91ca8dc5b22a839393c53d996661e06f58d772e3601c8a53e7535226e93fdd48

Analysis

max time kernel
31s
max time network
17s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19-04-2024 06:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f9bc8cac9357c61baee9b9033092b2b4_JaffaCakes118.exe
Size

181KB
MD5

f9bc8cac9357c61baee9b9033092b2b4
SHA1

b7953dec774e924cdeb36d6b9c2a40c508514686
SHA256

91ca8dc5b22a839393c53d996661e06f58d772e3601c8a53e7535226e93fdd48
SHA512

e3e2162f71bb92f53c5671fc85543ce5396616de878a6a475ac30d7033b71537f80efdadcc0a007419eeb5b29abf41d784ee6da09f01b9f911ccd48f961cb59f
SSDEEP

3072:qeaQ7OhLMyCkyUjixo7bIANF2wJzcLlr02+9edM7shg22YpgW:q7BpM3kzhxz79edLh

Score

6^/10

bootkit persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1542.003

Processes:

f9bc8cac9357c61baee9b9033092b2b4_JaffaCakes118.exe

description ioc process

File opened for modification \??\physicaldrive0 f9bc8cac9357c61baee9b9033092b2b4_JaffaCakes118.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

f9bc8cac9357c61baee9b9033092b2b4_JaffaCakes118.exe

pid process

2732 f9bc8cac9357c61baee9b9033092b2b4_JaffaCakes118.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

f9bc8cac9357c61baee9b9033092b2b4_JaffaCakes118.exe

description pid process

Token: SeShutdownPrivilege 2732 f9bc8cac9357c61baee9b9033092b2b4_JaffaCakes118.exe

description	ioc	process
File opened for modification	\??\physicaldrive0	f9bc8cac9357c61baee9b9033092b2b4_JaffaCakes118.exe

pid	process
2732	f9bc8cac9357c61baee9b9033092b2b4_JaffaCakes118.exe

description	pid	process
Token: SeShutdownPrivilege	2732	f9bc8cac9357c61baee9b9033092b2b4_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\f9bc8cac9357c61baee9b9033092b2b4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f9bc8cac9357c61baee9b9033092b2b4_JaffaCakes118.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
PID:2732

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2732-1-0x00000000001B0000-0x00000000001F1000-memory.dmp

Filesize
260KB

Download
memory/2732-0-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2732-2-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download