Overview

overview

8

Static

static

3

fc9f0d47c5...18.exe

windows7-x64

7

fc9f0d47c5...18.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    124s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-04-2024 11:06

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    fc9f0d47c5ea4e9b5c56123cd0f5cd48_JaffaCakes118.exe

  • Size

    820KB

  • MD5

    fc9f0d47c5ea4e9b5c56123cd0f5cd48

  • SHA1

    4b79570ed534367e839ea60803b20a8d5a790589

  • SHA256

    e9f78f44fb370fa80836b165ec33f8022fa098173557b205c51ecfe7bda240ea

  • SHA512

    06d807866a36e734b86972b7e681ebc8c34008c61ed18c174bdc95da7a7915c6fe9d72c6a8b2e98543b6e1b721c1122234bde83c3d500d1548c7a3e613c0f00d

  • SSDEEP

    24576:XwHp6MM2bCHmyObXLJc181Df6BsxOo+Kt:XwA72bvy8Ly189KsxPt

Score
8/10
bootkitpersistence

Malware Config

Signatures

  • Modifies Installed Components in the registry 2 TTPs 5 IoCs
    persistence
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 31 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 11 IoCs
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\fc9f0d47c5ea4e9b5c56123cd0f5cd48_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\fc9f0d47c5ea4e9b5c56123cd0f5cd48_JaffaCakes118.exe"
    1⤵
    • Adds Run key to start application
    • Enumerates connected drives
    • Writes to the Master Boot Record (MBR)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:2052
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2052 -s 756
      2⤵
      • Program crash
      PID:5028
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2052 -s 788
      2⤵
      • Program crash
      PID:1016
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2052 -s 1248
      2⤵
      • Program crash
      PID:2832
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2052 -s 1280
      2⤵
      • Program crash
      PID:3056
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2052 -s 1356
      2⤵
      • Program crash
      PID:2532
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2052 -s 1352
      2⤵
      • Program crash
      PID:4892
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2052 -s 1360
      2⤵
      • Program crash
      PID:4364
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2052 -s 1360
      2⤵
      • Program crash
      PID:4924
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2052 -s 1476
      2⤵
      • Program crash
      PID:4312
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2052 -s 1936
      2⤵
      • Program crash
      PID:4236
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2052 -s 1400
      2⤵
      • Program crash
      PID:1296
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2052 -ip 2052
    1⤵
      PID:4420
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2052 -ip 2052
      1⤵
        PID:824
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 2052 -ip 2052
        1⤵
          PID:2900
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 2052 -ip 2052
          1⤵
            PID:4148
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 2052 -ip 2052
            1⤵
              PID:4972
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2052 -ip 2052
              1⤵
                PID:4532
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2052 -ip 2052
                1⤵
                  PID:3540
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 2052 -ip 2052
                  1⤵
                    PID:3048
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 2052 -ip 2052
                    1⤵
                      PID:2248
                    • C:\Windows\system32\sihost.exe
                      sihost.exe
                      1⤵
                      • Suspicious use of FindShellTrayWindow
                      • Suspicious use of WriteProcessMemory
                      PID:2720
                      • C:\Windows\explorer.exe
                        explorer.exe /LOADSAVEDWINDOWS
                        2⤵
                        • Modifies Installed Components in the registry
                        • Enumerates connected drives
                        • Checks SCSI registry key(s)
                        • Modifies registry class
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of FindShellTrayWindow
                        • Suspicious use of SendNotifyMessage
                        PID:3280
                    • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
                      "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
                      1⤵
                      • Modifies data under HKEY_USERS
                      • Suspicious use of SetWindowsHookEx
                      PID:4308
                    • C:\Windows\system32\sihost.exe
                      sihost.exe
                      1⤵
                      • Suspicious use of FindShellTrayWindow
                      • Suspicious use of WriteProcessMemory
                      PID:2832
                      • C:\Windows\explorer.exe
                        explorer.exe /LOADSAVEDWINDOWS
                        2⤵
                        • Modifies Installed Components in the registry
                        • Enumerates connected drives
                        • Checks SCSI registry key(s)
                        • Modifies registry class
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of FindShellTrayWindow
                        • Suspicious use of SendNotifyMessage
                        PID:2108
                    • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
                      "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
                      1⤵
                      • Modifies data under HKEY_USERS
                      • Suspicious use of SetWindowsHookEx
                      PID:4148
                    • C:\Windows\system32\sihost.exe
                      sihost.exe
                      1⤵
                      • Suspicious use of FindShellTrayWindow
                      • Suspicious use of WriteProcessMemory
                      PID:4904
                      • C:\Windows\explorer.exe
                        explorer.exe /LOADSAVEDWINDOWS
                        2⤵
                        • Modifies Installed Components in the registry
                        • Enumerates connected drives
                        • Checks SCSI registry key(s)
                        • Modifies registry class
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of FindShellTrayWindow
                        • Suspicious use of SendNotifyMessage
                        PID:1116
                    • C:\Windows\system32\sihost.exe
                      sihost.exe
                      1⤵
                      • Modifies registry class
                      • Suspicious use of FindShellTrayWindow
                      • Suspicious use of WriteProcessMemory
                      PID:4356
                      • C:\Windows\explorer.exe
                        explorer.exe /LOADSAVEDWINDOWS
                        2⤵
                        • Modifies Installed Components in the registry
                        • Enumerates connected drives
                        • Checks SCSI registry key(s)
                        • Modifies registry class
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of SendNotifyMessage
                        PID:4180
                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                      1⤵
                        PID:636
                      • C:\Windows\system32\sihost.exe
                        sihost.exe
                        1⤵
                          PID:3572
                        • C:\Windows\system32\sihost.exe
                          sihost.exe
                          1⤵
                          • Suspicious use of WriteProcessMemory
                          PID:380
                          • C:\Windows\explorer.exe
                            explorer.exe /LOADSAVEDWINDOWS
                            2⤵
                              PID:428
                          • C:\Windows\explorer.exe
                            explorer.exe
                            1⤵
                            • Modifies Installed Components in the registry
                            • Enumerates connected drives
                            • Checks SCSI registry key(s)
                            • Modifies registry class
                            • Suspicious use of AdjustPrivilegeToken
                            • Suspicious use of SetWindowsHookEx
                            PID:692
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 2052 -ip 2052
                            1⤵
                              PID:884
                            • C:\Windows\SysWOW64\WerFault.exe
                              C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2052 -ip 2052
                              1⤵
                                PID:4984

                              Network

                              MITRE ATT&CK Matrix ATT&CK v13

                              Initial Access

                              Execution

                              Persistence

                              Boot or Logon Autostart Execution

                              2
                              T1547

                              Registry Run Keys / Startup Folder

                              2
                              T1547.001

                              Pre-OS Boot

                              1
                              T1542

                              Bootkit

                              1
                              T1542.003

                              Privilege Escalation

                              Boot or Logon Autostart Execution

                              2
                              T1547

                              Registry Run Keys / Startup Folder

                              2
                              T1547.001

                              Defense Evasion

                              Modify Registry

                              2
                              T1112

                              Pre-OS Boot

                              1
                              T1542

                              Bootkit

                              1
                              T1542.003

                              Credential Access

                              Discovery

                              Query Registry

                              3
                              T1012

                              Peripheral Device Discovery

                              2
                              T1120

                              System Information Discovery

                              3
                              T1082

                              Lateral Movement

                              Collection

                              Exfiltration

                              Command and Control

                              Impact

                              Resource Development

                              Reconnaissance

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53
                                Filesize

                                471B

                                MD5

                                f3945b57f0f3c105bd40af2901e4822a

                                SHA1

                                93dabbe9a560f3d59ad8ce8d5dc941909fe21ec1

                                SHA256

                                60ede5fc5d4e90f27afe2e8c8a14ebb0cf75df70ad29f8524f4b748a04203d39

                                SHA512

                                212a88efd8a79e9b20aa86c83cb3f05e093a9233e4eb7e2d1064c599c8bbb5085b8ef45433d4d6266f80604af3d1e0a29dbbfbe124c5e18710ddb76b1ad2de0f

                                Download Submit
                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53
                                Filesize

                                412B

                                MD5

                                be3062a0258272a87978754fb10e96ec

                                SHA1

                                45180cb0e261d41de3965e1f23bd7b3b7300cfef

                                SHA256

                                00bc206d2784325a085e886e0afdf10bfdea219392323e1b9908733207828a5b

                                SHA512

                                d7248a615febc090cbbd40afc269c564ed643fa2766968b4cd8cf812628b320a3a7d74f83da964f46cd887ca6604de5a615c00da54f66fd148662366908a09c5

                                Download Submit
                              • C:\Users\Admin\AppData\Local\IconCache.db
                                Filesize

                                14KB

                                MD5

                                74a9dfd185bc54b4c9bf692d387d7309

                                SHA1

                                3b25b04d4b631f6ee2083afb0f460ec8c343f8f2

                                SHA256

                                8501e61de3dcebf7f4f4f4bda3951041e2afd5f718c6e361ba72d6574fe2fa6b

                                SHA512

                                3623ff2c822293fe4e4a400ce868d33aa5195209d560d3676940633af39a1c78f63f8d94ee484ff457390d152db0b8576d1835c1774d45733cf7a162cf66cee9

                                Download Submit
                              • C:\Users\Admin\AppData\Local\Microsoft\PenWorkspace\DiscoverCacheData.dat
                                Filesize

                                1022B

                                MD5

                                9c51dc9f7a7b32062526d5810c50bce8

                                SHA1

                                6748c134c14553c01dc5fba3e74c6d81ab6c3a00

                                SHA256

                                099a645c946a46cfa575176b99011ed3b5e99fde2262d2c9469d27c7ec58b842

                                SHA512

                                c5636851a29edcc692a27f1d25795f44ac1288a555882706477f64c760a826048f7f4f770a1dc988b4e68c0478154a8a5dd9d4bd3eed2ea7e9018e4989ab3683

                                Download Submit
                              • C:\Users\Admin\AppData\Local\Temp\{BC8F62AE-DD7D-4F41-9B2A-202588B3D240}.png
                                Filesize

                                6KB

                                MD5

                                099ba37f81c044f6b2609537fdb7d872

                                SHA1

                                470ef859afbce52c017874d77c1695b7b0f9cb87

                                SHA256

                                8c98c856e4d43f705ff9a5c9a55f92e1885765654912b4c75385c3ea2fdef4a7

                                SHA512

                                837e1ad7fe4f5cbc0a87f3703ba211c18f32b20df93b23f681cbd0390d8077adba64cf6454a1bb28df1f7df4cb2cdc021d826b6ef8db890e40f21d618d5eb07a

                                Download Submit
                              • memory/692-33-0x0000000003730000-0x0000000003731000-memory.dmp
                                Filesize

                                4KB

                                Download
                              • memory/2052-36-0x0000000000400000-0x0000000000A15000-memory.dmp
                                Filesize

                                6.1MB

                                Download
                              • memory/2052-44-0x00000000028E0000-0x00000000028E1000-memory.dmp
                                Filesize

                                4KB

                                Download
                              • memory/2052-5-0x00000000028E0000-0x00000000028E1000-memory.dmp
                                Filesize

                                4KB

                                Download
                              • memory/2052-16-0x0000000000400000-0x0000000000A15000-memory.dmp
                                Filesize

                                6.1MB

                                Download
                              • memory/2052-68-0x0000000000400000-0x0000000000A15000-memory.dmp
                                Filesize

                                6.1MB

                                Download
                              • memory/2052-4-0x0000000000400000-0x0000000000A15000-memory.dmp
                                Filesize

                                6.1MB

                                Download
                              • memory/2052-3-0x0000000000400000-0x0000000000A15000-memory.dmp
                                Filesize

                                6.1MB

                                Download
                              • memory/2052-35-0x0000000000400000-0x0000000000A15000-memory.dmp
                                Filesize

                                6.1MB

                                Download
                              • memory/2052-0-0x0000000002760000-0x0000000002761000-memory.dmp
                                Filesize

                                4KB

                                Download
                              • memory/2052-1-0x0000000000400000-0x0000000000A15000-memory.dmp
                                Filesize

                                6.1MB

                                Download
                              • memory/2052-43-0x0000000000400000-0x0000000000A15000-memory.dmp
                                Filesize

                                6.1MB

                                Download
                              • memory/2052-67-0x0000000000400000-0x0000000000A15000-memory.dmp
                                Filesize

                                6.1MB

                                Download
                              • memory/2052-45-0x0000000000400000-0x0000000000A15000-memory.dmp
                                Filesize

                                6.1MB

                                Download
                              • memory/2052-52-0x0000000000400000-0x0000000000A15000-memory.dmp
                                Filesize

                                6.1MB

                                Download
                              • memory/2052-53-0x0000000000400000-0x0000000000A15000-memory.dmp
                                Filesize

                                6.1MB

                                Download
                              • memory/2052-54-0x0000000000400000-0x0000000000A15000-memory.dmp
                                Filesize

                                6.1MB

                                Download
                              • memory/2052-55-0x0000000000400000-0x0000000000A15000-memory.dmp
                                Filesize

                                6.1MB

                                Download
                              • memory/2052-60-0x0000000000400000-0x0000000000A15000-memory.dmp
                                Filesize

                                6.1MB

                                Download
                              • memory/2052-61-0x0000000000400000-0x0000000000A15000-memory.dmp
                                Filesize

                                6.1MB

                                Download
                              • memory/2052-62-0x0000000000400000-0x0000000000A15000-memory.dmp
                                Filesize

                                6.1MB

                                Download
                              • memory/2052-65-0x0000000000400000-0x0000000000A15000-memory.dmp
                                Filesize

                                6.1MB

                                Download
                              • memory/2052-66-0x0000000000400000-0x0000000000A15000-memory.dmp
                                Filesize

                                6.1MB

                                Download
                              • memory/3280-11-0x00000000045A0000-0x00000000045A1000-memory.dmp
                                Filesize

                                4KB

                                Download
                              • memory/4180-25-0x0000000004100000-0x0000000004101000-memory.dmp
                                Filesize

                                4KB

                                Download