e230003597e8a3942e9358b9642e1229f01d566383b202153927fc4bd806715f

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20-04-2024 09:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fc66b7875add3e5507b88048937fa4af_JaffaCakes118.exe
Size

136KB
MD5

fc66b7875add3e5507b88048937fa4af
SHA1

02e30b09c3dbbce94939b3bf97a45f1b1f460a88
SHA256

e230003597e8a3942e9358b9642e1229f01d566383b202153927fc4bd806715f
SHA512

6c98f5170c7ca87c105065d94234305d64192799266929cc57af2212677af22ed16e6f44b6990cb925f2ab4c8c07131d0511ea4aac0f7b3cab0cec6b3d2902a4
SSDEEP

3072:hOstg+b+nn8MNr+2/DAWjlO2H2y4UerhcXVEhojKmDH89MkXa4OoyWNu:hOn+b+n8M5+gxOTyTq2XVEhojp81XaDl

Score

7^/10

bootkit persistence

Malware Config

Signatures

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

2500 cmd.exe
Loads dropped DLL 1 IoCs

Processes:

fc66b7875add3e5507b88048937fa4af_JaffaCakes118.exe

pid process

2868 fc66b7875add3e5507b88048937fa4af_JaffaCakes118.exe
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1542.003

Processes:

fc66b7875add3e5507b88048937fa4af_JaffaCakes118.exe

description ioc process

File opened for modification \??\PhysicalDrive0 fc66b7875add3e5507b88048937fa4af_JaffaCakes118.exe

pid	process
2500	cmd.exe

pid	process
2868	fc66b7875add3e5507b88048937fa4af_JaffaCakes118.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	fc66b7875add3e5507b88048937fa4af_JaffaCakes118.exe

Drops file in System32 directory 2 IoCs

Processes:

fc66b7875add3e5507b88048937fa4af_JaffaCakes118.exe

description	ioc	process
File created	C:\Windows\SysWOW64\od3mdi.dll	fc66b7875add3e5507b88048937fa4af_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\delplme.bat	fc66b7875add3e5507b88048937fa4af_JaffaCakes118.exe

Suspicious behavior: LoadsDriver 2 IoCs

Processes:

fc66b7875add3e5507b88048937fa4af_JaffaCakes118.exe

pid process

2868 fc66b7875add3e5507b88048937fa4af_JaffaCakes118.exe
472
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

fc66b7875add3e5507b88048937fa4af_JaffaCakes118.exe

description pid process

Token: SeLoadDriverPrivilege 2868 fc66b7875add3e5507b88048937fa4af_JaffaCakes118.exe

pid	process
2868	fc66b7875add3e5507b88048937fa4af_JaffaCakes118.exe
472

description	pid	process
Token: SeLoadDriverPrivilege	2868	fc66b7875add3e5507b88048937fa4af_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

fc66b7875add3e5507b88048937fa4af_JaffaCakes118.exe

description	pid	process	target process
PID 2868 wrote to memory of 2500	2868	fc66b7875add3e5507b88048937fa4af_JaffaCakes118.exe	cmd.exe
PID 2868 wrote to memory of 2500	2868	fc66b7875add3e5507b88048937fa4af_JaffaCakes118.exe	cmd.exe
PID 2868 wrote to memory of 2500	2868	fc66b7875add3e5507b88048937fa4af_JaffaCakes118.exe	cmd.exe
PID 2868 wrote to memory of 2500	2868	fc66b7875add3e5507b88048937fa4af_JaffaCakes118.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\fc66b7875add3e5507b88048937fa4af_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fc66b7875add3e5507b88048937fa4af_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2868

C:\Windows\SysWOW64\cmd.exe
cmd /c delplme.bat
2⤵
- Deletes itself
PID:2500

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\delplme.bat
Filesize
306B

MD5
48619188df966863fb3b08464ce2f999

SHA1
82d3f26cb36d95f37d7a6850d12f88c98830bf38

SHA256
51fd2278e7e590514c1a4130725c3abc14ac280a3efe33187cc2a565469a41ff

SHA512
0d36b417daac976e5a8d3c8a11e6c2451f754d9580435a0bd8cee5d75a9dcfb027e084fda43cb6e82cdff9e1a7db593f3030901ebc5124bda4a546e7b96c0c1f

Download Submit
\Windows\SysWOW64\od3mdi.dll
Filesize
100KB

MD5
55720045c16aa2011d3b6704a56b65e8

SHA1
acca53faf75011c7a81281b068f5f6a0b71fc497

SHA256
100bb605577c3807cb43218c2f0dbe321213e71099adfafe9a20ea91470be82b

SHA512
93d572c53b326963fa7a88f08b2fef967d691d0b707f3c8945d9755ec1e612576c2da2364e105d382270c6b42709e447499a102e3c092be71db084032cf60ff5

Download Submit
memory/2868-0-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/2868-11-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download