17fc9c49de2bbca4154fa686b76604c8959abfbbe08d8534e0937dc142a3ba0b

Analysis

max time kernel
143s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19-04-2024 16:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fab07fe70d8bff909875addcb6d6941e_JaffaCakes118.exe
Size

1.8MB
MD5

fab07fe70d8bff909875addcb6d6941e
SHA1

61bdcf83229b437f0c7113adf45009a9b3d0a5d8
SHA256

17fc9c49de2bbca4154fa686b76604c8959abfbbe08d8534e0937dc142a3ba0b
SHA512

bab7769ea4bd26caa8c214f5c3ce7a458d536ac6b2bca39284684a14e548c57876405b34eb7fc49da92714223e9616e2bffd090e586bd57b8b1139d7a9a32711
SSDEEP

49152:/DntY25DM1uzOpQxg7V63V3LWMLRZtn6UbWuOXAdv:/B95PZOQF3aMLRrn6mN

Score

7^/10

bootkit persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

AnvirSet.exe

pid process

2868 AnvirSet.exe
Loads dropped DLL 2 IoCs

Processes:

fab07fe70d8bff909875addcb6d6941e_JaffaCakes118.exe

pid process

2804 fab07fe70d8bff909875addcb6d6941e_JaffaCakes118.exe
2804 fab07fe70d8bff909875addcb6d6941e_JaffaCakes118.exe
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1542.003

Processes:

AnvirSet.exe

description ioc process

File opened for modification \??\PhysicalDrive0 AnvirSet.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2868	AnvirSet.exe

pid	process
2804	fab07fe70d8bff909875addcb6d6941e_JaffaCakes118.exe
2804	fab07fe70d8bff909875addcb6d6941e_JaffaCakes118.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	AnvirSet.exe

Modifies registry class 3 IoCs

Processes:

AnvirSet.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	AnvirSet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	AnvirSet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	AnvirSet.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AnvirSet.exe

pid process

2868 AnvirSet.exe

pid	process
2868	AnvirSet.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

fab07fe70d8bff909875addcb6d6941e_JaffaCakes118.exe

description	pid	process	target process
PID 2804 wrote to memory of 2868	2804	fab07fe70d8bff909875addcb6d6941e_JaffaCakes118.exe	AnvirSet.exe
PID 2804 wrote to memory of 2868	2804	fab07fe70d8bff909875addcb6d6941e_JaffaCakes118.exe	AnvirSet.exe
PID 2804 wrote to memory of 2868	2804	fab07fe70d8bff909875addcb6d6941e_JaffaCakes118.exe	AnvirSet.exe
PID 2804 wrote to memory of 2868	2804	fab07fe70d8bff909875addcb6d6941e_JaffaCakes118.exe	AnvirSet.exe

C:\Users\Admin\AppData\Local\Temp\fab07fe70d8bff909875addcb6d6941e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fab07fe70d8bff909875addcb6d6941e_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2804

C:\Users\Admin\AppData\Local\Temp\AnvirSet.exe
"C:\Users\Admin\AppData\Local\Temp\AnvirSet.exe" DeleteSelf
2⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:2868

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\AnVirSet.exe
Filesize
1.9MB

MD5
dc7f3631f48bce089576f9b3588e9a61

SHA1
442b69a240354a17bb408acc8d8d050329700122

SHA256
7b853cc236313108f4efd5a9710c09bdc8e36d81fd2b4f059897cfba0ee4d98d

SHA512
b5dbd5f976bee13b0df9d341e5e4cb84c40cb871c36fa97fa9e798a2b815a781590193bbee6cb5255c7f539d98b2a0f6e0a482d3468bb81a1e5e1f98480514a0

Download Submit
memory/2804-16-0x0000000001E80000-0x0000000002272000-memory.dmp

Filesize
3.9MB

Download
memory/2804-31-0x0000000001E80000-0x0000000002272000-memory.dmp

Filesize
3.9MB

Download
memory/2868-24-0x0000000002230000-0x0000000002236000-memory.dmp

Filesize
24KB

Download
memory/2868-26-0x00000000025D0000-0x00000000025D1000-memory.dmp

Filesize
4KB

Download
memory/2868-21-0x0000000002240000-0x0000000002249000-memory.dmp

Filesize
36KB

Download
memory/2868-20-0x0000000002240000-0x0000000002241000-memory.dmp

Filesize
4KB

Download
memory/2868-22-0x00000000025C0000-0x00000000025C1000-memory.dmp

Filesize
4KB

Download
memory/2868-18-0x0000000000400000-0x00000000007F2000-memory.dmp

Filesize
3.9MB

Download
memory/2868-25-0x0000000000990000-0x0000000000991000-memory.dmp

Filesize
4KB

Download
memory/2868-19-0x0000000002240000-0x0000000002241000-memory.dmp

Filesize
4KB

Download
memory/2868-23-0x00000000025B0000-0x00000000025B1000-memory.dmp

Filesize
4KB

Download
memory/2868-28-0x0000000003750000-0x0000000003751000-memory.dmp

Filesize
4KB

Download
memory/2868-29-0x0000000003770000-0x0000000003771000-memory.dmp

Filesize
4KB

Download
memory/2868-27-0x0000000003710000-0x0000000003711000-memory.dmp

Filesize
4KB

Download
memory/2868-30-0x0000000000400000-0x00000000007F2000-memory.dmp

Filesize
3.9MB

Download
memory/2868-17-0x0000000000A50000-0x0000000000A85000-memory.dmp

Filesize
212KB

Download
memory/2868-32-0x0000000000A50000-0x0000000000A85000-memory.dmp

Filesize
212KB

Download
memory/2868-33-0x0000000002240000-0x0000000002241000-memory.dmp

Filesize
4KB

Download