e72bc1baf00a1e109d03d9eaabddff11d50f65e1f06f1b4602769b0f3feb3579

Analysis

max time kernel
140s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16/04/2024, 16:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f3d63d6ca4e29fd8d18382d51d9df400_JaffaCakes118.exe
Size

499KB
MD5

f3d63d6ca4e29fd8d18382d51d9df400
SHA1

bac1a6e61fbdb86204ebea1b6a1ddb500d2de0c0
SHA256

e72bc1baf00a1e109d03d9eaabddff11d50f65e1f06f1b4602769b0f3feb3579
SHA512

e2ff7255f9103c532735c03634567cc82259e98b1ea1cc93606a71193117df1b5995463d6957a54c2a0a170beaa2d270a44293e6a8bb65f6cb2e4f89ee8650d7
SSDEEP

12288:i6M9nk4yyH1vsq6inXnxNMCLRCpJSEVV3j/yq+jqGOfb4Nt:b4yyVfBqCYpxxj/ykGGU

Score

6^/10

bootkit persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	f3d63d6ca4e29fd8d18382d51d9df400_JaffaCakes118.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1196	2512	WerFault.exe	27

Modifies registry class 3 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	f3d63d6ca4e29fd8d18382d51d9df400_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	f3d63d6ca4e29fd8d18382d51d9df400_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	f3d63d6ca4e29fd8d18382d51d9df400_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 1196	2512	f3d63d6ca4e29fd8d18382d51d9df400_JaffaCakes118.exe	28
PID 2512 wrote to memory of 1196	2512	f3d63d6ca4e29fd8d18382d51d9df400_JaffaCakes118.exe	28
PID 2512 wrote to memory of 1196	2512	f3d63d6ca4e29fd8d18382d51d9df400_JaffaCakes118.exe	28
PID 2512 wrote to memory of 1196	2512	f3d63d6ca4e29fd8d18382d51d9df400_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\f3d63d6ca4e29fd8d18382d51d9df400_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f3d63d6ca4e29fd8d18382d51d9df400_JaffaCakes118.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2512 -s 248
  2⤵
  - Program crash
  PID:1196

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2512-0-0x0000000000400000-0x0000000000552000-memory.dmp

Filesize
1.3MB

Download
memory/2512-1-0x0000000000670000-0x0000000000671000-memory.dmp

Filesize
4KB

Download
memory/2512-2-0x0000000000670000-0x0000000000671000-memory.dmp

Filesize
4KB

Download
memory/2512-3-0x0000000000670000-0x0000000000671000-memory.dmp

Filesize
4KB

Download
memory/2512-4-0x0000000000670000-0x0000000000671000-memory.dmp

Filesize
4KB

Download
memory/2512-5-0x0000000000670000-0x0000000000671000-memory.dmp

Filesize
4KB

Download
memory/2512-6-0x0000000000670000-0x0000000000671000-memory.dmp

Filesize
4KB

Download
memory/2512-8-0x0000000000670000-0x0000000000671000-memory.dmp

Filesize
4KB

Download
memory/2512-7-0x0000000000670000-0x0000000000671000-memory.dmp

Filesize
4KB

Download
memory/2512-9-0x0000000000670000-0x0000000000671000-memory.dmp

Filesize
4KB

Download
memory/2512-11-0x0000000000670000-0x0000000000671000-memory.dmp

Filesize
4KB

Download
memory/2512-10-0x0000000000670000-0x0000000000671000-memory.dmp

Filesize
4KB

Download
memory/2512-12-0x0000000000670000-0x0000000000671000-memory.dmp

Filesize
4KB

Download
memory/2512-13-0x0000000000670000-0x0000000000671000-memory.dmp

Filesize
4KB

Download
memory/2512-15-0x0000000000670000-0x0000000000671000-memory.dmp

Filesize
4KB

Download
memory/2512-14-0x0000000000670000-0x0000000000671000-memory.dmp

Filesize
4KB

Download
memory/2512-16-0x0000000000670000-0x0000000000671000-memory.dmp

Filesize
4KB

Download
memory/2512-17-0x0000000000670000-0x0000000000671000-memory.dmp

Filesize
4KB

Download
memory/2512-18-0x0000000000670000-0x0000000000671000-memory.dmp

Filesize
4KB

Download
memory/2512-20-0x0000000000670000-0x0000000000671000-memory.dmp

Filesize
4KB

Download
memory/2512-22-0x0000000000670000-0x0000000000671000-memory.dmp

Filesize
4KB

Download
memory/2512-21-0x0000000000670000-0x0000000000671000-memory.dmp

Filesize
4KB

Download
memory/2512-19-0x0000000000670000-0x0000000000671000-memory.dmp

Filesize
4KB

Download
memory/2512-23-0x0000000000670000-0x0000000000671000-memory.dmp

Filesize
4KB

Download
memory/2512-24-0x0000000000670000-0x0000000000671000-memory.dmp

Filesize
4KB

Download
memory/2512-25-0x0000000000670000-0x0000000000671000-memory.dmp

Filesize
4KB

Download
memory/2512-26-0x0000000000670000-0x0000000000671000-memory.dmp

Filesize
4KB

Download
memory/2512-27-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/2512-28-0x0000000000660000-0x0000000000661000-memory.dmp

Filesize
4KB

Download
memory/2512-29-0x0000000000400000-0x0000000000552000-memory.dmp

Filesize
1.3MB

Download
memory/2512-30-0x0000000000670000-0x0000000000671000-memory.dmp

Filesize
4KB

Download
memory/2512-32-0x0000000000670000-0x0000000000671000-memory.dmp

Filesize
4KB

Download
memory/2512-33-0x0000000000670000-0x0000000000671000-memory.dmp

Filesize
4KB

Download
memory/2512-34-0x0000000000670000-0x0000000000671000-memory.dmp

Filesize
4KB

Download
memory/2512-35-0x0000000000670000-0x0000000000671000-memory.dmp

Filesize
4KB

Download
memory/2512-37-0x0000000000670000-0x0000000000671000-memory.dmp

Filesize
4KB

Download
memory/2512-36-0x0000000000670000-0x0000000000671000-memory.dmp

Filesize
4KB

Download
memory/2512-39-0x0000000000670000-0x0000000000671000-memory.dmp

Filesize
4KB

Download
memory/2512-38-0x0000000000670000-0x0000000000671000-memory.dmp

Filesize
4KB

Download
memory/2512-41-0x0000000000670000-0x0000000000671000-memory.dmp

Filesize
4KB

Download
memory/2512-40-0x0000000000670000-0x0000000000671000-memory.dmp

Filesize
4KB

Download
memory/2512-42-0x0000000000670000-0x0000000000671000-memory.dmp

Filesize
4KB

Download
memory/2512-43-0x0000000000670000-0x0000000000671000-memory.dmp

Filesize
4KB

Download
memory/2512-45-0x0000000000670000-0x0000000000671000-memory.dmp

Filesize
4KB

Download
memory/2512-44-0x0000000000670000-0x0000000000671000-memory.dmp

Filesize
4KB

Download
memory/2512-47-0x0000000000670000-0x0000000000671000-memory.dmp

Filesize
4KB

Download
memory/2512-46-0x0000000000670000-0x0000000000671000-memory.dmp

Filesize
4KB

Download
memory/2512-49-0x0000000000670000-0x0000000000671000-memory.dmp

Filesize
4KB

Download
memory/2512-48-0x0000000000670000-0x0000000000671000-memory.dmp

Filesize
4KB

Download
memory/2512-51-0x0000000000670000-0x0000000000671000-memory.dmp

Filesize
4KB

Download
memory/2512-50-0x0000000000670000-0x0000000000671000-memory.dmp

Filesize
4KB

Download
memory/2512-53-0x0000000000670000-0x0000000000671000-memory.dmp

Filesize
4KB

Download
memory/2512-52-0x0000000000670000-0x0000000000671000-memory.dmp

Filesize
4KB

Download
memory/2512-55-0x0000000000670000-0x0000000000671000-memory.dmp

Filesize
4KB

Download
memory/2512-54-0x0000000000670000-0x0000000000671000-memory.dmp

Filesize
4KB

Download
memory/2512-57-0x0000000000670000-0x0000000000671000-memory.dmp

Filesize
4KB

Download
memory/2512-56-0x0000000000670000-0x0000000000671000-memory.dmp

Filesize
4KB

Download
memory/2512-59-0x0000000000670000-0x0000000000671000-memory.dmp

Filesize
4KB

Download
memory/2512-58-0x0000000000670000-0x0000000000671000-memory.dmp

Filesize
4KB

Download
memory/2512-61-0x0000000000670000-0x0000000000671000-memory.dmp

Filesize
4KB

Download
memory/2512-60-0x0000000000670000-0x0000000000671000-memory.dmp

Filesize
4KB

Download
memory/2512-62-0x0000000000670000-0x0000000000671000-memory.dmp

Filesize
4KB

Download
memory/2512-63-0x0000000000670000-0x0000000000671000-memory.dmp

Filesize
4KB

Download
memory/2512-64-0x0000000000670000-0x0000000000671000-memory.dmp

Filesize
4KB

Download
memory/2512-65-0x0000000000670000-0x0000000000671000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads