Analysis
-
max time kernel
117s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
01-11-2024 09:20
General
-
Target
8457c46d0f4eb3d95356d3d5f27d3a9d_JaffaCakes118.exe
-
Size
1.6MB
-
MD5
8457c46d0f4eb3d95356d3d5f27d3a9d
-
SHA1
f81a43979fd664d820d136cb0731180b7edf7230
-
SHA256
6133595b57c88c017f35c670251425f4db837c7efd15d5de260db29da64f26ea
-
SHA512
9ce831cb5bff53278ed4a71166704628a2b676aa9a4c612af883c742948286089292aac8f6d9b7d01d620a7ca13e57ecf0dbbf7ef5d0595fc16464a5920cf3db
-
SSDEEP
49152:NZcX0JOG8smOxRUnTn14a93CMWRVQyVeLsduKLiwum:NekUG8smOPUnTn14ICpLQykLeuKLiU
Malware Config
Signatures
-
Loads dropped DLL 9 IoCs
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8457c46d0f4eb3d95356d3d5f27d3a9d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8457c46d0f4eb3d95356d3d5f27d3a9d_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
328KB
MD5cbd788f4c71b9776660d6e8473ae0e09
SHA10189cd47bfa5d1cac0d7f1a33953d279f60b02bf
SHA256db0a6d7b75503daaf93c8e62ce67abd3afd57daaef4a448ec25a43d1de69e47e
SHA51284bc02c67e3a3a9f77418b25afe7ec55e5bb5ca5a6c05503d94dffa57a30c7608e79bb4f83fe91c39ccce16872df2b3f9e7e5a8eafb4f563b1f961b93e9b8c94
-
Filesize
104KB
MD59812f11ad717a56e1b28d863b455bef6
SHA1268931ec7f8d235d0fb5192113e0b5690169e64c
SHA256bd4e8bf3c7b37bcb83ebaaa4532466707ae5746b9ec88708ae1e45aa6a4b8e4a
SHA5129f1382352014f6fbfa96a9a1afdb7b77b31dc3fd264953c6d0be99cc3e2435923719302517066f80e3a21733dd3c2679b8f354d0626cec463971ea71188dd552
-
Filesize
212KB
MD54c9e8f81bf741a61915d0d4fc49d595e
SHA1d033008b3a0e5d3fc8876e0423ee5509ecb3897c
SHA256951d725f4a12cd4ff713ca147fa3be08a02367db6731283c3f1ba30445990129
SHA512cf2c6f8f471c8a5aad563bc257035515860689b73ce343599c7713de8bc8338a031a722f366e005bc1907d6fc97b68b8b415e8ff05b7324fb1040c5dc02315d7
-
Filesize
112KB
MD56d4b2e73f6f8ecff02f19f7e8ef9a8c7
SHA109c32ca167136a17fd69df8c525ea5ffeca6c534
SHA256fe5783e64aa70fac10c2e42d460732d9770534357329d8bc78576557c165f040
SHA5122fd7a95cb632e9c4ac6b34e5b6b875aae94e73cd4b1f213e78f46dadab4846227a030776461bca08f9d75a1d61a0d45427f7b0c8b71406b7debc14db04b2ce04
-
Filesize
216KB
MD5cba933625bfa502fc4a1d9f34e1e4473
SHA15319194388c0e53321f99f1541b97af191999a09
SHA25625549c7781b3f1b92e73b0ea721d177207cce914a66f3229a71291f2eb160013
SHA512f5fb4b97c4f68a20e0847e6528740ce659c4501726f3b2dff1ac83e88a3b7198099da03edb0f069cd4af7ed568a2373597b235cd239895addfa5226d3a444142
-
Filesize
460KB
MD56eb20bb6cafd6d31e871ed3abd65a59c
SHA1ae6495ea4241bcde20e415f2940313785a4a10d2
SHA2562b3fe250f07229eaa58d1bc0c4ac103ba69ad622c27410151ce1d6d46a174bae
SHA512562edc1f058bc280333a6659fceb5a51b3a40bea7aca87db09b0cc1ca1966f26f2a7e4760b944e2502e20257544f85cf9c32f583f1dec06271a35dcfb8fa90f4
-
Filesize
380KB
MD507f0db2727c8288cd2cf7c4cf352708d
SHA1caf2d1b631c785c1f6f01189cf841fc2661666ed
SHA2563c18183857979a2b5664d3f852f74e3f31f0626720654914453e964938e18f5e
SHA512b81029a2968663a180feca2e3e47f4736f87a7cc73e6a9153aa227b91d963e077f44c5a289b9f64d6b481b7bd5ccb4bcb762048a4f29810c1f4fd4e6106cb0d3
-
Filesize
192KB
MD50503d44bada9a0c7138b3f7d3ab90693
SHA1c4ea03151eeedd1c84beaa06e73faa9c1e9574fc
SHA2567c077b6806738e62a9c2e38cc2ffefefd362049e3780b06a862210f1350d003e
SHA512f14dfa273b514753312e1dfc873ac501d6aa7bbd17cd63d16f3bcb9caddcb5ea349c072e73448a2beb3b1010c674be9c8ad22257d8c7b65a3a05e77e69d3b7a8
-
Filesize
1.1MB
MD5638e737b2293cf7b1f14c0b4fb1f3289
SHA1f8e2223348433b992a8c42c4a7a9fb4b5c1158bc
SHA256baad4798c3ab24dec8f0ac3cde48e2fee2e2dffa60d2b2497cd295cd6319fd5b
SHA5124d714a0980238c49af10376ff26ec9e6415e7057925b32ec1c24780c3671047ac5b5670e46c1c6cf9f160519be8f37e1e57f05c30c6c4bda3b275b143aa0bf12
-
Filesize
760KB
-
Filesize
272KB
-
Filesize
760KB
-
Filesize
760KB
-
Filesize
524KB
-
Filesize
140KB
-
Filesize
444KB
-
Filesize
760KB
-
Filesize
4KB
-
Filesize
120KB
-
Filesize
224KB
-
Filesize
20KB
-
Filesize
760KB
-
Filesize
388KB
-
Filesize
760KB
-
Filesize
120KB
-
Filesize
252KB
-
Filesize
760KB
-
Filesize
760KB
-
Filesize
140KB