c5b9bfd5fe09e42a89c7bee85d9be8c55c2f8496c69408a71d654cfe82b1502b

Analysis

max time kernel
1s
max time network
3s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
23/06/2024, 23:29

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

043b45e896ea246bb24d80b626df58d4_JaffaCakes118.exe
Size

179KB
MD5

043b45e896ea246bb24d80b626df58d4
SHA1

f7394c694a8226aab8c179e513497acbd057b05f
SHA256

c5b9bfd5fe09e42a89c7bee85d9be8c55c2f8496c69408a71d654cfe82b1502b
SHA512

83d21405178dc8c3f121e8da66601ad4c03d65cd9760495f6c2babc3b9c8e077e07e24e9985e030c085dadc51bf264715762195f22e0897baa851ecd1dffd9ff
SSDEEP

3072:JROMj8w9CEiyk2yDiv52poNef26n2Sv0knjmE7w0RwL5tdEhi5O:J8MLwEVk2yvagf26n2ixVRhU

Score

6^/10

bootkit persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\physicaldrive0	043b45e896ea246bb24d80b626df58d4_JaffaCakes118.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4420	043b45e896ea246bb24d80b626df58d4_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4420	043b45e896ea246bb24d80b626df58d4_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\043b45e896ea246bb24d80b626df58d4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\043b45e896ea246bb24d80b626df58d4_JaffaCakes118.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
PID:4420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4420-0-0x000000000043E000-0x0000000000442000-memory.dmp

Filesize
16KB

Download
memory/4420-1-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/4420-2-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads