Analysis

  • max time kernel
    140s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    29-11-2024 11:02

General

  • Target

    b0d1ced933fea37bf4ef7861de38857a_JaffaCakes118.exe

  • Size

    515KB

  • MD5

    b0d1ced933fea37bf4ef7861de38857a

  • SHA1

    44b0eb89fe7e889fc9b4021ee94d9a0c35bba0dc

  • SHA256

    f285caa21c237a88f9ce7ee1001dfb4be7ea64fd9a46dac141e7ab271d03f486

  • SHA512

    157dd84df216a1d1e4d8ee2f84795a04920e00a9efcdb985d6030e32714b76b6c759f46ba4d36652e452256097cbc4922e691daa9cb684112e532eb39e617ab0

  • SSDEEP

    6144:cVTkB73lncASaSfEDds9pb98rbyZUfRkizlL3nBE5Wky82FKioUsyeVBxGnO+BFU:cUtc5Sd+t98fOUfRkipLeeUVQ5FnHiL

Malware Config

Signatures

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b0d1ced933fea37bf4ef7861de38857a_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\b0d1ced933fea37bf4ef7861de38857a_JaffaCakes118.exe"
    1⤵
    • Writes to the Master Boot Record (MBR)
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    PID:2220

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\eIntaller\8B2283740EED467798DFE6060B5FEF6C\Config.ini

    Filesize

    337B

    MD5

    3daec153b4f7b60029ba9cf63c2239cc

    SHA1

    5876575fb6d8a9f52ceaea144a28f7079e6fbd5a

    SHA256

    b2ea2f0a4646043aaf6d1e48821a9f23090f29726df3cc85dd4761b5b351889c

    SHA512

    517e2a2bf07b6d1064238333cadf062ac3831dc07ab7be3973ff01c0b3675a9714f2988c96231aa95d750ea98382a7249f004f28cd88dc33d1960d3e2dbc607f

  • memory/2220-0-0x0000000000400000-0x0000000000527000-memory.dmp

    Filesize

    1.2MB

  • memory/2220-37-0x00000000003E0000-0x00000000003E1000-memory.dmp

    Filesize

    4KB

  • memory/2220-36-0x00000000003E0000-0x00000000003E1000-memory.dmp

    Filesize

    4KB

  • memory/2220-38-0x00000000003E0000-0x00000000003E5000-memory.dmp

    Filesize

    20KB

  • memory/2220-55-0x0000000001EA0000-0x0000000001EA1000-memory.dmp

    Filesize

    4KB

  • memory/2220-60-0x0000000000240000-0x0000000000241000-memory.dmp

    Filesize

    4KB

  • memory/2220-65-0x0000000000640000-0x0000000000641000-memory.dmp

    Filesize

    4KB

  • memory/2220-64-0x0000000001E80000-0x0000000001E81000-memory.dmp

    Filesize

    4KB

  • memory/2220-63-0x0000000000400000-0x0000000000527000-memory.dmp

    Filesize

    1.2MB

  • memory/2220-62-0x00000000003D0000-0x00000000003D1000-memory.dmp

    Filesize

    4KB

  • memory/2220-61-0x0000000000630000-0x0000000000631000-memory.dmp

    Filesize

    4KB

  • memory/2220-59-0x0000000000230000-0x0000000000231000-memory.dmp

    Filesize

    4KB

  • memory/2220-58-0x00000000003F0000-0x00000000003F1000-memory.dmp

    Filesize

    4KB

  • memory/2220-57-0x0000000001E90000-0x0000000001E91000-memory.dmp

    Filesize

    4KB

  • memory/2220-56-0x0000000001EA0000-0x0000000001EA1000-memory.dmp

    Filesize

    4KB

  • memory/2220-54-0x0000000001EA0000-0x0000000001EA1000-memory.dmp

    Filesize

    4KB

  • memory/2220-53-0x0000000001EA0000-0x0000000001EA1000-memory.dmp

    Filesize

    4KB

  • memory/2220-52-0x0000000001EA0000-0x0000000001EA1000-memory.dmp

    Filesize

    4KB

  • memory/2220-51-0x0000000001E90000-0x0000000001E91000-memory.dmp

    Filesize

    4KB

  • memory/2220-50-0x0000000001E90000-0x0000000001E91000-memory.dmp

    Filesize

    4KB

  • memory/2220-49-0x0000000001E90000-0x0000000001E91000-memory.dmp

    Filesize

    4KB

  • memory/2220-48-0x0000000001E90000-0x0000000001E91000-memory.dmp

    Filesize

    4KB

  • memory/2220-47-0x0000000001E90000-0x0000000001E91000-memory.dmp

    Filesize

    4KB

  • memory/2220-46-0x0000000001E90000-0x0000000001E91000-memory.dmp

    Filesize

    4KB

  • memory/2220-45-0x0000000001E90000-0x0000000001E91000-memory.dmp

    Filesize

    4KB

  • memory/2220-44-0x0000000001EA0000-0x0000000001EA1000-memory.dmp

    Filesize

    4KB

  • memory/2220-43-0x0000000001EA0000-0x0000000001EA1000-memory.dmp

    Filesize

    4KB

  • memory/2220-42-0x0000000001EA0000-0x0000000001EA1000-memory.dmp

    Filesize

    4KB

  • memory/2220-41-0x0000000001EA0000-0x0000000001EA1000-memory.dmp

    Filesize

    4KB

  • memory/2220-40-0x0000000001E90000-0x0000000001E91000-memory.dmp

    Filesize

    4KB

  • memory/2220-39-0x0000000001E90000-0x0000000001E91000-memory.dmp

    Filesize

    4KB

  • memory/2220-35-0x00000000003E0000-0x00000000003E1000-memory.dmp

    Filesize

    4KB

  • memory/2220-34-0x00000000003E0000-0x00000000003E1000-memory.dmp

    Filesize

    4KB

  • memory/2220-33-0x00000000003E0000-0x00000000003E1000-memory.dmp

    Filesize

    4KB

  • memory/2220-32-0x00000000003E0000-0x00000000003E1000-memory.dmp

    Filesize

    4KB

  • memory/2220-31-0x00000000003E0000-0x00000000003E1000-memory.dmp

    Filesize

    4KB

  • memory/2220-30-0x00000000003E0000-0x00000000003E1000-memory.dmp

    Filesize

    4KB

  • memory/2220-29-0x00000000003E0000-0x00000000003E1000-memory.dmp

    Filesize

    4KB

  • memory/2220-28-0x00000000003E0000-0x00000000003E1000-memory.dmp

    Filesize

    4KB

  • memory/2220-27-0x00000000003E0000-0x00000000003E1000-memory.dmp

    Filesize

    4KB

  • memory/2220-26-0x00000000003E0000-0x00000000003E1000-memory.dmp

    Filesize

    4KB

  • memory/2220-25-0x00000000003E0000-0x00000000003E1000-memory.dmp

    Filesize

    4KB

  • memory/2220-24-0x00000000003E0000-0x00000000003E1000-memory.dmp

    Filesize

    4KB

  • memory/2220-23-0x00000000003E0000-0x00000000003E1000-memory.dmp

    Filesize

    4KB

  • memory/2220-22-0x00000000003E0000-0x00000000003E1000-memory.dmp

    Filesize

    4KB

  • memory/2220-21-0x00000000003E0000-0x00000000003E1000-memory.dmp

    Filesize

    4KB

  • memory/2220-20-0x00000000003E0000-0x00000000003E1000-memory.dmp

    Filesize

    4KB

  • memory/2220-19-0x00000000003E0000-0x00000000003E1000-memory.dmp

    Filesize

    4KB

  • memory/2220-18-0x00000000003E0000-0x00000000003E1000-memory.dmp

    Filesize

    4KB

  • memory/2220-17-0x00000000003E0000-0x00000000003E1000-memory.dmp

    Filesize

    4KB

  • memory/2220-16-0x00000000003E0000-0x00000000003E1000-memory.dmp

    Filesize

    4KB

  • memory/2220-15-0x00000000003E0000-0x00000000003E1000-memory.dmp

    Filesize

    4KB

  • memory/2220-14-0x00000000003E0000-0x00000000003E1000-memory.dmp

    Filesize

    4KB

  • memory/2220-13-0x00000000003E0000-0x00000000003E1000-memory.dmp

    Filesize

    4KB

  • memory/2220-12-0x00000000003E0000-0x00000000003E1000-memory.dmp

    Filesize

    4KB

  • memory/2220-11-0x00000000003E0000-0x00000000003E1000-memory.dmp

    Filesize

    4KB

  • memory/2220-10-0x00000000003E0000-0x00000000003E1000-memory.dmp

    Filesize

    4KB

  • memory/2220-9-0x00000000003E0000-0x00000000003E1000-memory.dmp

    Filesize

    4KB

  • memory/2220-8-0x00000000003E0000-0x00000000003E1000-memory.dmp

    Filesize

    4KB

  • memory/2220-7-0x00000000003E0000-0x00000000003E1000-memory.dmp

    Filesize

    4KB

  • memory/2220-6-0x00000000003E0000-0x00000000003E1000-memory.dmp

    Filesize

    4KB

  • memory/2220-5-0x00000000003E0000-0x00000000003E1000-memory.dmp

    Filesize

    4KB

  • memory/2220-4-0x00000000003E0000-0x00000000003E1000-memory.dmp

    Filesize

    4KB

  • memory/2220-3-0x00000000003E0000-0x00000000003E1000-memory.dmp

    Filesize

    4KB

  • memory/2220-2-0x00000000003E0000-0x00000000003E1000-memory.dmp

    Filesize

    4KB

  • memory/2220-1-0x00000000003E0000-0x00000000003E1000-memory.dmp

    Filesize

    4KB

  • memory/2220-84-0x0000000000400000-0x0000000000527000-memory.dmp

    Filesize

    1.2MB