88927527fc77e50ed3a16d7e08d924ca7345c3e856541e79d9a740501b5d039d

Resubmissions

28-05-2024 22:14

240528-152acsef2t 7

Analysis

max time kernel
148s
max time network
155s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28-05-2024 22:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7e95e698243191401d1a1ee9f28927a6_JaffaCakes118.exe
Size

731KB
MD5

7e95e698243191401d1a1ee9f28927a6
SHA1

704830e2b0e64be98123f4d801495e1b72c6db92
SHA256

88927527fc77e50ed3a16d7e08d924ca7345c3e856541e79d9a740501b5d039d
SHA512

04e2a4fabad9e0ccdb71a1a72da521d0ee0d96431d694e1d21209651b2a3d7b6728f482d3fe79e30445e442baa8f815635eff34d91e3657f4d058742ed17f7d2
SSDEEP

12288:LDe6ZljUSIm8hkDvKDAOLTJEPUR2113CAikHWI02YF8uRImq3ghPoo4/fk99BKJm:ZzoQ8hY+TJEm23ikHWI0kuR838oo4Ulr

Score

7^/10

bootkit persistence upx

Malware Config

Signatures

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2200-0-0x0000000000400000-0x0000000000551000-memory.dmp	upx
behavioral1/memory/2200-1-0x0000000000400000-0x0000000000551000-memory.dmp	upx
behavioral1/memory/2200-7-0x0000000000400000-0x0000000000551000-memory.dmp	upx
behavioral1/memory/2200-10-0x0000000000400000-0x0000000000551000-memory.dmp	upx
behavioral1/memory/2200-20-0x0000000000400000-0x0000000000551000-memory.dmp	upx

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	7e95e698243191401d1a1ee9f28927a6_JaffaCakes118.exe

Modifies registry class 11 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}	7e95e698243191401d1a1ee9f28927a6_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories	7e95e698243191401d1a1ee9f28927a6_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79B5BC47-CEA1-4772-B433-7D1B3139F278}\Implemented Categories\{607568DD-B059-434b-B7E7-38EC51998F8E}\did = "77BB08A9E376E9F3D95EEE56C24D9370"	7e95e698243191401d1a1ee9f28927a6_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5}\idex = "d120a9d2ff9089755c0b7159416388fb"	7e95e698243191401d1a1ee9f28927a6_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5}\idno = "1"	7e95e698243191401d1a1ee9f28927a6_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79B5BC47-CEA1-4772-B433-7D1B3139F278}\Implemented Categories\{607568DD-B059-434b-B7E7-38EC51998F8E}	7e95e698243191401d1a1ee9f28927a6_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79B5BC47-CEA1-4772-B433-7D1B3139F278}	7e95e698243191401d1a1ee9f28927a6_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79B5BC47-CEA1-4772-B433-7D1B3139F278}\Implemented Categories	7e95e698243191401d1a1ee9f28927a6_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5}	7e95e698243191401d1a1ee9f28927a6_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node	7e95e698243191401d1a1ee9f28927a6_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	7e95e698243191401d1a1ee9f28927a6_JaffaCakes118.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2200	7e95e698243191401d1a1ee9f28927a6_JaffaCakes118.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2200	7e95e698243191401d1a1ee9f28927a6_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\7e95e698243191401d1a1ee9f28927a6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\7e95e698243191401d1a1ee9f28927a6_JaffaCakes118.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2200-0-0x0000000000400000-0x0000000000551000-memory.dmp

Filesize
1.3MB

Download
memory/2200-1-0x0000000000400000-0x0000000000551000-memory.dmp

Filesize
1.3MB

Download
memory/2200-7-0x0000000000400000-0x0000000000551000-memory.dmp

Filesize
1.3MB

Download
memory/2200-10-0x0000000000400000-0x0000000000551000-memory.dmp

Filesize
1.3MB

Download
memory/2200-20-0x0000000000400000-0x0000000000551000-memory.dmp

Filesize
1.3MB

Download
memory/2200-24-0x00000000003D0000-0x00000000003D1000-memory.dmp

Filesize
4KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads