e5152e0c6d430377988c326fd4c4da6615bc4d3d6afbac35146513dbec6d142f

Analysis

max time kernel
141s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20-04-2024 04:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fbf0753988f6e278a9766c29de45cecd_JaffaCakes118.exe
Size

1.6MB
MD5

fbf0753988f6e278a9766c29de45cecd
SHA1

5b88156909882c530235df9ab080d5144543f430
SHA256

e5152e0c6d430377988c326fd4c4da6615bc4d3d6afbac35146513dbec6d142f
SHA512

bfe6d67f86073821db278ca2c20fabebef7007dd49d5ea8f005bf60e24c0d436079dd5365363623e9d4249d65ea3e73d6a4c283358d045bb25f0f53265851094
SSDEEP

49152:SqJP/j515LJzZYy8MoPDMBqPtTe/LEXB8+mJu:Z3j5fhZ52IEPtCTEeY

Score

6^/10

bootkit persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1542.003

Processes:

fbf0753988f6e278a9766c29de45cecd_JaffaCakes118.exe

description ioc process

File opened for modification \??\PhysicalDrive0 fbf0753988f6e278a9766c29de45cecd_JaffaCakes118.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2544 2856 WerFault.exe fbf0753988f6e278a9766c29de45cecd_JaffaCakes118.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	fbf0753988f6e278a9766c29de45cecd_JaffaCakes118.exe

pid	pid_target	process	target process
2544	2856	WerFault.exe	fbf0753988f6e278a9766c29de45cecd_JaffaCakes118.exe

Modifies registry class 3 IoCs

Processes:

fbf0753988f6e278a9766c29de45cecd_JaffaCakes118.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	fbf0753988f6e278a9766c29de45cecd_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	fbf0753988f6e278a9766c29de45cecd_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	fbf0753988f6e278a9766c29de45cecd_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

fbf0753988f6e278a9766c29de45cecd_JaffaCakes118.exe

description	pid	process	target process
PID 2856 wrote to memory of 2544	2856	fbf0753988f6e278a9766c29de45cecd_JaffaCakes118.exe	WerFault.exe
PID 2856 wrote to memory of 2544	2856	fbf0753988f6e278a9766c29de45cecd_JaffaCakes118.exe	WerFault.exe
PID 2856 wrote to memory of 2544	2856	fbf0753988f6e278a9766c29de45cecd_JaffaCakes118.exe	WerFault.exe
PID 2856 wrote to memory of 2544	2856	fbf0753988f6e278a9766c29de45cecd_JaffaCakes118.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\fbf0753988f6e278a9766c29de45cecd_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fbf0753988f6e278a9766c29de45cecd_JaffaCakes118.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2856 -s 320
2⤵
- Program crash
PID:2544

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2856-0-0x0000000000400000-0x00000000008CF000-memory.dmp

Filesize
4.8MB

Download
memory/2856-1-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/2856-2-0x00000000008D0000-0x00000000008D1000-memory.dmp

Filesize
4KB

Download
memory/2856-30-0x0000000002510000-0x0000000002511000-memory.dmp

Filesize
4KB

Download
memory/2856-34-0x0000000002550000-0x0000000002551000-memory.dmp

Filesize
4KB

Download
memory/2856-33-0x0000000002560000-0x0000000002561000-memory.dmp

Filesize
4KB

Download
memory/2856-32-0x0000000002530000-0x0000000002531000-memory.dmp

Filesize
4KB

Download
memory/2856-31-0x0000000002540000-0x0000000002541000-memory.dmp

Filesize
4KB

Download
memory/2856-29-0x0000000002520000-0x0000000002521000-memory.dmp

Filesize
4KB

Download
memory/2856-28-0x0000000002300000-0x0000000002301000-memory.dmp

Filesize
4KB

Download
memory/2856-27-0x0000000002310000-0x0000000002311000-memory.dmp

Filesize
4KB

Download
memory/2856-26-0x00000000022E0000-0x00000000022E1000-memory.dmp

Filesize
4KB

Download
memory/2856-25-0x00000000022F0000-0x00000000022F1000-memory.dmp

Filesize
4KB

Download
memory/2856-24-0x0000000000960000-0x0000000000961000-memory.dmp

Filesize
4KB

Download
memory/2856-23-0x00000000022D0000-0x00000000022D1000-memory.dmp

Filesize
4KB

Download
memory/2856-22-0x0000000000940000-0x0000000000941000-memory.dmp

Filesize
4KB

Download
memory/2856-21-0x0000000000950000-0x0000000000951000-memory.dmp

Filesize
4KB

Download
memory/2856-20-0x0000000000930000-0x0000000000931000-memory.dmp

Filesize
4KB

Download
memory/2856-19-0x0000000000380000-0x0000000000381000-memory.dmp

Filesize
4KB

Download
memory/2856-18-0x0000000000360000-0x0000000000361000-memory.dmp

Filesize
4KB

Download
memory/2856-17-0x0000000000370000-0x0000000000371000-memory.dmp

Filesize
4KB

Download
memory/2856-16-0x0000000000330000-0x0000000000331000-memory.dmp

Filesize
4KB

Download
memory/2856-15-0x0000000000340000-0x0000000000341000-memory.dmp

Filesize
4KB

Download
memory/2856-14-0x0000000000320000-0x0000000000321000-memory.dmp

Filesize
4KB

Download
memory/2856-13-0x00000000008E0000-0x00000000008E1000-memory.dmp

Filesize
4KB

Download
memory/2856-12-0x0000000000300000-0x0000000000301000-memory.dmp

Filesize
4KB

Download
memory/2856-11-0x00000000002F0000-0x00000000002F1000-memory.dmp

Filesize
4KB

Download
memory/2856-10-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/2856-9-0x0000000000310000-0x0000000000311000-memory.dmp

Filesize
4KB

Download
memory/2856-8-0x0000000000920000-0x0000000000921000-memory.dmp

Filesize
4KB

Download
memory/2856-7-0x0000000000910000-0x0000000000911000-memory.dmp

Filesize
4KB

Download
memory/2856-6-0x0000000000910000-0x0000000000911000-memory.dmp

Filesize
4KB

Download
memory/2856-5-0x00000000003F0000-0x00000000003F3000-memory.dmp

Filesize
12KB

Download
memory/2856-4-0x00000000008D0000-0x00000000008D1000-memory.dmp

Filesize
4KB

Download
memory/2856-3-0x00000000008D0000-0x00000000008D1000-memory.dmp

Filesize
4KB

Download
memory/2856-35-0x0000000002580000-0x0000000002581000-memory.dmp

Filesize
4KB

Download
memory/2856-36-0x0000000002570000-0x0000000002571000-memory.dmp

Filesize
4KB

Download
memory/2856-37-0x00000000029F0000-0x00000000029F1000-memory.dmp

Filesize
4KB

Download
memory/2856-38-0x00000000029E0000-0x00000000029E1000-memory.dmp

Filesize
4KB

Download
memory/2856-39-0x0000000002A10000-0x0000000002A11000-memory.dmp

Filesize
4KB

Download
memory/2856-40-0x0000000002A00000-0x0000000002A01000-memory.dmp

Filesize
4KB

Download
memory/2856-41-0x0000000002A20000-0x0000000002A21000-memory.dmp

Filesize
4KB

Download
memory/2856-42-0x0000000002A60000-0x0000000002A61000-memory.dmp

Filesize
4KB

Download
memory/2856-43-0x0000000002A50000-0x0000000002A51000-memory.dmp

Filesize
4KB

Download
memory/2856-47-0x00000000037D0000-0x00000000037D1000-memory.dmp

Filesize
4KB

Download
memory/2856-46-0x00000000037E0000-0x00000000037E1000-memory.dmp

Filesize
4KB

Download
memory/2856-48-0x0000000003800000-0x0000000003801000-memory.dmp

Filesize
4KB

Download
memory/2856-45-0x00000000037B0000-0x00000000037B1000-memory.dmp

Filesize
4KB

Download
memory/2856-44-0x0000000002A40000-0x0000000002A41000-memory.dmp

Filesize
4KB

Download
memory/2856-49-0x00000000037F0000-0x00000000037F1000-memory.dmp

Filesize
4KB

Download
memory/2856-50-0x0000000003820000-0x0000000003821000-memory.dmp

Filesize
4KB

Download
memory/2856-51-0x0000000003810000-0x0000000003811000-memory.dmp

Filesize
4KB

Download
memory/2856-52-0x0000000003840000-0x0000000003841000-memory.dmp

Filesize
4KB

Download
memory/2856-53-0x0000000003830000-0x0000000003831000-memory.dmp

Filesize
4KB

Download
memory/2856-54-0x0000000003870000-0x0000000003871000-memory.dmp

Filesize
4KB

Download
memory/2856-55-0x0000000003860000-0x0000000003861000-memory.dmp

Filesize
4KB

Download
memory/2856-56-0x0000000003890000-0x0000000003891000-memory.dmp

Filesize
4KB

Download
memory/2856-57-0x00000000038C0000-0x00000000038C1000-memory.dmp

Filesize
4KB

Download
memory/2856-58-0x00000000038B0000-0x00000000038B1000-memory.dmp

Filesize
4KB

Download
memory/2856-59-0x00000000038E0000-0x00000000038E1000-memory.dmp

Filesize
4KB

Download
memory/2856-61-0x0000000003900000-0x0000000003901000-memory.dmp

Filesize
4KB

Download
memory/2856-60-0x00000000038D0000-0x00000000038D1000-memory.dmp

Filesize
4KB

Download
memory/2856-62-0x00000000038F0000-0x00000000038F1000-memory.dmp

Filesize
4KB

Download
memory/2856-63-0x0000000003920000-0x0000000003921000-memory.dmp

Filesize
4KB

Download
memory/2856-68-0x0000000000400000-0x00000000008CF000-memory.dmp

Filesize
4.8MB

Download