Analysis
-
max time kernel
142s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
-
submitted
28/03/2025, 19:14
General
-
Target
JaffaCakes118_8aefd589efeb7ceb795ca6cc58f9bf20.exe
-
Size
496KB
-
MD5
8aefd589efeb7ceb795ca6cc58f9bf20
-
SHA1
35bb5e50341d3a72e82e996388c89bbaa9d2efbb
-
SHA256
2e3a7739fd9eb2e6bb2f7747918a025e1bbcd3f8c9fd952d0e4a879992084c9c
-
SHA512
d33a443f385345c1659b1e2a2080a9eaf8140117641a03cda7b0ec63ef004ea995fca0fc44b45768ead44ca080f31435aec29a9978c562e061e6ac9d1f03eee0
-
SSDEEP
12288:FmkbnVZIeNyo1BoGJHKnJFgaXdqu3U8OEtOM2ZNtTird:YqbIeNyos4KnJF1XM8OEtOnTEd
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 2 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 5 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 14 IoCs
-
Suspicious use of FindShellTrayWindow 30 IoCs
-
Suspicious use of SendNotifyMessage 22 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8aefd589efeb7ceb795ca6cc58f9bf20.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8aefd589efeb7ceb795ca6cc58f9bf20.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4.exe2⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Hacker.com.cn.exeC:\Windows\Hacker.com.cn.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE"2⤵
-
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
785KB
MD51f4759ec8dc50429ce7127aa292100ae
SHA1c6583bf92638defbbd915689e5c5782014b0cf7f
SHA2562da9359008415a0543c02c744b2dadaeb98f5b356755c0bda9e86317df1e40cc
SHA5123bfcae9241244b655cee125707cbfe13388d4b86bdcc747303b5048d2a19a8f058c3d1192524133048f988553d6c5ae3294f49361f12a535a1b05ecd891298fb
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
904KB
-
Filesize
4KB
-
Filesize
268KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
268KB
-
Filesize
904KB
-
Filesize
64KB
-
Filesize
824KB
-
Filesize
824KB
-
Filesize
824KB
-
Filesize
824KB