5078e7fe9f4608b1c09410fb28481ec5902100001408f3c7ede010861dfee0d3

General

Target

fa89f8791dfaf4ab8ef219bffd508b8e_JaffaCakes118.exe
Size

1.2MB
MD5

fa89f8791dfaf4ab8ef219bffd508b8e
SHA1

091ac74284449d935cbd690813698f595bcb9977
SHA256

5078e7fe9f4608b1c09410fb28481ec5902100001408f3c7ede010861dfee0d3
SHA512

ca7e025c71223154260f19a15ae0e18a18d1836486a573737fae12a45168a6b455246e3dd0cd8cb96ffa4eec260e98574109d27c4cf05f17c5810671dad8438e
SSDEEP

24576:r/oM8SLYWNInsMfnDOm6iFv2VTBVVF/Nq5R7sy:zD8SLYW6np/DOm6VVT//Nk9n

Score

6^/10

bootkit persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1542.003

Processes:

fa89f8791dfaf4ab8ef219bffd508b8e_JaffaCakes118.exe

description ioc process

File opened for modification \??\PhysicalDrive0 fa89f8791dfaf4ab8ef219bffd508b8e_JaffaCakes118.exe
Executes dropped EXE 1 IoCs

Processes:

NFWCHK.exe

pid process

3008 NFWCHK.exe
Loads dropped DLL 1 IoCs

Processes:

fa89f8791dfaf4ab8ef219bffd508b8e_JaffaCakes118.exe

pid process

2120 fa89f8791dfaf4ab8ef219bffd508b8e_JaffaCakes118.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	fa89f8791dfaf4ab8ef219bffd508b8e_JaffaCakes118.exe

pid	process
3008	NFWCHK.exe

pid	process
2120	fa89f8791dfaf4ab8ef219bffd508b8e_JaffaCakes118.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

fa89f8791dfaf4ab8ef219bffd508b8e_JaffaCakes118.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	fa89f8791dfaf4ab8ef219bffd508b8e_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

fa89f8791dfaf4ab8ef219bffd508b8e_JaffaCakes118.exe

pid process

2120 fa89f8791dfaf4ab8ef219bffd508b8e_JaffaCakes118.exe
2120 fa89f8791dfaf4ab8ef219bffd508b8e_JaffaCakes118.exe

pid	process
2120	fa89f8791dfaf4ab8ef219bffd508b8e_JaffaCakes118.exe
2120	fa89f8791dfaf4ab8ef219bffd508b8e_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

fa89f8791dfaf4ab8ef219bffd508b8e_JaffaCakes118.exe

description	pid	process	target process
PID 2120 wrote to memory of 3008	2120	fa89f8791dfaf4ab8ef219bffd508b8e_JaffaCakes118.exe	NFWCHK.exe
PID 2120 wrote to memory of 3008	2120	fa89f8791dfaf4ab8ef219bffd508b8e_JaffaCakes118.exe	NFWCHK.exe
PID 2120 wrote to memory of 3008	2120	fa89f8791dfaf4ab8ef219bffd508b8e_JaffaCakes118.exe	NFWCHK.exe
PID 2120 wrote to memory of 3008	2120	fa89f8791dfaf4ab8ef219bffd508b8e_JaffaCakes118.exe	NFWCHK.exe

C:\Users\Admin\AppData\Local\Temp\fa89f8791dfaf4ab8ef219bffd508b8e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fa89f8791dfaf4ab8ef219bffd508b8e_JaffaCakes118.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Loads dropped DLL
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2120

C:\Users\Public\Documents\Wondershare\NFWCHK.exe
C:\Users\Public\Documents\Wondershare\NFWCHK.exe
2⤵
- Executes dropped EXE
PID:3008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\wsWAE.log
Filesize
4KB

MD5
3ff088d35facfd10a8933bc8786ee7de

SHA1
2a02c21317c5f9ea7949f9ba5e791984ec2a7b14

SHA256
7395f01fff08e3c4a1f8258a92c1b467b519cbbc48ad99084e0430b12b696855

SHA512
8284f021055fa3389d8d23708e1ea773ba9090a287e37d5f4778a88e54eb8610097a9e6b5d34d9fb31dfbf8735bd58660dd19b82658fd1afbdf5ca76b99741d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\wsWAE.log
Filesize
548B

MD5
bbb81fe9d7c24128b9ff7316cb636c64

SHA1
42347d41eb66c26b50c1a91000fbd500d82e63a2

SHA256
11fd5f89cecfb117c1468800a304ece564be5b2f50dc5ecef809c37af63846b7

SHA512
22c3d6223fa5b46841381706252791809a9426661e02cb2d4073123e7c658bd40bd8f10b06b4ba4cd19107d4cec2c0a33b2d6a4ba1a60cb6987e8ffabd87435f

Download Submit
C:\Users\Admin\AppData\Local\Temp\wsWAE.log
Filesize
1KB

MD5
2db67f4b002c99f2d89b8da4df94b18c

SHA1
38da729ef40f2ce1af33889ebadb66ef59ce7b44

SHA256
03a7e29b49130952d6b7cfedc45e9f8a4a409ec48996cce85443751dce1a0158

SHA512
54f05b6dca0bc69dc03611bec0991c83ab9f51303c2b64bed03db1f6afc89e094e67f21fe68641fb4be09d5d6169e5206cc1cb73c3507ca5d338e43536341bd1

Download Submit
C:\Users\Admin\AppData\Local\Temp\wsWAE.log
Filesize
2KB

MD5
80a76fa0ebf4422d29768bb4066ba38e

SHA1
a21c57bd309b865610c1a119bb5f3ebc6fcbe7b9

SHA256
fbfa8bbc8a1bebcaa6796a8ef8953bda0e552132af66f1840bec34f46bec911d

SHA512
0e72300bc6b5db9de7e76653d4503ebbe413f9d13d174abba13b55479e13338d8d4d8200692628d016d5dfa38447011808823e5693c34188a2fc110a3a76e05a

Download Submit
C:\Users\Admin\AppData\Local\Temp\wsduilib.log
Filesize
1KB

MD5
29c673a993ed569f6b187e61c85a5aec

SHA1
eae2b18c3d8416f6602b9ef592a332832e62f488

SHA256
2168be78f08a2e0d4aa9d99ac4648bacad3f0753136dc20142688307d43da1b4

SHA512
e4f3c61594ac729ad49f64894c5657ea864b5492d24f5197a63c615fedfbe28a1b1407d4a6d20714ee24711629de2040c6bc9d000c41e015f67f424ad7100556

Download Submit
C:\Users\Admin\AppData\Local\Temp\wsduilib.log
Filesize
5KB

MD5
f904a0dec286985d92dbc5e75fcb786a

SHA1
c37f185c2bb4f9aa3cda40390719ac45db99b3d4

SHA256
185dbc18314eb4650a01473266052fe1ae4890e96247308a97397a5fb9411ec4

SHA512
f377ce52ec7f8d9800fb6c4fa0790ad493688a26d6d5cfcba91d719e9f3eb69333bf59e1f359d80aa8b4a8fa50326d670bb1d3bc737f1b17fc6f437f40e5be02

Download Submit
C:\Users\Public\Documents\Wondershare\NFWCHK.exe
Filesize
7KB

MD5
27cfb3990872caa5930fa69d57aefe7b

SHA1
5e1c80d61e8db0cdc0c9b9fa3b2e36d156d45f8f

SHA256
43881549228975c7506b050bce4d9b671412d3cdc08c7516c9dbbb7f50c25146

SHA512
a1509024872c99c1cf63f42d9f3c5f063afde4e9490c21611551ddd2322d136ce9240256113c525305346cf7b66ccca84c3df67637c8fecbfeebf14ffa373a2a

Download Submit
C:\Users\Public\Documents\Wondershare\NFWCHK.exe.config
Filesize
229B

MD5
ad0967a0ab95aa7d71b3dc92b71b8f7a

SHA1
ed63f517e32094c07a2c5b664ed1cab412233ab5

SHA256
9c1212bc648a2533b53a2d0afcec518846d97630afb013742a9622f0df7b04fc

SHA512
85766a907331f60044ec205cf345453fc3d44bfcac296ac93a12e8a752b84290dfd94f73b71de82f46f9503177d29602cbb87549f89dc61373d889b4ea26634b

Download Submit
memory/3008-1084-0x000007FEF5A30000-0x000007FEF63CD000-memory.dmp

Filesize
9.6MB

Download
memory/3008-1085-0x0000000002190000-0x0000000002210000-memory.dmp

Filesize
512KB

Download
memory/3008-1087-0x000007FEF5A30000-0x000007FEF63CD000-memory.dmp

Filesize
9.6MB

Download

Analysis

Sharing