c357e8a1c726aba10cc1eee37c92013807f765659be8d2549946ee6ce1740274

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20-04-2024 19:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fd83fd822cfc2968e650a85fefa40262_JaffaCakes118.exe
Size

348KB
MD5

fd83fd822cfc2968e650a85fefa40262
SHA1

448f76adae4f9d6b5ce0faf63891534667c078d0
SHA256

c357e8a1c726aba10cc1eee37c92013807f765659be8d2549946ee6ce1740274
SHA512

c39468c3e35a5c5d09c96636828216e196119ed62c8161029ddbf856d22516bb720c240267f3e2f736acef8fefdfc20770769718202ef66fadad06f5c26c79a6
SSDEEP

6144:AThJya3kvgQTLzQUmSFhBwqEwvP6bQ7yMP+DE827WMylwvP6bQ7yMP+DE827F:AThJyaE0U1HBwg6b7MP+Dd2ag6b7MP+Y

Score

8^/10

bootkit persistence

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

fd83fd822cfc2968e650a85fefa40262_JaffaCakes118.exe

description ioc process

File opened for modification C:\Windows\system32\drivers\etc\hosts fd83fd822cfc2968e650a85fefa40262_JaffaCakes118.exe
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1542.003

Processes:

fd83fd822cfc2968e650a85fefa40262_JaffaCakes118.exe

description ioc process

File opened for modification \??\PhysicalDrive0 fd83fd822cfc2968e650a85fefa40262_JaffaCakes118.exe

description	ioc	process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	fd83fd822cfc2968e650a85fefa40262_JaffaCakes118.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	fd83fd822cfc2968e650a85fefa40262_JaffaCakes118.exe

Modifies registry class 3 IoCs

Processes:

fd83fd822cfc2968e650a85fefa40262_JaffaCakes118.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	fd83fd822cfc2968e650a85fefa40262_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	fd83fd822cfc2968e650a85fefa40262_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	fd83fd822cfc2968e650a85fefa40262_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

fd83fd822cfc2968e650a85fefa40262_JaffaCakes118.exe

pid process

2988 fd83fd822cfc2968e650a85fefa40262_JaffaCakes118.exe

pid	process
2988	fd83fd822cfc2968e650a85fefa40262_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\fd83fd822cfc2968e650a85fefa40262_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fd83fd822cfc2968e650a85fefa40262_JaffaCakes118.exe"
1⤵
- Drops file in Drivers directory
- Writes to the Master Boot Record (MBR)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2988

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2988-1-0x0000000000260000-0x0000000000290000-memory.dmp

Filesize
192KB

Download
memory/2988-0-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2988-6-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2988-9-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2988-8-0x0000000000260000-0x0000000000290000-memory.dmp

Filesize
192KB

Download
memory/2988-7-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/2988-4-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/2988-2-0x0000000000290000-0x0000000000294000-memory.dmp

Filesize
16KB

Download