Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
23-11-2024 22:29
General
-
Target
9103ef9b9b1f4cee3d43a4f100d35018_JaffaCakes118.exe
-
Size
1.2MB
-
MD5
9103ef9b9b1f4cee3d43a4f100d35018
-
SHA1
fbaa117c22fb1053abe9234107487ac634b82c82
-
SHA256
55c1833817a413db9316e07c374df3019bbc2792f0dff16d964f3109512eaed2
-
SHA512
3b83d680e0c83df07622d37e60640f377436839132a6f304c6379542e48de951099a0287e221614680d66a10518a208c0f1b0957b0261c72c44aa33b8dc81698
-
SSDEEP
24576:nXWcPsTMuyZZGu0bCUbXVLKN1sowy+Hug45tiEXiBwx:mE4MetbZBWTsjbz45KOx
Malware Config
Signatures
-
ASPack v2.12-2.42 3 IoCs
Detects executables packed with ASPack v2.12-2.42
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL 11 IoCs
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9103ef9b9b1f4cee3d43a4f100d35018_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\9103ef9b9b1f4cee3d43a4f100d35018_JaffaCakes118.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9103ef9b9b1f4cee3d43a4f100d35018_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\9103ef9b9b1f4cee3d43a4f100d35018_JaffaCakes118.exe" -12⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
9KB
MD56ba094067ccabd10f2d16371b482b27e
SHA10b181e9fc182bd40d60a37a4b42f5aeef8a05393
SHA25667317a84467e05bd7bd182d31eac866c743a092d2cfaedacba15e42e948d729a
SHA512ab9c878dd2a219f9e7aacd9ad1136781d4d298f1014b7c2a41389b563ebda37a65fcc9a1f8aa00f8efef625ba8af322393a7056f310e6d1cd0fb86b17a98a76e
-
Filesize
18KB
MD5d7ec5ff93ffb4d309a4ef1d2152b32a3
SHA12b80ef7f5eff6fcdfb1edb52377e3a346c5460ef
SHA256d87638795c1092a7447714a2e95e81b91825d31c6a0339656e7cecedfc4c22a8
SHA51255ab3529b03de7b31bd1403f20ac5e4e4bb565c3c4c9523aa98a44f4bd2d73f4373f379d3897bf6e1124941ee9aabcc68d207a9ffe6afa04ee998496caa9bbcb
-
Filesize
384KB
MD51ed8bb0300e7646a4d19bb036196cb28
SHA14a16c95247c3dd3068b262abc62078ed129c4fe6
SHA2564f9c5b8b6d8a0fb849877adc904e0d3a0f253bdc62b2fdb1c4119f20ebb87a3c
SHA512852dfcb1420df570f5c0b444c2a31a341d10f9c27489d1128d179e6ee055c5623a76ec1d061d0e55f0d8aeaf5a4df5ca07d224c69456ea5da120bce82529ddb0
-
Filesize
417KB
MD5816a0d8fbf1b6693cd49f616559199d9
SHA1fb808122e27ef6d66bced8ee08143ec15f3b9043
SHA256318c078af7739fd9f70ce7e9bf2b52a86038b4c6a1e8d7e8a8b5749d44b7e8ab
SHA51232d1277c235cab3d8c608753452a52a14a922e3ec903b74afa8ea3db8d7460e13e312da4a73ab1c2d222df523b6567c17e95b8ebb631404edabc7e64d7749452
-
Filesize
174KB
MD56e02945f320d4349958fc6b901739c58
SHA13258dcb140855a4b005f63877bf438051fb190d8
SHA25613a23db70f752fe253252fd37dedc350c746e0f7aaf856ae71f256736c473dc3
SHA5127e74dff01cf56e8cb664c075fedcca8aeade7ab09cff63252f9e1e1b8b3734a857c97034e4e8925dca3fc7b8a6df925b40923cffd42b23deebd2432d5063e29c
-
Filesize
944KB
-
Filesize
4KB
-
Filesize
944KB
-
Filesize
1008KB
-
Filesize
944KB
-
Filesize
4KB
-
Filesize
944KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
476KB
-
Filesize
1008KB
-
Filesize
944KB
-
Filesize
476KB
-
Filesize
4KB
