33c5f7514c5f7527ff44411b05068adb8128ee072c02ca88a52c7e8d9d637122

Analysis

max time kernel
114s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
20-04-2024 10:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fc8b882c5acd2e010ab3d872b384de2e_JaffaCakes118.exe
Size

24KB
MD5

fc8b882c5acd2e010ab3d872b384de2e
SHA1

1b0d18e6fdf733f71b304395282c918a64ee535a
SHA256

33c5f7514c5f7527ff44411b05068adb8128ee072c02ca88a52c7e8d9d637122
SHA512

fe307dc44e17b524f8832bb583c52b744ab05e09f37ede3ab87163a319cd42d7dc962317a2e76d154356e4cd01e247c9abca3af6230ab6c28ae9d63f52d8783a
SSDEEP

192:yKn6MFqBGAhlrmT9roeTdUZt8f0utuXpaUmgWHBHyz8/bdW11oynD3zVviQlv:aMF6GAXm5roeTU40mkpalTBc1B3ZxF

Score

6^/10

bootkit persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1542.003

Processes:

fc8b882c5acd2e010ab3d872b384de2e_JaffaCakes118.exe

description ioc process

File opened for modification \??\PhysicalDrive0 fc8b882c5acd2e010ab3d872b384de2e_JaffaCakes118.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	fc8b882c5acd2e010ab3d872b384de2e_JaffaCakes118.exe

Modifies registry class 1 IoCs

Processes:

fc8b882c5acd2e010ab3d872b384de2e_JaffaCakes118.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AF604EFE-8897-11D1-B944-00A0C90312E1}\InProcServer32\	fc8b882c5acd2e010ab3d872b384de2e_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

fc8b882c5acd2e010ab3d872b384de2e_JaffaCakes118.exe

pid process

2148 fc8b882c5acd2e010ab3d872b384de2e_JaffaCakes118.exe

pid	process
2148	fc8b882c5acd2e010ab3d872b384de2e_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\fc8b882c5acd2e010ab3d872b384de2e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fc8b882c5acd2e010ab3d872b384de2e_JaffaCakes118.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2148

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=2268 --field-trial-handle=2244,i,11878111470816612087,2265290141962607370,262144 --variations-seed-version /prefetch:8
1⤵
PID:3188

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads