Analysis

  • max time kernel
    140s
  • max time network
    138s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/10/2024, 13:54

General

  • Target

    83358ea41c0b423fa18db219ebd82ee7_JaffaCakes118.exe

  • Size

    448KB

  • MD5

    83358ea41c0b423fa18db219ebd82ee7

  • SHA1

    d756717c0912dcf2ebe29b8ea6839fbcf3e6a98e

  • SHA256

    80c4f47b95d503b844e8eed23b1298b757fb63e2a0ec40e578f86db8e778278a

  • SHA512

    4ef3a423037d7945d70670c38ef8098e68fedda8c1aeea37848e94d0ee48b5ed2ec117d93eff4da27f17fd4f6c59bcaf2d2211b578534a7da01c2f1065c7a93e

  • SSDEEP

    12288:dg1DKqQ3tz9jshL/PLo6WwfPWFnHUo3pm:m1Dd8HiLnLrzWK0pm

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\83358ea41c0b423fa18db219ebd82ee7_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\83358ea41c0b423fa18db219ebd82ee7_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Writes to the Master Boot Record (MBR)
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4112

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\eIntaller\77F1994E321045db9F59B9EF736A3A0B\Config.ini

          Filesize

          335B

          MD5

          f76305592e685e01ef57d14fde2aa28d

          SHA1

          0791781f1e510069ebe756aeaa53831c0995bea4

          SHA256

          7e6610923ae8706ccead6afb7eb783884c9c7565ff1dd2e8b2b7cebd2d5f4a2a

          SHA512

          0334f7eca562f272666d254e6594d0402980139971cec3f3e6cd9d24fbc7b84579bd56e2849e2c9bad90f4f0b708c1af21a033227e7c8e6a01cc5ab56dcb8a9a

        • memory/4112-0-0x0000000000400000-0x000000000051B000-memory.dmp

          Filesize

          1.1MB

        • memory/4112-34-0x0000000002470000-0x0000000002471000-memory.dmp

          Filesize

          4KB

        • memory/4112-35-0x0000000002470000-0x0000000002471000-memory.dmp

          Filesize

          4KB

        • memory/4112-42-0x00000000024E0000-0x00000000024E1000-memory.dmp

          Filesize

          4KB

        • memory/4112-57-0x00000000024A0000-0x00000000024A1000-memory.dmp

          Filesize

          4KB

        • memory/4112-56-0x00000000024B0000-0x00000000024B1000-memory.dmp

          Filesize

          4KB

        • memory/4112-55-0x0000000002490000-0x0000000002491000-memory.dmp

          Filesize

          4KB

        • memory/4112-54-0x00000000007B0000-0x00000000007B1000-memory.dmp

          Filesize

          4KB

        • memory/4112-53-0x00000000007A0000-0x00000000007A1000-memory.dmp

          Filesize

          4KB

        • memory/4112-52-0x0000000002480000-0x0000000002481000-memory.dmp

          Filesize

          4KB

        • memory/4112-50-0x00000000024C0000-0x00000000024C1000-memory.dmp

          Filesize

          4KB

        • memory/4112-3-0x0000000002470000-0x0000000002471000-memory.dmp

          Filesize

          4KB

        • memory/4112-49-0x00000000024E0000-0x00000000024E1000-memory.dmp

          Filesize

          4KB

        • memory/4112-48-0x00000000024E0000-0x00000000024E1000-memory.dmp

          Filesize

          4KB

        • memory/4112-47-0x00000000024E0000-0x00000000024E1000-memory.dmp

          Filesize

          4KB

        • memory/4112-46-0x00000000024E0000-0x00000000024E1000-memory.dmp

          Filesize

          4KB

        • memory/4112-45-0x00000000024E0000-0x00000000024E1000-memory.dmp

          Filesize

          4KB

        • memory/4112-44-0x00000000024E0000-0x00000000024E1000-memory.dmp

          Filesize

          4KB

        • memory/4112-43-0x00000000024E0000-0x00000000024E1000-memory.dmp

          Filesize

          4KB

        • memory/4112-41-0x00000000024E0000-0x00000000024E1000-memory.dmp

          Filesize

          4KB

        • memory/4112-40-0x00000000024E0000-0x00000000024E1000-memory.dmp

          Filesize

          4KB

        • memory/4112-39-0x00000000024E0000-0x00000000024E1000-memory.dmp

          Filesize

          4KB

        • memory/4112-38-0x00000000024E0000-0x00000000024E1000-memory.dmp

          Filesize

          4KB

        • memory/4112-37-0x00000000024C0000-0x00000000024C1000-memory.dmp

          Filesize

          4KB

        • memory/4112-36-0x0000000002470000-0x0000000002475000-memory.dmp

          Filesize

          20KB

        • memory/4112-51-0x0000000002460000-0x0000000002461000-memory.dmp

          Filesize

          4KB

        • memory/4112-33-0x0000000002470000-0x0000000002471000-memory.dmp

          Filesize

          4KB

        • memory/4112-32-0x0000000002470000-0x0000000002471000-memory.dmp

          Filesize

          4KB

        • memory/4112-31-0x0000000002470000-0x0000000002471000-memory.dmp

          Filesize

          4KB

        • memory/4112-30-0x0000000002470000-0x0000000002471000-memory.dmp

          Filesize

          4KB

        • memory/4112-29-0x0000000002470000-0x0000000002471000-memory.dmp

          Filesize

          4KB

        • memory/4112-28-0x0000000002470000-0x0000000002471000-memory.dmp

          Filesize

          4KB

        • memory/4112-27-0x0000000002470000-0x0000000002471000-memory.dmp

          Filesize

          4KB

        • memory/4112-26-0x0000000002470000-0x0000000002471000-memory.dmp

          Filesize

          4KB

        • memory/4112-25-0x0000000002470000-0x0000000002471000-memory.dmp

          Filesize

          4KB

        • memory/4112-24-0x0000000002470000-0x0000000002471000-memory.dmp

          Filesize

          4KB

        • memory/4112-23-0x0000000002470000-0x0000000002471000-memory.dmp

          Filesize

          4KB

        • memory/4112-22-0x0000000002470000-0x0000000002471000-memory.dmp

          Filesize

          4KB

        • memory/4112-21-0x0000000002470000-0x0000000002471000-memory.dmp

          Filesize

          4KB

        • memory/4112-20-0x0000000002470000-0x0000000002471000-memory.dmp

          Filesize

          4KB

        • memory/4112-19-0x0000000002470000-0x0000000002471000-memory.dmp

          Filesize

          4KB

        • memory/4112-18-0x0000000002470000-0x0000000002471000-memory.dmp

          Filesize

          4KB

        • memory/4112-17-0x0000000002470000-0x0000000002471000-memory.dmp

          Filesize

          4KB

        • memory/4112-16-0x0000000002470000-0x0000000002471000-memory.dmp

          Filesize

          4KB

        • memory/4112-15-0x0000000002470000-0x0000000002471000-memory.dmp

          Filesize

          4KB

        • memory/4112-14-0x0000000002470000-0x0000000002471000-memory.dmp

          Filesize

          4KB

        • memory/4112-13-0x0000000002470000-0x0000000002471000-memory.dmp

          Filesize

          4KB

        • memory/4112-12-0x0000000002470000-0x0000000002471000-memory.dmp

          Filesize

          4KB

        • memory/4112-11-0x0000000002470000-0x0000000002471000-memory.dmp

          Filesize

          4KB

        • memory/4112-10-0x0000000002470000-0x0000000002471000-memory.dmp

          Filesize

          4KB

        • memory/4112-9-0x0000000002470000-0x0000000002471000-memory.dmp

          Filesize

          4KB

        • memory/4112-8-0x0000000002470000-0x0000000002471000-memory.dmp

          Filesize

          4KB

        • memory/4112-7-0x0000000002470000-0x0000000002471000-memory.dmp

          Filesize

          4KB

        • memory/4112-6-0x0000000002470000-0x0000000002471000-memory.dmp

          Filesize

          4KB

        • memory/4112-5-0x0000000002470000-0x0000000002471000-memory.dmp

          Filesize

          4KB

        • memory/4112-4-0x0000000002470000-0x0000000002471000-memory.dmp

          Filesize

          4KB

        • memory/4112-2-0x0000000002470000-0x0000000002471000-memory.dmp

          Filesize

          4KB

        • memory/4112-1-0x0000000002470000-0x0000000002471000-memory.dmp

          Filesize

          4KB

        • memory/4112-72-0x0000000000400000-0x000000000051B000-memory.dmp

          Filesize

          1.1MB

        • memory/4112-73-0x0000000002470000-0x0000000002471000-memory.dmp

          Filesize

          4KB

        • memory/4112-74-0x00000000024E0000-0x00000000024E1000-memory.dmp

          Filesize

          4KB