3598b2b039ee792d286e36cc0bfd70cb32e945557fe6242738c09b7f0d6220f4

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
20-04-2024 09:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fc75e4bcdb18945f30721cdd3a15ea2c_JaffaCakes118.exe
Size

140KB
MD5

fc75e4bcdb18945f30721cdd3a15ea2c
SHA1

29ecc9811c6e019a273d98e45cffc3c0bc42aff5
SHA256

3598b2b039ee792d286e36cc0bfd70cb32e945557fe6242738c09b7f0d6220f4
SHA512

bc89b03a662014ecea93e675d9278be6e388598959e56acea3fc679cc681670e881590dc8a97e31a4c2b13147b5559ad1f14431cf6732a584003749abddabec9
SSDEEP

3072:EzzIS2PUcbif2XuGp40vbbrMbvT0q8O1cZPzQ7IXMBc+AMP+QfQEhxFyVU70GfdN:Ez8S2PTiuXuGW0jwvP6bQ7yMP+DE827D

Score

6^/10

bootkit persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1542.003

Processes:

fc75e4bcdb18945f30721cdd3a15ea2c_JaffaCakes118.exe

description ioc process

File opened for modification \??\PhysicalDrive0 fc75e4bcdb18945f30721cdd3a15ea2c_JaffaCakes118.exe
Drops file in System32 directory 1 IoCs

Processes:

fc75e4bcdb18945f30721cdd3a15ea2c_JaffaCakes118.exe

description ioc process

File created C:\Windows\SysWOW64\mprmsgse.axz fc75e4bcdb18945f30721cdd3a15ea2c_JaffaCakes118.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	fc75e4bcdb18945f30721cdd3a15ea2c_JaffaCakes118.exe

description	ioc	process
File created	C:\Windows\SysWOW64\mprmsgse.axz	fc75e4bcdb18945f30721cdd3a15ea2c_JaffaCakes118.exe

Modifies registry class 8 IoCs

Processes:

fc75e4bcdb18945f30721cdd3a15ea2c_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F9BA1AA9-CAD4-4C14-BDE6-922DFF5F6F38}\dlloadtime = "1713605901"	fc75e4bcdb18945f30721cdd3a15ea2c_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F9BA1AA9-CAD4-4C14-BDE6-922DFF5F6F38}\mac = "62-AB-D1-C1-14-F0"	fc75e4bcdb18945f30721cdd3a15ea2c_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F9BA1AA9-CAD4-4C14-BDE6-922DFF5F6F38}\dlt = "1713605901"	fc75e4bcdb18945f30721cdd3a15ea2c_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F9BA1AA9-CAD4-4C14-BDE6-922DFF5F6F38}\dlnmi = "1713605901"	fc75e4bcdb18945f30721cdd3a15ea2c_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	fc75e4bcdb18945f30721cdd3a15ea2c_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	fc75e4bcdb18945f30721cdd3a15ea2c_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	fc75e4bcdb18945f30721cdd3a15ea2c_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{F9BA1AA9-CAD4-4C14-BDE6-922DFF5F6F38}	fc75e4bcdb18945f30721cdd3a15ea2c_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\fc75e4bcdb18945f30721cdd3a15ea2c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fc75e4bcdb18945f30721cdd3a15ea2c_JaffaCakes118.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Modifies registry class
PID:2548

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2548-0-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2548-63-0x0000000002820000-0x0000000002821000-memory.dmp

Filesize
4KB

Download
memory/2548-64-0x0000000002980000-0x0000000002981000-memory.dmp

Filesize
4KB

Download
memory/2548-62-0x00000000003C0000-0x00000000003C1000-memory.dmp

Filesize
4KB

Download
memory/2548-61-0x0000000002AD0000-0x0000000002AD1000-memory.dmp

Filesize
4KB

Download
memory/2548-60-0x0000000002AE0000-0x0000000002AE1000-memory.dmp

Filesize
4KB

Download
memory/2548-59-0x0000000002970000-0x0000000002971000-memory.dmp

Filesize
4KB

Download
memory/2548-58-0x0000000002810000-0x0000000002811000-memory.dmp

Filesize
4KB

Download
memory/2548-57-0x00000000027F0000-0x00000000027F1000-memory.dmp

Filesize
4KB

Download
memory/2548-56-0x0000000002800000-0x0000000002801000-memory.dmp

Filesize
4KB

Download
memory/2548-55-0x00000000027D0000-0x00000000027D1000-memory.dmp

Filesize
4KB

Download
memory/2548-54-0x00000000027E0000-0x00000000027E1000-memory.dmp

Filesize
4KB

Download
memory/2548-53-0x00000000023D0000-0x00000000023D1000-memory.dmp

Filesize
4KB

Download
memory/2548-52-0x00000000023E0000-0x00000000023E1000-memory.dmp

Filesize
4KB

Download
memory/2548-51-0x00000000023B0000-0x00000000023B1000-memory.dmp

Filesize
4KB

Download
memory/2548-50-0x00000000023C0000-0x00000000023C1000-memory.dmp

Filesize
4KB

Download
memory/2548-49-0x0000000002390000-0x0000000002391000-memory.dmp

Filesize
4KB

Download
memory/2548-48-0x00000000023A0000-0x00000000023A1000-memory.dmp

Filesize
4KB

Download
memory/2548-47-0x0000000002370000-0x0000000002371000-memory.dmp

Filesize
4KB

Download
memory/2548-46-0x0000000002380000-0x0000000002381000-memory.dmp

Filesize
4KB

Download
memory/2548-45-0x0000000002350000-0x0000000002351000-memory.dmp

Filesize
4KB

Download
memory/2548-44-0x0000000002360000-0x0000000002361000-memory.dmp

Filesize
4KB

Download
memory/2548-43-0x0000000002330000-0x0000000002331000-memory.dmp

Filesize
4KB

Download
memory/2548-42-0x0000000002340000-0x0000000002341000-memory.dmp

Filesize
4KB

Download
memory/2548-41-0x00000000022F0000-0x00000000022F1000-memory.dmp

Filesize
4KB

Download
memory/2548-40-0x0000000002320000-0x0000000002321000-memory.dmp

Filesize
4KB

Download
memory/2548-39-0x00000000022D0000-0x00000000022D1000-memory.dmp

Filesize
4KB

Download
memory/2548-38-0x00000000022E0000-0x00000000022E1000-memory.dmp

Filesize
4KB

Download
memory/2548-37-0x00000000022B0000-0x00000000022B1000-memory.dmp

Filesize
4KB

Download
memory/2548-36-0x00000000022C0000-0x00000000022C1000-memory.dmp

Filesize
4KB

Download
memory/2548-35-0x0000000002290000-0x0000000002291000-memory.dmp

Filesize
4KB

Download
memory/2548-34-0x00000000022A0000-0x00000000022A1000-memory.dmp

Filesize
4KB

Download
memory/2548-33-0x0000000001F60000-0x0000000001F61000-memory.dmp

Filesize
4KB

Download
memory/2548-32-0x0000000002280000-0x0000000002281000-memory.dmp

Filesize
4KB

Download
memory/2548-31-0x0000000001F40000-0x0000000001F41000-memory.dmp

Filesize
4KB

Download
memory/2548-30-0x0000000001F50000-0x0000000001F51000-memory.dmp

Filesize
4KB

Download
memory/2548-29-0x0000000001D00000-0x0000000001D01000-memory.dmp

Filesize
4KB

Download
memory/2548-28-0x0000000001F30000-0x0000000001F31000-memory.dmp

Filesize
4KB

Download
memory/2548-27-0x0000000001CE0000-0x0000000001CE1000-memory.dmp

Filesize
4KB

Download
memory/2548-26-0x0000000001CF0000-0x0000000001CF1000-memory.dmp

Filesize
4KB

Download
memory/2548-25-0x0000000001CC0000-0x0000000001CC1000-memory.dmp

Filesize
4KB

Download
memory/2548-24-0x0000000001CD0000-0x0000000001CD1000-memory.dmp

Filesize
4KB

Download
memory/2548-23-0x0000000001CA0000-0x0000000001CA1000-memory.dmp

Filesize
4KB

Download
memory/2548-22-0x0000000001CB0000-0x0000000001CB1000-memory.dmp

Filesize
4KB

Download
memory/2548-21-0x0000000001C80000-0x0000000001C81000-memory.dmp

Filesize
4KB

Download
memory/2548-20-0x0000000001C90000-0x0000000001C91000-memory.dmp

Filesize
4KB

Download
memory/2548-19-0x0000000001C60000-0x0000000001C61000-memory.dmp

Filesize
4KB

Download
memory/2548-18-0x0000000001C70000-0x0000000001C71000-memory.dmp

Filesize
4KB

Download
memory/2548-17-0x0000000000510000-0x0000000000511000-memory.dmp

Filesize
4KB

Download
memory/2548-16-0x0000000000520000-0x0000000000521000-memory.dmp

Filesize
4KB

Download
memory/2548-15-0x00000000004F0000-0x00000000004F1000-memory.dmp

Filesize
4KB

Download
memory/2548-14-0x0000000000500000-0x0000000000501000-memory.dmp

Filesize
4KB

Download
memory/2548-13-0x00000000004D0000-0x00000000004D1000-memory.dmp

Filesize
4KB

Download
memory/2548-12-0x00000000004E0000-0x00000000004E1000-memory.dmp

Filesize
4KB

Download
memory/2548-11-0x00000000004B0000-0x00000000004B1000-memory.dmp

Filesize
4KB

Download
memory/2548-10-0x00000000004C0000-0x00000000004C1000-memory.dmp

Filesize
4KB

Download
memory/2548-8-0x0000000000490000-0x0000000000491000-memory.dmp

Filesize
4KB

Download
memory/2548-7-0x00000000004A0000-0x00000000004A1000-memory.dmp

Filesize
4KB

Download
memory/2548-6-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/2548-5-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2548-4-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/2548-3-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/2548-2-0x00000000003D0000-0x00000000003D2000-memory.dmp

Filesize
8KB

Download
memory/2548-1-0x0000000000440000-0x0000000000470000-memory.dmp

Filesize
192KB

Download
memory/2548-76-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download