Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20250207-en -
resource tags
-
submitted
28/03/2025, 15:30
General
-
Target
JaffaCakes118_8acde77f6157d8f53783dfab311370cc.exe
-
Size
1.2MB
-
MD5
8acde77f6157d8f53783dfab311370cc
-
SHA1
6fed2cb5d25332c3a193b6903fe44a45cbd7c1bc
-
SHA256
919494303f059d91e52ec0bb56c9b5c33f46cb479e65bbc560cc4817b6fcc8ee
-
SHA512
eb80dbe138d76b4313aa82f3d00312bdd670fc67ec4e14ad6601206b71fb6668b0e7cac31d12c5c369c1ff50fe78e9e96a70f1089938011d1cf1990446519161
-
SSDEEP
24576:Q+3dwWxKk9+7GefVl9UygEOEpd70wRlsUiXLLNwUaXcXrnXM82p:ZtjeZUDFEMIl0XNw0M82
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 3 IoCs
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8acde77f6157d8f53783dfab311370cc.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8acde77f6157d8f53783dfab311370cc.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\demo.comC:\Users\Admin\AppData\Local\Temp\demo.com2⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\demo.bat3⤵
- System Location Discovery: System Language Discovery
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
58KB
MD560ead979318a5effb7774fbcc2f23b50
SHA12d6df81c79aa75d771bffea6c9318848cfbe186b
SHA256b2e5f4756d96c0060364ae70e8d0e52605b6aaeacb8c4b9894ad279e24c3a346
SHA5124fa9ad0692b6553bf956ee6fff8d6948bef0a2fb1cfc97920f6cdbab6febb1f9070c6d8b03c387d09bdc6868278626f40ca35cd0685decf8a510c071d1582650
-
Filesize
170B
MD5f283d0ec5d947ec31fe5bbe78b07c6f8
SHA1b243495f70100bd3c1641af2b09490d28d3c4c74
SHA256878c53b547d0e0d54b61549654f6be437e368b3d2313fefa8e9368f92e6c1b6b
SHA5127c3a967b2ecf6da8be37965b67eecbf7c21dec1dbb54c5f892ce9348c49b28f276e207dd2905fa9dfaa62d04fb6013d7c1c2007efe83b718e94c98c793a0a31e
-
Filesize
40B
MD5e2b9e501f4b245db43957f5575ab3675
SHA1540a6d4aac18ff3d16e309ebdae5904e6b953388
SHA2561c3c7b000c1d220ea16761904df29881e89debb3f660e5a7bf585d64f9222eef
SHA512a2e3a29d1938edfd6548a4e408ddc551b8931ce2054fd2fa16f3a97a4e76773562d3c2a322d7c731d0427f68ca39ae5decc8746560bd930d1092e18063323ae1
-
Filesize
162KB
MD5bc9ae1258b839cb8924e005cc1ee02d1
SHA1db74d2958f56fd9257462f3c3a887da018d72c0c
SHA2560a3f9a12400c6854f651a36005b220bbf3584f4217d4374ab58591ae6eaa3d4c
SHA512c42b5faa9943df8430489ade63307ba1e4a8a04a31c27155e44eafec01109ee8ff101670d3d3fc59fc47f67a250e8cdce3d4d17d25adb585c13e5ea163644a2f
-
Filesize
468KB
-
Filesize
12.6MB
-
Filesize
12.6MB
-
Filesize
12.6MB
-
Filesize
12.6MB
-
Filesize
12.6MB
-
Filesize
12.6MB
-
Filesize
12.6MB
-
Filesize
4KB
-
Filesize
12.6MB
-
Filesize
12.6MB
-
Filesize
468KB
-
Filesize
468KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
12.6MB
-
Filesize
12.6MB
-
Filesize
12.6MB
-
Filesize
12.6MB
-
Filesize
12.6MB
-
Filesize
12.6MB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
12KB
-
Filesize
12KB
-
Filesize
468KB
-
Filesize
4KB
-
Filesize
12KB
-
Filesize
12KB
-
Filesize
468KB