5271232843883ae82643ee5f95adffddf9f354004c09abd2aa38e71b48563f8c

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
19-04-2024 21:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fb2bc5d91efe3edeb5266d91a6070cfe_JaffaCakes118.exe
Size

1.7MB
MD5

fb2bc5d91efe3edeb5266d91a6070cfe
SHA1

740baf6d050c1827122e3dd27cf37becc9517fb7
SHA256

5271232843883ae82643ee5f95adffddf9f354004c09abd2aa38e71b48563f8c
SHA512

c91f3bda49d12e92b08d6d3b0df0a2eecdda878c24e7be6caa0ea60283ee19ad7588bf843470d4315c72d81334b00ab197d1cdd947f64d6552e4c9b4d4b1ed21
SSDEEP

24576:7vyubpyxzfv/Cb6UC8AFzbyA/EqaNO5fqKEcSqsEVT7q:7vyKyxDXuCbtE9NO5fqMSq9

Score

7^/10

bootkit persistence upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

fb2bc5d91efe3edeb5266d91a6070cfe_JaffaCakes118.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\Control Panel\International\Geo\Nation	fb2bc5d91efe3edeb5266d91a6070cfe_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

Processes:

winman.exe

pid process

4756 winman.exe

pid	process
4756	winman.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Windows\SysWOW64\winman.exe	upx
behavioral2/memory/4756-8-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral2/memory/4756-11-0x0000000000400000-0x000000000040E000-memory.dmp	upx

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1542.003

Processes:

winman.exe

description ioc process

File opened for modification \??\PhysicalDrive0 winman.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	winman.exe

Drops file in System32 directory 2 IoCs

Processes:

fb2bc5d91efe3edeb5266d91a6070cfe_JaffaCakes118.exewinman.exe

description	ioc	process
File created	C:\Windows\SysWOW64\winman.exe	fb2bc5d91efe3edeb5266d91a6070cfe_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\id	winman.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid	pid_target	process	target process
2672	5056	WerFault.exe	fb2bc5d91efe3edeb5266d91a6070cfe_JaffaCakes118.exe
2760	5056	WerFault.exe	fb2bc5d91efe3edeb5266d91a6070cfe_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

fb2bc5d91efe3edeb5266d91a6070cfe_JaffaCakes118.exe

description	pid	process	target process
PID 5056 wrote to memory of 4756	5056	fb2bc5d91efe3edeb5266d91a6070cfe_JaffaCakes118.exe	winman.exe
PID 5056 wrote to memory of 4756	5056	fb2bc5d91efe3edeb5266d91a6070cfe_JaffaCakes118.exe	winman.exe
PID 5056 wrote to memory of 4756	5056	fb2bc5d91efe3edeb5266d91a6070cfe_JaffaCakes118.exe	winman.exe

C:\Users\Admin\AppData\Local\Temp\fb2bc5d91efe3edeb5266d91a6070cfe_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fb2bc5d91efe3edeb5266d91a6070cfe_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:5056
- C:\Windows\SysWOW64\winman.exe
  "C:\Windows\system32\winman.exe"
  2⤵
  - Executes dropped EXE
  - Writes to the Master Boot Record (MBR)
  - Drops file in System32 directory
  PID:4756
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5056 -s 1708
  2⤵
  - Program crash
  PID:2672
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5056 -s 1712
  2⤵
  - Program crash
  PID:2760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5056 -ip 5056
1⤵
PID:1064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 5056 -ip 5056
1⤵
PID:4276

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\id

Filesize
8B

MD5
87588832f89b483d53b90533c5b3a440

SHA1
abed747f311dbd98072db92583c13e946b5ded10

SHA256
f9a2edd2409cf0c75c208a49f06c06513c27312b179f1712f233df6aecda4204

SHA512
6af1c719c4f42c46cab8d4106d66de6131edaa988810e1a50e2134ac2ade21749491d8e848ef1bf35c38b921a23f8b8574c36c12f9567149853f6573cc9b2936

Download Submit
C:\Windows\SysWOW64\winman.exe

Filesize
16KB

MD5
a0fdc0fde6a0331f6bffc3a605e89643

SHA1
7b19764d51b9857df2576cd317e786c899aa40c9

SHA256
9a75100696ea630f4cfd36cad96295b47d3b2e4ddddf794f19c3b5dd9f4e670e

SHA512
756d72116c5bf1649b8189fc2342a2e8010286f7bee7f69f3cecb5d1cf3e3bb086a34577e5235757022f6910f6ce9587172f818672de39b454b8fc680416165d

Download Submit
memory/4756-8-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/4756-11-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/5056-0-0x0000000002430000-0x0000000002431000-memory.dmp

Filesize
4KB

Download
memory/5056-13-0x0000000000400000-0x00000000005BB000-memory.dmp

Filesize
1.7MB

Download