a3fc7582c0a09e1b3f2b82a9a2941c12cb076c84cbfe811b2445de5bb4cc19b7

General

Target

fc22a53283a698ce6223d08254f7579e_JaffaCakes118.exe
Size

296KB
MD5

fc22a53283a698ce6223d08254f7579e
SHA1

bd71da45daa316e78145fdffcb579229cefa0ae9
SHA256

a3fc7582c0a09e1b3f2b82a9a2941c12cb076c84cbfe811b2445de5bb4cc19b7
SHA512

9874f45e81db376a7e4d744a42a05699dfb34e5fc8a427110456dcdfe1374bd5f6dd4e4a28bb545a3041bb66cd8e275f7a96fdc81c5b7033a1da84dd0469856a
SSDEEP

6144:SijqqnucE1vRPeQnVW5GJZ2tNYLj8MfsoFaupxH/+MBTU0Y:SijfFE7PegVzYKj86soFaupJWP

Score

6^/10

bootkit persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1542.003

Processes:

fc22a53283a698ce6223d08254f7579e_JaffaCakes118.exe

description ioc process

File opened for modification \??\PhysicalDrive0 fc22a53283a698ce6223d08254f7579e_JaffaCakes118.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	fc22a53283a698ce6223d08254f7579e_JaffaCakes118.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

fc22a53283a698ce6223d08254f7579e_JaffaCakes118.exefc22a53283a698ce6223d08254f7579e_JaffaCakes118.exe

description	pid	process	target process
PID 1512 set thread context of 2904	1512	fc22a53283a698ce6223d08254f7579e_JaffaCakes118.exe	fc22a53283a698ce6223d08254f7579e_JaffaCakes118.exe
PID 2904 set thread context of 2640	2904	fc22a53283a698ce6223d08254f7579e_JaffaCakes118.exe	fc22a53283a698ce6223d08254f7579e_JaffaCakes118.exe

Modifies registry class 3 IoCs

Processes:

fc22a53283a698ce6223d08254f7579e_JaffaCakes118.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	fc22a53283a698ce6223d08254f7579e_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	fc22a53283a698ce6223d08254f7579e_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	fc22a53283a698ce6223d08254f7579e_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

fc22a53283a698ce6223d08254f7579e_JaffaCakes118.exefc22a53283a698ce6223d08254f7579e_JaffaCakes118.exe

pid process

1512 fc22a53283a698ce6223d08254f7579e_JaffaCakes118.exe
2904 fc22a53283a698ce6223d08254f7579e_JaffaCakes118.exe

pid	process
1512	fc22a53283a698ce6223d08254f7579e_JaffaCakes118.exe
2904	fc22a53283a698ce6223d08254f7579e_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

fc22a53283a698ce6223d08254f7579e_JaffaCakes118.exefc22a53283a698ce6223d08254f7579e_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\fc22a53283a698ce6223d08254f7579e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fc22a53283a698ce6223d08254f7579e_JaffaCakes118.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1512

C:\Users\Admin\AppData\Local\Temp\fc22a53283a698ce6223d08254f7579e_JaffaCakes118.exe
C:\Users\Admin\AppData\Local\Temp\fc22a53283a698ce6223d08254f7579e_JaffaCakes118.exe
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2904

C:\Users\Admin\AppData\Local\Temp\fc22a53283a698ce6223d08254f7579e_JaffaCakes118.exe
C:\Users\Admin\AppData\Local\Temp\fc22a53283a698ce6223d08254f7579e_JaffaCakes118.exe
3⤵
PID:2640

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1512-17-0x00000000026D0000-0x00000000026D1000-memory.dmp

Filesize
4KB

Download
memory/1512-15-0x0000000000550000-0x0000000000551000-memory.dmp

Filesize
4KB

Download
memory/1512-0-0x0000000000400000-0x0000000000528000-memory.dmp

Filesize
1.2MB

Download
memory/1512-3-0x0000000000250000-0x0000000000260000-memory.dmp

Filesize
64KB

Download
memory/1512-6-0x0000000002520000-0x0000000002521000-memory.dmp

Filesize
4KB

Download
memory/1512-7-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/1512-8-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/1512-9-0x0000000002690000-0x0000000002691000-memory.dmp

Filesize
4KB

Download
memory/1512-10-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/1512-11-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/1512-12-0x0000000000540000-0x0000000000541000-memory.dmp

Filesize
4KB

Download
memory/1512-13-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/1512-14-0x0000000000560000-0x0000000000561000-memory.dmp

Filesize
4KB

Download
memory/1512-19-0x00000000026C0000-0x00000000026C1000-memory.dmp

Filesize
4KB

Download
memory/1512-4-0x00000000005F0000-0x00000000005F1000-memory.dmp

Filesize
4KB

Download
memory/1512-25-0x00000000026E0000-0x00000000026E1000-memory.dmp

Filesize
4KB

Download
memory/1512-1-0x0000000000600000-0x000000000060C000-memory.dmp

Filesize
48KB

Download
memory/1512-21-0x0000000000400000-0x0000000000528000-memory.dmp

Filesize
1.2MB

Download
memory/1512-23-0x00000000026F0000-0x00000000026F1000-memory.dmp

Filesize
4KB

Download
memory/2640-38-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download
memory/2640-28-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2640-30-0x0000000000400000-0x00000000004083A0-memory.dmp

Filesize
32KB

Download
memory/2640-33-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2640-35-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2640-37-0x0000000000400000-0x00000000004083A0-memory.dmp

Filesize
32KB

Download
memory/2904-22-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2904-27-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2904-20-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2904-29-0x00000000027B0000-0x00000000028D8000-memory.dmp

Filesize
1.2MB

Download
memory/2904-32-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2904-16-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download

description	pid	process	target process
PID 1512 wrote to memory of 2904	1512	fc22a53283a698ce6223d08254f7579e_JaffaCakes118.exe	fc22a53283a698ce6223d08254f7579e_JaffaCakes118.exe
PID 1512 wrote to memory of 2904	1512	fc22a53283a698ce6223d08254f7579e_JaffaCakes118.exe	fc22a53283a698ce6223d08254f7579e_JaffaCakes118.exe
PID 1512 wrote to memory of 2904	1512	fc22a53283a698ce6223d08254f7579e_JaffaCakes118.exe	fc22a53283a698ce6223d08254f7579e_JaffaCakes118.exe
PID 1512 wrote to memory of 2904	1512	fc22a53283a698ce6223d08254f7579e_JaffaCakes118.exe	fc22a53283a698ce6223d08254f7579e_JaffaCakes118.exe
PID 1512 wrote to memory of 2904	1512	fc22a53283a698ce6223d08254f7579e_JaffaCakes118.exe	fc22a53283a698ce6223d08254f7579e_JaffaCakes118.exe
PID 1512 wrote to memory of 2904	1512	fc22a53283a698ce6223d08254f7579e_JaffaCakes118.exe	fc22a53283a698ce6223d08254f7579e_JaffaCakes118.exe
PID 1512 wrote to memory of 2904	1512	fc22a53283a698ce6223d08254f7579e_JaffaCakes118.exe	fc22a53283a698ce6223d08254f7579e_JaffaCakes118.exe
PID 1512 wrote to memory of 2904	1512	fc22a53283a698ce6223d08254f7579e_JaffaCakes118.exe	fc22a53283a698ce6223d08254f7579e_JaffaCakes118.exe
PID 1512 wrote to memory of 2904	1512	fc22a53283a698ce6223d08254f7579e_JaffaCakes118.exe	fc22a53283a698ce6223d08254f7579e_JaffaCakes118.exe
PID 2904 wrote to memory of 2640	2904	fc22a53283a698ce6223d08254f7579e_JaffaCakes118.exe	fc22a53283a698ce6223d08254f7579e_JaffaCakes118.exe
PID 2904 wrote to memory of 2640	2904	fc22a53283a698ce6223d08254f7579e_JaffaCakes118.exe	fc22a53283a698ce6223d08254f7579e_JaffaCakes118.exe
PID 2904 wrote to memory of 2640	2904	fc22a53283a698ce6223d08254f7579e_JaffaCakes118.exe	fc22a53283a698ce6223d08254f7579e_JaffaCakes118.exe
PID 2904 wrote to memory of 2640	2904	fc22a53283a698ce6223d08254f7579e_JaffaCakes118.exe	fc22a53283a698ce6223d08254f7579e_JaffaCakes118.exe
PID 2904 wrote to memory of 2640	2904	fc22a53283a698ce6223d08254f7579e_JaffaCakes118.exe	fc22a53283a698ce6223d08254f7579e_JaffaCakes118.exe
PID 2904 wrote to memory of 2640	2904	fc22a53283a698ce6223d08254f7579e_JaffaCakes118.exe	fc22a53283a698ce6223d08254f7579e_JaffaCakes118.exe
PID 2904 wrote to memory of 2640	2904	fc22a53283a698ce6223d08254f7579e_JaffaCakes118.exe	fc22a53283a698ce6223d08254f7579e_JaffaCakes118.exe
PID 2904 wrote to memory of 2640	2904	fc22a53283a698ce6223d08254f7579e_JaffaCakes118.exe	fc22a53283a698ce6223d08254f7579e_JaffaCakes118.exe

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads