Overview

overview

8

Static

static

3

04d199a0ff...18.exe

windows7-x64

7

04d199a0ff...18.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    123s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28-04-2024 08:53

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    04d199a0ff29b41701889dcf25eef176_JaffaCakes118.exe

  • Size

    1.1MB

  • MD5

    04d199a0ff29b41701889dcf25eef176

  • SHA1

    601ff0cf9195af7586d44a0cb8b034c74da56d67

  • SHA256

    39b8a3b17075dfa11526b41faa39fb02f8b436375824d1ebb2afa561d52a77db

  • SHA512

    72faefd036d192cfc9c04e71944da84aff8aabdfa2180b7c272eb6d60febb8f9b0f23ae2f3a04ce618ff0b843c18c84e8fbab056043ca6b660cc1c99d42f71e9

  • SSDEEP

    24576:hVhiebfv1ypW219UdGz8Ou43YJLNX5cViMwnBsLIw+rqsgGF:vhieDvwpW2rUdRfOIas

Score
8/10
bootkitpersistenceupx

Malware Config

Signatures

  • Modifies Installed Components in the registry 2 TTPs 5 IoCs
    persistence
  • Executes dropped EXE 1 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 31 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 49 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\04d199a0ff29b41701889dcf25eef176_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\04d199a0ff29b41701889dcf25eef176_JaffaCakes118.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:504
    • C:\ProgramData\defender.exe
      C:\ProgramData\defender.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Enumerates connected drives
      • Writes to the Master Boot Record (MBR)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:2328
  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
    • Suspicious use of FindShellTrayWindow
    PID:3820
  • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
    "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
    1⤵
    • Modifies data under HKEY_USERS
    • Suspicious use of SetWindowsHookEx
    PID:4108
  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3912
    • C:\Windows\explorer.exe
      explorer.exe /LOADSAVEDWINDOWS
      2⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1152
  • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
    "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
    1⤵
    • Modifies data under HKEY_USERS
    • Suspicious use of SetWindowsHookEx
    PID:4836
  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:3872
    • C:\Windows\explorer.exe
      explorer.exe /LOADSAVEDWINDOWS
      2⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:5060
  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:4144
    • C:\Windows\explorer.exe
      explorer.exe /LOADSAVEDWINDOWS
      2⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3088
  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:3860
    • C:\Windows\explorer.exe
      explorer.exe /LOADSAVEDWINDOWS
      2⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SendNotifyMessage
      PID:2816
  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:844
    • C:\Windows\explorer.exe
      explorer.exe /LOADSAVEDWINDOWS
      2⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:2200

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Defense Evasion

Modify Registry

2
T1112

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Credential Access

Discovery

Query Registry

2
T1012

Peripheral Device Discovery

2
T1120

System Information Discovery

3
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\defender.exe
    Filesize

    904KB

    MD5

    6e2f9d95c72a4cc2d06a4d21b4697b82

    SHA1

    a8167588575640a607732e9ac92cde2bc926dabc

    SHA256

    36b85cea5c5870fef442d9bdb1564235cc58bf50dd6bc162df68605ff3aae8f5

    SHA512

    d9fbeadd808daba0a4092aed345282c297c84fa466a571b58705e37d12c91ce315bc3223eec6f0c57d241d1a10a04e45beb37c3e2539600fd6ec8a667b1c4989

    Download Submit
  • C:\Users\Admin\AppData\Local\Microsoft\PenWorkspace\DiscoverCacheData.dat
    Filesize

    1018B

    MD5

    e45585997c0f6fa77a4dab1218316bf2

    SHA1

    f45989b8756512de7eb3ebdf9ce72b02056d116f

    SHA256

    9a09dfc8a94d8212db7218784bde56352ca4d3744abf147a1754b02d560c5bef

    SHA512

    6398e0f1c2ab872f00cd8d7e2a3c9efc55bd8f5e63da972e683c352d4449564814766652bede7da555abaf4c567e39d4c2dd20448ee9c2e41b9d3d43fa80c3b3

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\{806BCF0D-5912-4320-904A-1178E13483E2}.png
    Filesize

    6KB

    MD5

    099ba37f81c044f6b2609537fdb7d872

    SHA1

    470ef859afbce52c017874d77c1695b7b0f9cb87

    SHA256

    8c98c856e4d43f705ff9a5c9a55f92e1885765654912b4c75385c3ea2fdef4a7

    SHA512

    837e1ad7fe4f5cbc0a87f3703ba211c18f32b20df93b23f681cbd0390d8077adba64cf6454a1bb28df1f7df4cb2cdc021d826b6ef8db890e40f21d618d5eb07a

    Download Submit
  • C:\Users\Public\Desktop\Security Protection.lnk
    Filesize

    681B

    MD5

    062e8d6d2b861769203affff35fe2a22

    SHA1

    daeb98bd7a79632b9a81a66206f0b0acf069d3c8

    SHA256

    328738b1b8745c1d21a0e940be4aa05e6814620bc5e58b054d552e8a36b0d02d

    SHA512

    293de6c5155da9f4e11773f93df8575af6be04562412a5bf050834371a467797612b96713b4eddcf256a3d824fd2476c1e2420e40000700f13eb6b3e7633b339

    Download Submit
  • memory/504-1-0x0000000002580000-0x0000000002584000-memory.dmp
    Filesize

    16KB

    Download
  • memory/504-2-0x0000000000400000-0x000000000074D000-memory.dmp
    Filesize

    3.3MB

    Download
  • memory/504-7-0x0000000000400000-0x000000000074D000-memory.dmp
    Filesize

    3.3MB

    Download
  • memory/504-0-0x0000000000400000-0x000000000074D000-memory.dmp
    Filesize

    3.3MB

    Download
  • memory/1152-27-0x0000000004CF0000-0x0000000004CF1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2200-43-0x0000000002B80000-0x0000000002B81000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2328-45-0x0000000000400000-0x0000000000A2B000-memory.dmp
    Filesize

    6.2MB

    Download
  • memory/2328-14-0x0000000000400000-0x0000000000A2B000-memory.dmp
    Filesize

    6.2MB

    Download
  • memory/2328-19-0x0000000000400000-0x0000000000A2B000-memory.dmp
    Filesize

    6.2MB

    Download
  • memory/2328-18-0x0000000000400000-0x0000000000A2B000-memory.dmp
    Filesize

    6.2MB

    Download
  • memory/2328-36-0x0000000000400000-0x0000000000A2B000-memory.dmp
    Filesize

    6.2MB

    Download
  • memory/2328-16-0x0000000000400000-0x0000000000A2B000-memory.dmp
    Filesize

    6.2MB

    Download
  • memory/2328-15-0x0000000000BF0000-0x0000000000BF4000-memory.dmp
    Filesize

    16KB

    Download
  • memory/2328-53-0x0000000000400000-0x0000000000A2B000-memory.dmp
    Filesize

    6.2MB

    Download
  • memory/2328-52-0x0000000000400000-0x0000000000A2B000-memory.dmp
    Filesize

    6.2MB

    Download
  • memory/2328-54-0x0000000000C40000-0x0000000000C41000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2328-55-0x0000000000400000-0x0000000000A2B000-memory.dmp
    Filesize

    6.2MB

    Download
  • memory/2328-20-0x0000000000C40000-0x0000000000C41000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2328-62-0x0000000000400000-0x0000000000A2B000-memory.dmp
    Filesize

    6.2MB

    Download
  • memory/2328-63-0x0000000000400000-0x0000000000A2B000-memory.dmp
    Filesize

    6.2MB

    Download
  • memory/2328-64-0x0000000000400000-0x0000000000A2B000-memory.dmp
    Filesize

    6.2MB

    Download
  • memory/2328-67-0x0000000000400000-0x0000000000A2B000-memory.dmp
    Filesize

    6.2MB

    Download
  • memory/2328-70-0x0000000000400000-0x0000000000A2B000-memory.dmp
    Filesize

    6.2MB

    Download
  • memory/2328-71-0x0000000000400000-0x0000000000A2B000-memory.dmp
    Filesize

    6.2MB

    Download
  • memory/2328-72-0x0000000000400000-0x0000000000A2B000-memory.dmp
    Filesize

    6.2MB

    Download
  • memory/2328-75-0x0000000000400000-0x0000000000A2B000-memory.dmp
    Filesize

    6.2MB

    Download
  • memory/2328-76-0x0000000000400000-0x0000000000A2B000-memory.dmp
    Filesize

    6.2MB

    Download
  • memory/2328-77-0x0000000000400000-0x0000000000A2B000-memory.dmp
    Filesize

    6.2MB

    Download
  • memory/2328-78-0x0000000000400000-0x0000000000A2B000-memory.dmp
    Filesize

    6.2MB

    Download