Analysis

  • max time kernel
    143s
  • max time network
    134s
  • platform
    windows7_x64
  • resource
    win7-20240611-en
  • resource tags

    arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
  • submitted
    20-06-2024 14:30

General

  • Target

    06d798549154c28be78ce9f4074585c9_JaffaCakes118.exe

  • Size

    518KB

  • MD5

    06d798549154c28be78ce9f4074585c9

  • SHA1

    fdf04f3277ce3c3eced17d679948e7df7a4f756a

  • SHA256

    ad9b48bb70a715e82d4a7c133101400c38c7efac78ae82738cbcaba81f6c58a9

  • SHA512

    3ff86ec631987b912ee7cf6d7d3f2116553d61da2e752e5501ebeb515fa318ef776a68a47be9ac65f793332d2151a165871aa67440dec72198134e40e0c45bdb

  • SSDEEP

    12288:+xFal5fCzEsRoCp95sRuk297Wv3Rr8d/Xagc67Zt9Usu3ZXcjuTq:+jaHgEpE9Iup76h8d/7c6JE3ZMjF

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Drops file in System32 directory 3 IoCs
  • Drops file in Windows directory 3 IoCs
  • Modifies data under HKEY_USERS 24 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\06d798549154c28be78ce9f4074585c9_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\06d798549154c28be78ce9f4074585c9_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2840
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\COMSER~1.EXE
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\COMSER~1.EXE
      2⤵
      • Executes dropped EXE
      • Writes to the Master Boot Record (MBR)
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1712
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c C:\Windows\GUOCYOKl.BAT
        3⤵
          PID:1468
    • C:\Windows\wowmap.exe
      C:\Windows\wowmap.exe
      1⤵
      • Executes dropped EXE
      • Writes to the Master Boot Record (MBR)
      • Drops file in System32 directory
      • Modifies data under HKEY_USERS
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:2476
      • C:\Program Files\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
        2⤵
          PID:812

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Windows\GUOCYOKl.BAT

        Filesize

        164B

        MD5

        f76abc9f135f91db5e13f4f0e6e9c4c9

        SHA1

        6a92d6d71946eb32f50f350b65313e495630d0ce

        SHA256

        87d2a6832c8431fac2a0cb3661ad3bb85c078754480b7b4c5087dfa6e476b448

        SHA512

        e2ec636ea8f48f9e7918260274cc528d530198f91b070cbf324bf1e84d11e56102388d071c5fbe7982cf1ef42b571476a06e2368dcdc8a50fcc3adf029b3e8a5

      • \Users\Admin\AppData\Local\Temp\IXP000.TMP\COMSER~1.EXE

        Filesize

        493KB

        MD5

        5956b1c78eaec57f148472e7066cedfe

        SHA1

        dbca650c8541ee49f1b5f3bd80047c75a0555ec3

        SHA256

        b38b59422075efcb463f44551b4e404a64530db264f2c2de7e451da5e32eaec7

        SHA512

        46b43493d8182f9c8411dc3c8209b1e03b90297dff41997313f84d7a4594ad099854cf0ba13743ef6225ebffaba3fca1c5d96ed1d3dc932a9d3143c9bc7eb69d

      • memory/1712-20-0x0000000001F90000-0x0000000001F91000-memory.dmp

        Filesize

        4KB

      • memory/1712-49-0x0000000002560000-0x0000000002561000-memory.dmp

        Filesize

        4KB

      • memory/1712-16-0x0000000001C90000-0x0000000001C91000-memory.dmp

        Filesize

        4KB

      • memory/1712-15-0x00000000001D0000-0x00000000001D1000-memory.dmp

        Filesize

        4KB

      • memory/1712-14-0x0000000000260000-0x0000000000261000-memory.dmp

        Filesize

        4KB

      • memory/1712-13-0x0000000001CB0000-0x0000000001CB1000-memory.dmp

        Filesize

        4KB

      • memory/1712-18-0x0000000001D50000-0x0000000001D53000-memory.dmp

        Filesize

        12KB

      • memory/1712-17-0x0000000001D10000-0x0000000001D11000-memory.dmp

        Filesize

        4KB

      • memory/1712-58-0x00000000025E0000-0x00000000025E1000-memory.dmp

        Filesize

        4KB

      • memory/1712-57-0x00000000025F0000-0x00000000025F1000-memory.dmp

        Filesize

        4KB

      • memory/1712-56-0x0000000002600000-0x0000000002601000-memory.dmp

        Filesize

        4KB

      • memory/1712-55-0x00000000025C0000-0x00000000025C1000-memory.dmp

        Filesize

        4KB

      • memory/1712-54-0x00000000025D0000-0x00000000025D1000-memory.dmp

        Filesize

        4KB

      • memory/1712-53-0x00000000025A0000-0x00000000025A1000-memory.dmp

        Filesize

        4KB

      • memory/1712-52-0x00000000025B0000-0x00000000025B1000-memory.dmp

        Filesize

        4KB

      • memory/1712-51-0x0000000002580000-0x0000000002581000-memory.dmp

        Filesize

        4KB

      • memory/1712-50-0x0000000002590000-0x0000000002591000-memory.dmp

        Filesize

        4KB

      • memory/1712-59-0x0000000002630000-0x0000000002631000-memory.dmp

        Filesize

        4KB

      • memory/1712-48-0x0000000002570000-0x0000000002571000-memory.dmp

        Filesize

        4KB

      • memory/1712-47-0x0000000002540000-0x0000000002541000-memory.dmp

        Filesize

        4KB

      • memory/1712-46-0x0000000002550000-0x0000000002551000-memory.dmp

        Filesize

        4KB

      • memory/1712-45-0x0000000002520000-0x0000000002521000-memory.dmp

        Filesize

        4KB

      • memory/1712-44-0x0000000002530000-0x0000000002531000-memory.dmp

        Filesize

        4KB

      • memory/1712-43-0x0000000002500000-0x0000000002501000-memory.dmp

        Filesize

        4KB

      • memory/1712-42-0x0000000002510000-0x0000000002511000-memory.dmp

        Filesize

        4KB

      • memory/1712-41-0x00000000023E0000-0x00000000023E1000-memory.dmp

        Filesize

        4KB

      • memory/1712-40-0x00000000023F0000-0x00000000023F1000-memory.dmp

        Filesize

        4KB

      • memory/1712-11-0x0000000000400000-0x00000000004F4000-memory.dmp

        Filesize

        976KB

      • memory/1712-38-0x00000000023D0000-0x00000000023D1000-memory.dmp

        Filesize

        4KB

      • memory/1712-37-0x00000000023A0000-0x00000000023A1000-memory.dmp

        Filesize

        4KB

      • memory/1712-36-0x00000000023B0000-0x00000000023B1000-memory.dmp

        Filesize

        4KB

      • memory/1712-62-0x0000000002640000-0x0000000002641000-memory.dmp

        Filesize

        4KB

      • memory/1712-34-0x0000000002390000-0x0000000002391000-memory.dmp

        Filesize

        4KB

      • memory/1712-33-0x0000000002360000-0x0000000002361000-memory.dmp

        Filesize

        4KB

      • memory/1712-32-0x0000000002370000-0x0000000002371000-memory.dmp

        Filesize

        4KB

      • memory/1712-31-0x0000000002340000-0x0000000002341000-memory.dmp

        Filesize

        4KB

      • memory/1712-30-0x0000000002350000-0x0000000002351000-memory.dmp

        Filesize

        4KB

      • memory/1712-29-0x0000000002010000-0x0000000002011000-memory.dmp

        Filesize

        4KB

      • memory/1712-28-0x0000000002330000-0x0000000002331000-memory.dmp

        Filesize

        4KB

      • memory/1712-27-0x0000000001FF0000-0x0000000001FF1000-memory.dmp

        Filesize

        4KB

      • memory/1712-26-0x0000000002000000-0x0000000002001000-memory.dmp

        Filesize

        4KB

      • memory/1712-25-0x0000000001FD0000-0x0000000001FD1000-memory.dmp

        Filesize

        4KB

      • memory/1712-24-0x0000000001FE0000-0x0000000001FE1000-memory.dmp

        Filesize

        4KB

      • memory/1712-23-0x0000000001FA0000-0x0000000001FA1000-memory.dmp

        Filesize

        4KB

      • memory/1712-22-0x0000000001D30000-0x0000000001D31000-memory.dmp

        Filesize

        4KB

      • memory/1712-21-0x0000000001D20000-0x0000000001D21000-memory.dmp

        Filesize

        4KB

      • memory/1712-39-0x00000000023C0000-0x00000000023C1000-memory.dmp

        Filesize

        4KB

      • memory/1712-12-0x0000000001D60000-0x0000000001DA3000-memory.dmp

        Filesize

        268KB

      • memory/1712-35-0x0000000002380000-0x0000000002381000-memory.dmp

        Filesize

        4KB

      • memory/1712-61-0x0000000002650000-0x0000000002651000-memory.dmp

        Filesize

        4KB

      • memory/1712-60-0x0000000002620000-0x0000000002621000-memory.dmp

        Filesize

        4KB

      • memory/1712-19-0x0000000001D40000-0x0000000001D41000-memory.dmp

        Filesize

        4KB

      • memory/1712-77-0x00000000031B0000-0x00000000031B1000-memory.dmp

        Filesize

        4KB

      • memory/1712-78-0x00000000031E0000-0x00000000031E1000-memory.dmp

        Filesize

        4KB

      • memory/1712-91-0x00000000032B0000-0x00000000032B1000-memory.dmp

        Filesize

        4KB

      • memory/1712-90-0x0000000003290000-0x0000000003291000-memory.dmp

        Filesize

        4KB

      • memory/1712-89-0x0000000003270000-0x0000000003271000-memory.dmp

        Filesize

        4KB

      • memory/1712-88-0x0000000003280000-0x0000000003281000-memory.dmp

        Filesize

        4KB

      • memory/1712-87-0x0000000003250000-0x0000000003251000-memory.dmp

        Filesize

        4KB

      • memory/1712-86-0x0000000003260000-0x0000000003261000-memory.dmp

        Filesize

        4KB

      • memory/1712-85-0x0000000003230000-0x0000000003231000-memory.dmp

        Filesize

        4KB

      • memory/1712-84-0x0000000003240000-0x0000000003241000-memory.dmp

        Filesize

        4KB

      • memory/1712-83-0x0000000003210000-0x0000000003211000-memory.dmp

        Filesize

        4KB

      • memory/1712-82-0x0000000003220000-0x0000000003221000-memory.dmp

        Filesize

        4KB

      • memory/1712-81-0x00000000031F0000-0x00000000031F1000-memory.dmp

        Filesize

        4KB

      • memory/1712-80-0x0000000003200000-0x0000000003201000-memory.dmp

        Filesize

        4KB

      • memory/1712-79-0x00000000031D0000-0x00000000031D1000-memory.dmp

        Filesize

        4KB

      • memory/1712-76-0x00000000031C0000-0x00000000031C1000-memory.dmp

        Filesize

        4KB

      • memory/1712-71-0x00000000027E0000-0x00000000027E1000-memory.dmp

        Filesize

        4KB

      • memory/1712-69-0x0000000002680000-0x0000000002681000-memory.dmp

        Filesize

        4KB

      • memory/1712-66-0x0000000002670000-0x0000000002671000-memory.dmp

        Filesize

        4KB

      • memory/1712-75-0x0000000003190000-0x0000000003191000-memory.dmp

        Filesize

        4KB

      • memory/1712-74-0x00000000031A0000-0x00000000031A1000-memory.dmp

        Filesize

        4KB

      • memory/1712-73-0x0000000003170000-0x0000000003171000-memory.dmp

        Filesize

        4KB

      • memory/1712-72-0x0000000003180000-0x0000000003181000-memory.dmp

        Filesize

        4KB

      • memory/1712-70-0x0000000003160000-0x0000000003161000-memory.dmp

        Filesize

        4KB

      • memory/1712-68-0x0000000002690000-0x0000000002691000-memory.dmp

        Filesize

        4KB

      • memory/1712-67-0x0000000002660000-0x0000000002661000-memory.dmp

        Filesize

        4KB

      • memory/1712-97-0x00000000032E0000-0x00000000032E1000-memory.dmp

        Filesize

        4KB

      • memory/1712-96-0x00000000032C0000-0x00000000032C1000-memory.dmp

        Filesize

        4KB

      • memory/1712-95-0x00000000032A0000-0x00000000032A1000-memory.dmp

        Filesize

        4KB

      • memory/1712-94-0x00000000032F0000-0x00000000032F1000-memory.dmp

        Filesize

        4KB

      • memory/1712-93-0x0000000003300000-0x0000000003301000-memory.dmp

        Filesize

        4KB

      • memory/1712-92-0x00000000032D0000-0x00000000032D1000-memory.dmp

        Filesize

        4KB

      • memory/1712-99-0x0000000003310000-0x0000000003311000-memory.dmp

        Filesize

        4KB

      • memory/1712-98-0x0000000003320000-0x0000000003321000-memory.dmp

        Filesize

        4KB

      • memory/1712-102-0x0000000000400000-0x00000000004F4000-memory.dmp

        Filesize

        976KB

      • memory/1712-103-0x0000000001D60000-0x0000000001DA3000-memory.dmp

        Filesize

        268KB

      • memory/1712-115-0x0000000001D60000-0x0000000001DA3000-memory.dmp

        Filesize

        268KB

      • memory/1712-114-0x0000000000400000-0x00000000004F4000-memory.dmp

        Filesize

        976KB

      • memory/2476-101-0x0000000000400000-0x00000000004F4000-memory.dmp

        Filesize

        976KB

      • memory/2476-104-0x0000000000290000-0x00000000002D3000-memory.dmp

        Filesize

        268KB

      • memory/2476-119-0x0000000000400000-0x00000000004F4000-memory.dmp

        Filesize

        976KB

      • memory/2476-121-0x0000000000290000-0x00000000002D3000-memory.dmp

        Filesize

        268KB

      • memory/2840-9-0x0000000000A10000-0x0000000000B04000-memory.dmp

        Filesize

        976KB

      • memory/2840-8-0x0000000000A10000-0x0000000000B04000-memory.dmp

        Filesize

        976KB