69bb50163f5f147c350195fdd09a15df5f94dd167bfa0a733aed3d9af36d7606

Reason

Machine shutdown: "{\"level\":\"info\",\"time\":\"2024-04-20T09:39:49Z\",\"message\":\"Dirty snapshot: /var/lib/sandbox/hatchvm/win10v2004-20240226-en/instance_30-dirty.qcow2\"}"

General

Target

fc766d8589f0ab218a945ae00649f695_JaffaCakes118.exe
Size

171KB
MD5

fc766d8589f0ab218a945ae00649f695
SHA1

4572659953d68bee2977d0f8bd0e58339c21303b
SHA256

69bb50163f5f147c350195fdd09a15df5f94dd167bfa0a733aed3d9af36d7606
SHA512

8819c2d7e68fcc318ec38f52abe11410438b6aa78fd64ef48cd885ebf120e3a24096e08686e9c5b51a002e0e2769222b5c67da151d128ed656b1935edbaadd83
SSDEEP

768:EBJSZqwuOScxKt90mUFNzj78/e/fnbLY6WjkBvNEzay94kJsX8gKAoZLc:EBS1hfb8W/fnbLYF8U68gsZLc

Score

6^/10

bootkit persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1542.003

Processes:

fc766d8589f0ab218a945ae00649f695_JaffaCakes118.exe

description ioc process

File opened for modification \??\PHYSICALDRIVE0 fc766d8589f0ab218a945ae00649f695_JaffaCakes118.exe

description	ioc	process
File opened for modification	\??\PHYSICALDRIVE0	fc766d8589f0ab218a945ae00649f695_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

fc766d8589f0ab218a945ae00649f695_JaffaCakes118.exe

description	pid	process	target process
PID 3844 set thread context of 2412	3844	fc766d8589f0ab218a945ae00649f695_JaffaCakes118.exe	fc766d8589f0ab218a945ae00649f695_JaffaCakes118.exe

Modifies data under HKEY_USERS 15 IoCs

Processes:

LogonUI.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "221"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

fc766d8589f0ab218a945ae00649f695_JaffaCakes118.exe

description pid process

Token: SeShutdownPrivilege 2412 fc766d8589f0ab218a945ae00649f695_JaffaCakes118.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

LogonUI.exe

pid process

1936 LogonUI.exe

description	pid	process
Token: SeShutdownPrivilege	2412	fc766d8589f0ab218a945ae00649f695_JaffaCakes118.exe

pid	process
1936	LogonUI.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

fc766d8589f0ab218a945ae00649f695_JaffaCakes118.exe

description	pid	process	target process
PID 3844 wrote to memory of 2412	3844	fc766d8589f0ab218a945ae00649f695_JaffaCakes118.exe	fc766d8589f0ab218a945ae00649f695_JaffaCakes118.exe
PID 3844 wrote to memory of 2412	3844	fc766d8589f0ab218a945ae00649f695_JaffaCakes118.exe	fc766d8589f0ab218a945ae00649f695_JaffaCakes118.exe
PID 3844 wrote to memory of 2412	3844	fc766d8589f0ab218a945ae00649f695_JaffaCakes118.exe	fc766d8589f0ab218a945ae00649f695_JaffaCakes118.exe
PID 3844 wrote to memory of 2412	3844	fc766d8589f0ab218a945ae00649f695_JaffaCakes118.exe	fc766d8589f0ab218a945ae00649f695_JaffaCakes118.exe
PID 3844 wrote to memory of 2412	3844	fc766d8589f0ab218a945ae00649f695_JaffaCakes118.exe	fc766d8589f0ab218a945ae00649f695_JaffaCakes118.exe
PID 3844 wrote to memory of 2412	3844	fc766d8589f0ab218a945ae00649f695_JaffaCakes118.exe	fc766d8589f0ab218a945ae00649f695_JaffaCakes118.exe
PID 3844 wrote to memory of 2412	3844	fc766d8589f0ab218a945ae00649f695_JaffaCakes118.exe	fc766d8589f0ab218a945ae00649f695_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\fc766d8589f0ab218a945ae00649f695_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fc766d8589f0ab218a945ae00649f695_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3844

C:\Users\Admin\AppData\Local\Temp\fc766d8589f0ab218a945ae00649f695_JaffaCakes118.exe
C:\Users\Admin\AppData\Local\Temp\fc766d8589f0ab218a945ae00649f695_JaffaCakes118.exe
2⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of AdjustPrivilegeToken
PID:2412

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa39fb055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:1936

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2412-1-0x000000002AA00000-0x000000002AA06000-memory.dmp

Filesize
24KB

Download
memory/2412-3-0x000000002AA00000-0x000000002AA06000-memory.dmp

Filesize
24KB

Download
memory/2412-6-0x000000002AA00000-0x000000002AA06000-memory.dmp

Filesize
24KB

Download
memory/2412-7-0x000000002AA00000-0x000000002AA06000-memory.dmp

Filesize
24KB

Download
memory/3844-5-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads