aaedaa050d4c36bbde17f64881abf8e1d262c8d7ec4ac1a242cfef4c0d6ffcbc

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 01:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

65782a89407957a1b75f289b2686eeca_JaffaCakes118.exe
Size

7.0MB
MD5

65782a89407957a1b75f289b2686eeca
SHA1

450cff946ada1c2faecff2022e2bf8d252ce256e
SHA256

aaedaa050d4c36bbde17f64881abf8e1d262c8d7ec4ac1a242cfef4c0d6ffcbc
SHA512

c9ccea0d441bbbf643bee0a6dc61fe4946e1b0989d43c3461ec0d001fcf38030dd115ffe25a4b030bd7b73d2e011264c2f058a1bceecb3dcaf72c0dadbdf6cf6
SSDEEP

196608:3tyoNtGUevnh36ujLM28KUhvYBPEVY0LSX6QXb:3tZVeTLJQYRP6QL

Score

7^/10

bootkit persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

65782a89407957a1b75f289b2686eeca_JaffaCakes118.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	65782a89407957a1b75f289b2686eeca_JaffaCakes118.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1542.003

Processes:

65782a89407957a1b75f289b2686eeca_JaffaCakes118.exe

description ioc process

File opened for modification \??\PhysicalDrive0 65782a89407957a1b75f289b2686eeca_JaffaCakes118.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Kills process with taskkill 4 IoCs
evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid process

836 taskkill.exe
4648 taskkill.exe
3644 taskkill.exe
1236 taskkill.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

65782a89407957a1b75f289b2686eeca_JaffaCakes118.exe

pid process

1872 65782a89407957a1b75f289b2686eeca_JaffaCakes118.exe
1872 65782a89407957a1b75f289b2686eeca_JaffaCakes118.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	65782a89407957a1b75f289b2686eeca_JaffaCakes118.exe

pid	process
836	taskkill.exe
4648	taskkill.exe
3644	taskkill.exe
1236	taskkill.exe

pid	process
1872	65782a89407957a1b75f289b2686eeca_JaffaCakes118.exe
1872	65782a89407957a1b75f289b2686eeca_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exe

description	pid	process
Token: SeDebugPrivilege	836	taskkill.exe
Token: SeDebugPrivilege	1236	taskkill.exe
Token: SeDebugPrivilege	3644	taskkill.exe
Token: SeDebugPrivilege	4648	taskkill.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

65782a89407957a1b75f289b2686eeca_JaffaCakes118.exe

description	pid	process	target process
PID 1872 wrote to memory of 3644	1872	65782a89407957a1b75f289b2686eeca_JaffaCakes118.exe	taskkill.exe
PID 1872 wrote to memory of 3644	1872	65782a89407957a1b75f289b2686eeca_JaffaCakes118.exe	taskkill.exe
PID 1872 wrote to memory of 3644	1872	65782a89407957a1b75f289b2686eeca_JaffaCakes118.exe	taskkill.exe
PID 1872 wrote to memory of 1236	1872	65782a89407957a1b75f289b2686eeca_JaffaCakes118.exe	taskkill.exe
PID 1872 wrote to memory of 1236	1872	65782a89407957a1b75f289b2686eeca_JaffaCakes118.exe	taskkill.exe
PID 1872 wrote to memory of 1236	1872	65782a89407957a1b75f289b2686eeca_JaffaCakes118.exe	taskkill.exe
PID 1872 wrote to memory of 836	1872	65782a89407957a1b75f289b2686eeca_JaffaCakes118.exe	taskkill.exe
PID 1872 wrote to memory of 836	1872	65782a89407957a1b75f289b2686eeca_JaffaCakes118.exe	taskkill.exe
PID 1872 wrote to memory of 836	1872	65782a89407957a1b75f289b2686eeca_JaffaCakes118.exe	taskkill.exe
PID 1872 wrote to memory of 4648	1872	65782a89407957a1b75f289b2686eeca_JaffaCakes118.exe	taskkill.exe
PID 1872 wrote to memory of 4648	1872	65782a89407957a1b75f289b2686eeca_JaffaCakes118.exe	taskkill.exe
PID 1872 wrote to memory of 4648	1872	65782a89407957a1b75f289b2686eeca_JaffaCakes118.exe	taskkill.exe

C:\Users\Admin\AppData\Local\Temp\65782a89407957a1b75f289b2686eeca_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\65782a89407957a1b75f289b2686eeca_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1872

C:\Windows\SysWOW64\taskkill.exe
"C:\Windows\System32\taskkill.exe" /f /im KuaiZip.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3644

C:\Windows\SysWOW64\taskkill.exe
"C:\Windows\System32\taskkill.exe" /f /im Update.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1236

C:\Windows\SysWOW64\taskkill.exe
"C:\Windows\System32\taskkill.exe" /f /im KZReport.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:836

C:\Windows\SysWOW64\taskkill.exe
"C:\Windows\System32\taskkill.exe" /f /im UpdateChecker.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4648

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads