x0000000000930000-0x0000000000931000-memory.dmp

          Filesize

          4KB

        • memory/2872-0-0x0000000000400000-0x000000000051B000-memory.dmp

          Filesize

          1.1MB

        • memory/2872-4-0x0000000000930000-0x0000000000931000-memory.dmp

          Filesize

          4KB

        • memory/2872-12-0x0000000000930000-0x0000000000935000-memory.dmp

          Filesize

          20KB

        • memory/2872-3-0x0000000000930000-0x0000000000931000-memory.dmp

          Filesize

          4KB

        • memory/2872-6-0x0000000000930000-0x0000000000931000-memory.dmp

          Filesize

          4KB

        • memory/2872-28-0x0000000001F90000-0x0000000001F91000-memory.dmp

          Filesize

          4KB

        • memory/2872-27-0x0000000001F80000-0x0000000001F81000-memory.dmp

          Filesize

          4KB

        • memory/2872-35-0x0000000001F60000-0x0000000001F61000-memory.dmp

          Filesize

          4KB

        • memory/2872-34-0x0000000001F70000-0x0000000001F71000-memory.dmp

          Filesize

          4KB

        • memory/2872-33-0x0000000001F50000-0x0000000001F51000-memory.dmp

          Filesize

          4KB

        • memory/2872-32-0x0000000000240000-0x0000000000241000-memory.dmp

          Filesize

          4KB

        • memory/2872-31-0x0000000000230000-0x0000000000231000-memory.dmp

          Filesize

          4KB

        • memory/2872-30-0x0000000001F40000-0x0000000001F41000-memory.dmp

          Filesize

          4KB

        • memory/2872-29-0x0000000000920000-0x0000000000921000-memory.dmp

          Filesize

          4KB

        • memory/2872-36-0x0000000000400000-0x000000000051B000-memory.dmp

          Filesize

          1.1MB