f285caa21c237a88f9ce7ee1001dfb4be7ea64fd9a46dac141e7ab271d03f486

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
29-11-2024 11:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b0d1ced933fea37bf4ef7861de38857a_JaffaCakes118.exe
Size

515KB
MD5

b0d1ced933fea37bf4ef7861de38857a
SHA1

44b0eb89fe7e889fc9b4021ee94d9a0c35bba0dc
SHA256

f285caa21c237a88f9ce7ee1001dfb4be7ea64fd9a46dac141e7ab271d03f486
SHA512

157dd84df216a1d1e4d8ee2f84795a04920e00a9efcdb985d6030e32714b76b6c759f46ba4d36652e452256097cbc4922e691daa9cb684112e532eb39e617ab0
SSDEEP

6144:cVTkB73lncASaSfEDds9pb98rbyZUfRkizlL3nBE5Wky82FKioUsyeVBxGnO+BFU:cUtc5Sd+t98fOUfRkipLeeUVQ5FnHiL

Score

6^/10

bootkit discovery persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

Processes:

b0d1ced933fea37bf4ef7861de38857a_JaffaCakes118.exe

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	b0d1ced933fea37bf4ef7861de38857a_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

b0d1ced933fea37bf4ef7861de38857a_JaffaCakes118.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b0d1ced933fea37bf4ef7861de38857a_JaffaCakes118.exe

Modifies registry class 3 IoCs

Processes:

b0d1ced933fea37bf4ef7861de38857a_JaffaCakes118.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	b0d1ced933fea37bf4ef7861de38857a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	b0d1ced933fea37bf4ef7861de38857a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	b0d1ced933fea37bf4ef7861de38857a_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\b0d1ced933fea37bf4ef7861de38857a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b0d1ced933fea37bf4ef7861de38857a_JaffaCakes118.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2508

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\eIntaller\EE6DDCD5B21445639FC1B82A3A5CBF23\Config.ini

Filesize
337B

MD5
3daec153b4f7b60029ba9cf63c2239cc

SHA1
5876575fb6d8a9f52ceaea144a28f7079e6fbd5a

SHA256
b2ea2f0a4646043aaf6d1e48821a9f23090f29726df3cc85dd4761b5b351889c

SHA512
517e2a2bf07b6d1064238333cadf062ac3831dc07ab7be3973ff01c0b3675a9714f2988c96231aa95d750ea98382a7249f004f28cd88dc33d1960d3e2dbc607f

Download Submit
memory/2508-4-0x0000000000400000-0x0000000000527000-memory.dmp

Filesize
1.2MB

Download
memory/2508-2-0x0000000000400000-0x0000000000527000-memory.dmp

Filesize
1.2MB

Download
memory/2508-3-0x0000000000400000-0x0000000000527000-memory.dmp

Filesize
1.2MB

Download
memory/2508-6-0x0000000000400000-0x0000000000527000-memory.dmp

Filesize
1.2MB

Download
memory/2508-5-0x0000000000400000-0x0000000000527000-memory.dmp

Filesize
1.2MB

Download
memory/2508-0-0x0000000000400000-0x0000000000527000-memory.dmp

Filesize
1.2MB

Download
memory/2508-7-0x0000000000400000-0x0000000000527000-memory.dmp

Filesize
1.2MB

Download
memory/2508-1-0x00000000004C6000-0x00000000004C7000-memory.dmp

Filesize
4KB

Download
memory/2508-27-0x0000000000400000-0x0000000000527000-memory.dmp

Filesize
1.2MB

Download
memory/2508-28-0x0000000000400000-0x0000000000527000-memory.dmp

Filesize
1.2MB

Download
memory/2508-26-0x0000000000400000-0x0000000000527000-memory.dmp

Filesize
1.2MB

Download
memory/2508-29-0x00000000004C6000-0x00000000004C7000-memory.dmp

Filesize
4KB

Download