469de2775f43960ff7c9db3fa091cbaab8ee7b384ef875d13045e67af9f1fcdb

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
20-04-2024 01:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fb969d14510593ea1b1da79447e431e1_JaffaCakes118.dll
Size

116KB
MD5

fb969d14510593ea1b1da79447e431e1
SHA1

57a49c23a89ad79078bb8f1d3e3ef6f944e2cf0d
SHA256

469de2775f43960ff7c9db3fa091cbaab8ee7b384ef875d13045e67af9f1fcdb
SHA512

83fea427aa6d0d66c37dd303f5802edda6fbd3978cd075c2631ef011553cf2cce06ece0a8977854a24d89454bf96ab05259d912b5b4c9919220372810a4c82f7
SSDEEP

3072:LNVbRICWoLsyQHfT9z64Fq4clCUihDMMbCvHZB:LNYCWo4OwcAvIOeHT

Score

6^/10

bootkit discovery persistence

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1542.003

Processes:

rundll32.exe

description ioc process

File opened for modification \??\PhysicalDrive0 rundll32.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

rundll32.exe

pid process

2320 rundll32.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	rundll32.exe

pid	process
2320	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2792 wrote to memory of 2320	2792	rundll32.exe	rundll32.exe
PID 2792 wrote to memory of 2320	2792	rundll32.exe	rundll32.exe
PID 2792 wrote to memory of 2320	2792	rundll32.exe	rundll32.exe
PID 2792 wrote to memory of 2320	2792	rundll32.exe	rundll32.exe
PID 2792 wrote to memory of 2320	2792	rundll32.exe	rundll32.exe
PID 2792 wrote to memory of 2320	2792	rundll32.exe	rundll32.exe
PID 2792 wrote to memory of 2320	2792	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fb969d14510593ea1b1da79447e431e1_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2792

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fb969d14510593ea1b1da79447e431e1_JaffaCakes118.dll,#1
2⤵
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
PID:2320

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2320-0-0x0000000000100000-0x000000000010B000-memory.dmp

Filesize
44KB

Download
memory/2320-1-0x0000000010000000-0x000000001000A000-memory.dmp

Filesize
40KB

Download
memory/2320-4-0x0000000010000000-0x000000001000A000-memory.dmp

Filesize
40KB

Download