69bb50163f5f147c350195fdd09a15df5f94dd167bfa0a733aed3d9af36d7606

Analysis

max time kernel
7s
max time network
11s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20-04-2024 09:39

Sharing

Reason

Machine shutdown: "{\"level\":\"info\",\"time\":\"2024-04-20T09:39:33Z\",\"message\":\"Dirty snapshot: /var/lib/sandbox/hatchvm/win7-20240221-en/instance_30-dirty.qcow2\"}"

Report Analysis Logs

General

Target

fc766d8589f0ab218a945ae00649f695_JaffaCakes118.exe
Size

171KB
MD5

fc766d8589f0ab218a945ae00649f695
SHA1

4572659953d68bee2977d0f8bd0e58339c21303b
SHA256

69bb50163f5f147c350195fdd09a15df5f94dd167bfa0a733aed3d9af36d7606
SHA512

8819c2d7e68fcc318ec38f52abe11410438b6aa78fd64ef48cd885ebf120e3a24096e08686e9c5b51a002e0e2769222b5c67da151d128ed656b1935edbaadd83
SSDEEP

768:EBJSZqwuOScxKt90mUFNzj78/e/fnbLY6WjkBvNEzay94kJsX8gKAoZLc:EBS1hfb8W/fnbLYF8U68gsZLc

Score

6^/10

bootkit persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1542.003

Processes:

fc766d8589f0ab218a945ae00649f695_JaffaCakes118.exe

description ioc process

File opened for modification \??\PHYSICALDRIVE0 fc766d8589f0ab218a945ae00649f695_JaffaCakes118.exe

description	ioc	process
File opened for modification	\??\PHYSICALDRIVE0	fc766d8589f0ab218a945ae00649f695_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

fc766d8589f0ab218a945ae00649f695_JaffaCakes118.exe

description	pid	process	target process
PID 2020 set thread context of 3036	2020	fc766d8589f0ab218a945ae00649f695_JaffaCakes118.exe	fc766d8589f0ab218a945ae00649f695_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

fc766d8589f0ab218a945ae00649f695_JaffaCakes118.exe

description pid process

Token: SeShutdownPrivilege 3036 fc766d8589f0ab218a945ae00649f695_JaffaCakes118.exe

description	pid	process
Token: SeShutdownPrivilege	3036	fc766d8589f0ab218a945ae00649f695_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

fc766d8589f0ab218a945ae00649f695_JaffaCakes118.exe

description	pid	process	target process
PID 2020 wrote to memory of 3036	2020	fc766d8589f0ab218a945ae00649f695_JaffaCakes118.exe	fc766d8589f0ab218a945ae00649f695_JaffaCakes118.exe
PID 2020 wrote to memory of 3036	2020	fc766d8589f0ab218a945ae00649f695_JaffaCakes118.exe	fc766d8589f0ab218a945ae00649f695_JaffaCakes118.exe
PID 2020 wrote to memory of 3036	2020	fc766d8589f0ab218a945ae00649f695_JaffaCakes118.exe	fc766d8589f0ab218a945ae00649f695_JaffaCakes118.exe
PID 2020 wrote to memory of 3036	2020	fc766d8589f0ab218a945ae00649f695_JaffaCakes118.exe	fc766d8589f0ab218a945ae00649f695_JaffaCakes118.exe
PID 2020 wrote to memory of 3036	2020	fc766d8589f0ab218a945ae00649f695_JaffaCakes118.exe	fc766d8589f0ab218a945ae00649f695_JaffaCakes118.exe
PID 2020 wrote to memory of 3036	2020	fc766d8589f0ab218a945ae00649f695_JaffaCakes118.exe	fc766d8589f0ab218a945ae00649f695_JaffaCakes118.exe
PID 2020 wrote to memory of 3036	2020	fc766d8589f0ab218a945ae00649f695_JaffaCakes118.exe	fc766d8589f0ab218a945ae00649f695_JaffaCakes118.exe
PID 2020 wrote to memory of 3036	2020	fc766d8589f0ab218a945ae00649f695_JaffaCakes118.exe	fc766d8589f0ab218a945ae00649f695_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\fc766d8589f0ab218a945ae00649f695_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fc766d8589f0ab218a945ae00649f695_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2020

C:\Users\Admin\AppData\Local\Temp\fc766d8589f0ab218a945ae00649f695_JaffaCakes118.exe
C:\Users\Admin\AppData\Local\Temp\fc766d8589f0ab218a945ae00649f695_JaffaCakes118.exe
2⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of AdjustPrivilegeToken
PID:3036

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
1⤵
PID:2544

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x1
1⤵
PID:2944

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2020-8-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2544-12-0x0000000002A40000-0x0000000002A41000-memory.dmp

Filesize
4KB

Download
memory/2944-13-0x00000000027F0000-0x00000000027F1000-memory.dmp

Filesize
4KB

Download
memory/3036-1-0x000000002AA00000-0x000000002AA06000-memory.dmp

Filesize
24KB

Download
memory/3036-2-0x000000002AA00000-0x000000002AA06000-memory.dmp

Filesize
24KB

Download
memory/3036-3-0x000000002AA00000-0x000000002AA06000-memory.dmp

Filesize
24KB

Download
memory/3036-4-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/3036-6-0x000000002AA00000-0x000000002AA06000-memory.dmp

Filesize
24KB

Download
memory/3036-10-0x000000002AA00000-0x000000002AA06000-memory.dmp

Filesize
24KB

Download
memory/3036-11-0x000000002AA00000-0x000000002AA06000-memory.dmp

Filesize
24KB

Download