33c5f7514c5f7527ff44411b05068adb8128ee072c02ca88a52c7e8d9d637122

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20-04-2024 10:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fc8b882c5acd2e010ab3d872b384de2e_JaffaCakes118.exe
Size

24KB
MD5

fc8b882c5acd2e010ab3d872b384de2e
SHA1

1b0d18e6fdf733f71b304395282c918a64ee535a
SHA256

33c5f7514c5f7527ff44411b05068adb8128ee072c02ca88a52c7e8d9d637122
SHA512

fe307dc44e17b524f8832bb583c52b744ab05e09f37ede3ab87163a319cd42d7dc962317a2e76d154356e4cd01e247c9abca3af6230ab6c28ae9d63f52d8783a
SSDEEP

192:yKn6MFqBGAhlrmT9roeTdUZt8f0utuXpaUmgWHBHyz8/bdW11oynD3zVviQlv:aMF6GAXm5roeTU40mkpalTBc1B3ZxF

Score

6^/10

bootkit persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1542.003

Processes:

fc8b882c5acd2e010ab3d872b384de2e_JaffaCakes118.exe

description ioc process

File opened for modification \??\PhysicalDrive0 fc8b882c5acd2e010ab3d872b384de2e_JaffaCakes118.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	fc8b882c5acd2e010ab3d872b384de2e_JaffaCakes118.exe

Modifies registry class 1 IoCs

Processes:

fc8b882c5acd2e010ab3d872b384de2e_JaffaCakes118.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AF604EFE-8897-11D1-B944-00A0C90312E1}\InProcServer32\	fc8b882c5acd2e010ab3d872b384de2e_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

fc8b882c5acd2e010ab3d872b384de2e_JaffaCakes118.exe

pid process

868 fc8b882c5acd2e010ab3d872b384de2e_JaffaCakes118.exe

pid	process
868	fc8b882c5acd2e010ab3d872b384de2e_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\fc8b882c5acd2e010ab3d872b384de2e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fc8b882c5acd2e010ab3d872b384de2e_JaffaCakes118.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:868

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads