52e562f150b5cad40866ba2cf3487ca08369cc2896693b5fac9ff8e2be1a7148

General

Target

fc2afd7c0e96ebf56d1bd0f5e939c830_JaffaCakes118.exe
Size

515KB
MD5

fc2afd7c0e96ebf56d1bd0f5e939c830
SHA1

f3193aeaf3b09e986074102d31086d2ab5318d6f
SHA256

52e562f150b5cad40866ba2cf3487ca08369cc2896693b5fac9ff8e2be1a7148
SHA512

0cc2fe6422bb36256a1f3dd0cd740120c673b0ca2fcdea56fe9b303089dbc9324dc72ba1488abe503770f69ab1fd041833d35a752b14a367a234fa1fc15b4ff0
SSDEEP

6144:L7m+RKkro+H8+ThEB9kT1pfIT6oG8Qp1YR0jlmV972EYuKNUg24TyQOI5Jgpcvql:LZROE7PASc2jy7SNUmT0Iw5pcEh3gw

Score

6^/10

bootkit persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1542.003

Processes:

fc2afd7c0e96ebf56d1bd0f5e939c830_JaffaCakes118.exe

description ioc process

File opened for modification \??\PhysicalDrive0 fc2afd7c0e96ebf56d1bd0f5e939c830_JaffaCakes118.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

fc2afd7c0e96ebf56d1bd0f5e939c830_JaffaCakes118.exe

description pid process

PID 1968 set thread context of 0 1968 fc2afd7c0e96ebf56d1bd0f5e939c830_JaffaCakes118.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	fc2afd7c0e96ebf56d1bd0f5e939c830_JaffaCakes118.exe

description	pid	process
PID 1968 set thread context of 0	1968	fc2afd7c0e96ebf56d1bd0f5e939c830_JaffaCakes118.exe

Modifies registry class 3 IoCs

Processes:

fc2afd7c0e96ebf56d1bd0f5e939c830_JaffaCakes118.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	fc2afd7c0e96ebf56d1bd0f5e939c830_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	fc2afd7c0e96ebf56d1bd0f5e939c830_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	fc2afd7c0e96ebf56d1bd0f5e939c830_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

fc2afd7c0e96ebf56d1bd0f5e939c830_JaffaCakes118.exe

pid process

1968 fc2afd7c0e96ebf56d1bd0f5e939c830_JaffaCakes118.exe

pid	process
1968	fc2afd7c0e96ebf56d1bd0f5e939c830_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

fc2afd7c0e96ebf56d1bd0f5e939c830_JaffaCakes118.exe

description	pid	process
PID 1968 wrote to memory of 0	1968	fc2afd7c0e96ebf56d1bd0f5e939c830_JaffaCakes118.exe
PID 1968 wrote to memory of 0	1968	fc2afd7c0e96ebf56d1bd0f5e939c830_JaffaCakes118.exe
PID 1968 wrote to memory of 0	1968	fc2afd7c0e96ebf56d1bd0f5e939c830_JaffaCakes118.exe
PID 1968 wrote to memory of 0	1968	fc2afd7c0e96ebf56d1bd0f5e939c830_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\fc2afd7c0e96ebf56d1bd0f5e939c830_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fc2afd7c0e96ebf56d1bd0f5e939c830_JaffaCakes118.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1968

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1968-0-0x0000000000400000-0x00000000005A7000-memory.dmp

Filesize
1.7MB

Download
memory/1968-2-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/1968-4-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/1968-3-0x00000000003E0000-0x00000000003F0000-memory.dmp

Filesize
64KB

Download
memory/1968-1-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/1968-8-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1968-7-0x00000000002C0000-0x00000000002D0000-memory.dmp

Filesize
64KB

Download
memory/1968-9-0x0000000000390000-0x0000000000391000-memory.dmp

Filesize
4KB

Download
memory/1968-13-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/1968-12-0x00000000002D0000-0x00000000002D1000-memory.dmp

Filesize
4KB

Download
memory/1968-11-0x00000000002E0000-0x00000000002E1000-memory.dmp

Filesize
4KB

Download
memory/1968-10-0x00000000005B0000-0x00000000005B1000-memory.dmp

Filesize
4KB

Download
memory/1968-14-0x0000000000300000-0x0000000000301000-memory.dmp

Filesize
4KB

Download
memory/1968-15-0x00000000002F0000-0x00000000002F1000-memory.dmp

Filesize
4KB

Download
memory/1968-16-0x0000000000330000-0x0000000000331000-memory.dmp

Filesize
4KB

Download
memory/1968-17-0x0000000000320000-0x0000000000321000-memory.dmp

Filesize
4KB

Download
memory/1968-18-0x00000000005F0000-0x00000000005F1000-memory.dmp

Filesize
4KB

Download
memory/1968-19-0x00000000005E0000-0x00000000005E1000-memory.dmp

Filesize
4KB

Download
memory/1968-20-0x0000000002640000-0x0000000002641000-memory.dmp

Filesize
4KB

Download
memory/1968-21-0x0000000002630000-0x0000000002631000-memory.dmp

Filesize
4KB

Download
memory/1968-22-0x0000000002660000-0x0000000002661000-memory.dmp

Filesize
4KB

Download
memory/1968-23-0x0000000002650000-0x0000000002651000-memory.dmp

Filesize
4KB

Download
memory/1968-35-0x0000000000400000-0x00000000005A7000-memory.dmp

Filesize
1.7MB

Download
memory/1968-34-0x0000000002970000-0x0000000002971000-memory.dmp

Filesize
4KB

Download
memory/1968-33-0x0000000002940000-0x0000000002941000-memory.dmp

Filesize
4KB

Download
memory/1968-36-0x0000000002960000-0x0000000002961000-memory.dmp

Filesize
4KB

Download
memory/1968-32-0x0000000002950000-0x0000000002951000-memory.dmp

Filesize
4KB

Download
memory/1968-31-0x0000000002910000-0x0000000002911000-memory.dmp

Filesize
4KB

Download
memory/1968-30-0x0000000002920000-0x0000000002921000-memory.dmp

Filesize
4KB

Download
memory/1968-29-0x00000000027B0000-0x00000000027B1000-memory.dmp

Filesize
4KB

Download
memory/1968-28-0x00000000027C0000-0x00000000027C1000-memory.dmp

Filesize
4KB

Download
memory/1968-27-0x00000000005C0000-0x00000000005C1000-memory.dmp

Filesize
4KB

Download
memory/1968-26-0x00000000005D0000-0x00000000005D1000-memory.dmp

Filesize
4KB

Download
memory/1968-25-0x0000000002670000-0x0000000002671000-memory.dmp

Filesize
4KB

Download
memory/1968-24-0x00000000027A0000-0x00000000027A1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing