d0036c25f65fb4c4d20c3a71b0569a2c64ff7e31bff0d44724a90b89e07ac62c

General

Target

fa7f0e28d9a459e344da350443698df6_JaffaCakes118.exe
Size

455KB
MD5

fa7f0e28d9a459e344da350443698df6
SHA1

60e72c23b0f1fe2b53762c0422c28d9905bf0b49
SHA256

d0036c25f65fb4c4d20c3a71b0569a2c64ff7e31bff0d44724a90b89e07ac62c
SHA512

318c011d7f22290ce1d8c84edc9625b31c264df0cbfcd7d588132f5312077e5776a780cd18733533ab8175ef50a31f00d15d057ad550475eea1398771e640c4c
SSDEEP

12288:0bMJ24z1IFr12b0mXGuHsHfnY8W1K3DnsIfFtU5:0e24z6CAeGuM/nNW4Ds+HM

Score

6^/10

bootkit persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1542.003

Processes:

fa7f0e28d9a459e344da350443698df6_JaffaCakes118.exe

description ioc process

File opened for modification \??\PhysicalDrive0 fa7f0e28d9a459e344da350443698df6_JaffaCakes118.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2072 1936 WerFault.exe fa7f0e28d9a459e344da350443698df6_JaffaCakes118.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	fa7f0e28d9a459e344da350443698df6_JaffaCakes118.exe

pid	pid_target	process	target process
2072	1936	WerFault.exe	fa7f0e28d9a459e344da350443698df6_JaffaCakes118.exe

Modifies registry class 3 IoCs

Processes:

fa7f0e28d9a459e344da350443698df6_JaffaCakes118.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	fa7f0e28d9a459e344da350443698df6_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	fa7f0e28d9a459e344da350443698df6_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	fa7f0e28d9a459e344da350443698df6_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

fa7f0e28d9a459e344da350443698df6_JaffaCakes118.exe

description	pid	process	target process
PID 1936 wrote to memory of 2160	1936	fa7f0e28d9a459e344da350443698df6_JaffaCakes118.exe	iexplore.exe
PID 1936 wrote to memory of 2160	1936	fa7f0e28d9a459e344da350443698df6_JaffaCakes118.exe	iexplore.exe
PID 1936 wrote to memory of 2160	1936	fa7f0e28d9a459e344da350443698df6_JaffaCakes118.exe	iexplore.exe
PID 1936 wrote to memory of 2160	1936	fa7f0e28d9a459e344da350443698df6_JaffaCakes118.exe	iexplore.exe
PID 1936 wrote to memory of 2072	1936	fa7f0e28d9a459e344da350443698df6_JaffaCakes118.exe	WerFault.exe
PID 1936 wrote to memory of 2072	1936	fa7f0e28d9a459e344da350443698df6_JaffaCakes118.exe	WerFault.exe
PID 1936 wrote to memory of 2072	1936	fa7f0e28d9a459e344da350443698df6_JaffaCakes118.exe	WerFault.exe
PID 1936 wrote to memory of 2072	1936	fa7f0e28d9a459e344da350443698df6_JaffaCakes118.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\fa7f0e28d9a459e344da350443698df6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fa7f0e28d9a459e344da350443698df6_JaffaCakes118.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1936

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" ¨Á
2⤵
PID:2160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1936 -s 276
2⤵
- Program crash
PID:2072

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1936-0-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/1936-1-0x0000000002260000-0x0000000002262000-memory.dmp

Filesize
8KB

Download
memory/1936-25-0x0000000002340000-0x0000000002341000-memory.dmp

Filesize
4KB

Download
memory/1936-24-0x0000000002350000-0x0000000002351000-memory.dmp

Filesize
4KB

Download
memory/1936-23-0x0000000002320000-0x0000000002321000-memory.dmp

Filesize
4KB

Download
memory/1936-22-0x0000000002330000-0x0000000002331000-memory.dmp

Filesize
4KB

Download
memory/1936-21-0x0000000002300000-0x0000000002301000-memory.dmp

Filesize
4KB

Download
memory/1936-20-0x0000000002310000-0x0000000002311000-memory.dmp

Filesize
4KB

Download
memory/1936-19-0x00000000022E0000-0x00000000022E1000-memory.dmp

Filesize
4KB

Download
memory/1936-18-0x00000000022F0000-0x00000000022F1000-memory.dmp

Filesize
4KB

Download
memory/1936-17-0x00000000022D0000-0x00000000022D1000-memory.dmp

Filesize
4KB

Download
memory/1936-16-0x0000000001DC0000-0x0000000001DC1000-memory.dmp

Filesize
4KB

Download
memory/1936-15-0x0000000001DA0000-0x0000000001DA1000-memory.dmp

Filesize
4KB

Download
memory/1936-14-0x0000000001DB0000-0x0000000001DB1000-memory.dmp

Filesize
4KB

Download
memory/1936-13-0x00000000006D0000-0x00000000006D1000-memory.dmp

Filesize
4KB

Download
memory/1936-12-0x00000000006E0000-0x00000000006E1000-memory.dmp

Filesize
4KB

Download
memory/1936-11-0x00000000006C0000-0x00000000006C1000-memory.dmp

Filesize
4KB

Download
memory/1936-10-0x0000000002280000-0x0000000002281000-memory.dmp

Filesize
4KB

Download
memory/1936-9-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/1936-8-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/1936-7-0x0000000002270000-0x0000000002271000-memory.dmp

Filesize
4KB

Download
memory/1936-6-0x0000000001F40000-0x0000000001F41000-memory.dmp

Filesize
4KB

Download
memory/1936-5-0x00000000006B0000-0x00000000006B1000-memory.dmp

Filesize
4KB

Download
memory/1936-4-0x00000000022C0000-0x00000000022C1000-memory.dmp

Filesize
4KB

Download
memory/1936-3-0x00000000022B0000-0x00000000022B1000-memory.dmp

Filesize
4KB

Download
memory/1936-2-0x00000000022B0000-0x00000000022B1000-memory.dmp

Filesize
4KB

Download
memory/1936-29-0x0000000002480000-0x0000000002481000-memory.dmp

Filesize
4KB

Download
memory/1936-28-0x0000000002490000-0x0000000002491000-memory.dmp

Filesize
4KB

Download
memory/1936-27-0x0000000002460000-0x0000000002461000-memory.dmp

Filesize
4KB

Download
memory/1936-26-0x0000000002470000-0x0000000002471000-memory.dmp

Filesize
4KB

Download
memory/1936-30-0x00000000024B0000-0x00000000024B1000-memory.dmp

Filesize
4KB

Download
memory/1936-31-0x00000000024A0000-0x00000000024A1000-memory.dmp

Filesize
4KB

Download
memory/1936-32-0x00000000024D0000-0x00000000024D1000-memory.dmp

Filesize
4KB

Download
memory/1936-33-0x00000000024C0000-0x00000000024C1000-memory.dmp

Filesize
4KB

Download
memory/1936-34-0x00000000024F0000-0x00000000024F1000-memory.dmp

Filesize
4KB

Download
memory/1936-35-0x00000000024E0000-0x00000000024E1000-memory.dmp

Filesize
4KB

Download
memory/1936-36-0x0000000002510000-0x0000000002511000-memory.dmp

Filesize
4KB

Download
memory/1936-37-0x0000000002500000-0x0000000002501000-memory.dmp

Filesize
4KB

Download
memory/1936-38-0x0000000002520000-0x0000000002521000-memory.dmp

Filesize
4KB

Download
memory/1936-39-0x0000000002560000-0x0000000002561000-memory.dmp

Filesize
4KB

Download
memory/1936-40-0x0000000002550000-0x0000000002551000-memory.dmp

Filesize
4KB

Download
memory/1936-41-0x0000000002540000-0x0000000002541000-memory.dmp

Filesize
4KB

Download
memory/1936-42-0x0000000002570000-0x0000000002571000-memory.dmp

Filesize
4KB

Download
memory/1936-43-0x00000000032E0000-0x00000000032E1000-memory.dmp

Filesize
4KB

Download
memory/1936-44-0x00000000032D0000-0x00000000032D1000-memory.dmp

Filesize
4KB

Download
memory/1936-45-0x0000000003420000-0x0000000003421000-memory.dmp

Filesize
4KB

Download
memory/1936-55-0x0000000002580000-0x0000000002581000-memory.dmp

Filesize
4KB

Download
memory/1936-54-0x0000000002530000-0x0000000002531000-memory.dmp

Filesize
4KB

Download
memory/1936-53-0x0000000003490000-0x0000000003491000-memory.dmp

Filesize
4KB

Download
memory/1936-56-0x0000000003460000-0x0000000003461000-memory.dmp

Filesize
4KB

Download
memory/1936-52-0x00000000034A0000-0x00000000034A1000-memory.dmp

Filesize
4KB

Download
memory/1936-51-0x0000000003470000-0x0000000003471000-memory.dmp

Filesize
4KB

Download
memory/1936-50-0x0000000003480000-0x0000000003481000-memory.dmp

Filesize
4KB

Download
memory/1936-49-0x0000000003450000-0x0000000003451000-memory.dmp

Filesize
4KB

Download
memory/1936-48-0x0000000003430000-0x0000000003431000-memory.dmp

Filesize
4KB

Download
memory/1936-47-0x0000000003440000-0x0000000003441000-memory.dmp

Filesize
4KB

Download
memory/1936-46-0x0000000003410000-0x0000000003411000-memory.dmp

Filesize
4KB

Download
memory/1936-57-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download

Analysis

Sharing