Analysis
- max time kernel
140s - max time network
123s - platform
windows7_x64 - resource
win7-20240508-en - resource tags
- submitted
24/06/2024, 01:15
General
- Target 069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe
- Size 983KB
- Sample240624-bmdznssemb
- SHA256 d201ca35b14699011ec0c36e3bd4650f654002767d1849cbc6f066b198333228
Malware Config
Signatures
- Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- Drops file in System32 directory 2 IoCs
- Program crash 1 IoCs
- Modifies registry class 64 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118.exe"1⤵
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2104 -s 1962⤵
- Program crash
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2104-0-0x0000000000400000-0x000000000054E000-memory.dmp
memory/2104-61-0x00000000003E0000-0x00000000003E1000-memory.dmp
memory/2104-60-0x00000000003D0000-0x00000000003D1000-memory.dmp
memory/2104-59-0x0000000000240000-0x0000000000243000-memory.dmp
memory/2104-58-0x00000000003E0000-0x00000000003E1000-memory.dmp
memory/2104-57-0x00000000003E0000-0x00000000003E1000-memory.dmp
memory/2104-56-0x00000000003E0000-0x00000000003E1000-memory.dmp
memory/2104-55-0x00000000003E0000-0x00000000003E1000-memory.dmp
memory/2104-54-0x00000000003E0000-0x00000000003E1000-memory.dmp
memory/2104-53-0x00000000003E0000-0x00000000003E1000-memory.dmp
memory/2104-52-0x00000000003E0000-0x00000000003E1000-memory.dmp
memory/2104-51-0x00000000003E0000-0x00000000003E1000-memory.dmp
memory/2104-50-0x00000000003E0000-0x00000000003E1000-memory.dmp
memory/2104-49-0x00000000003E0000-0x00000000003E1000-memory.dmp
memory/2104-48-0x00000000003E0000-0x00000000003E1000-memory.dmp
memory/2104-47-0x00000000003E0000-0x00000000003E1000-memory.dmp
memory/2104-46-0x00000000003E0000-0x00000000003E1000-memory.dmp
memory/2104-45-0x00000000003E0000-0x00000000003E1000-memory.dmp
memory/2104-44-0x00000000003E0000-0x00000000003E1000-memory.dmp
memory/2104-43-0x00000000003E0000-0x00000000003E1000-memory.dmp
memory/2104-42-0x00000000003E0000-0x00000000003E1000-memory.dmp
memory/2104-41-0x00000000003E0000-0x00000000003E1000-memory.dmp
memory/2104-40-0x00000000003E0000-0x00000000003E1000-memory.dmp
memory/2104-39-0x00000000003E0000-0x00000000003E1000-memory.dmp
memory/2104-38-0x00000000003F0000-0x00000000003F1000-memory.dmp
memory/2104-37-0x00000000003F0000-0x00000000003F1000-memory.dmp
memory/2104-36-0x00000000003F0000-0x00000000003F1000-memory.dmp
memory/2104-35-0x00000000003F0000-0x00000000003F1000-memory.dmp
memory/2104-34-0x00000000003F0000-0x00000000003F1000-memory.dmp
memory/2104-33-0x00000000003F0000-0x00000000003F1000-memory.dmp
memory/2104-32-0x00000000003F0000-0x00000000003F1000-memory.dmp
memory/2104-31-0x00000000003F0000-0x00000000003F1000-memory.dmp
memory/2104-30-0x00000000003F0000-0x00000000003F1000-memory.dmp
memory/2104-29-0x00000000003F0000-0x00000000003F1000-memory.dmp
memory/2104-28-0x00000000003F0000-0x00000000003F1000-memory.dmp
memory/2104-27-0x00000000003F0000-0x00000000003F1000-memory.dmp
memory/2104-26-0x00000000003F0000-0x00000000003F1000-memory.dmp
memory/2104-25-0x00000000003F0000-0x00000000003F1000-memory.dmp
memory/2104-24-0x00000000003F0000-0x00000000003F1000-memory.dmp
memory/2104-23-0x00000000003E0000-0x00000000003E1000-memory.dmp
memory/2104-22-0x00000000003E0000-0x00000000003E1000-memory.dmp
memory/2104-21-0x00000000003E0000-0x00000000003E1000-memory.dmp
memory/2104-20-0x00000000003E0000-0x00000000003E1000-memory.dmp
memory/2104-19-0x00000000003E0000-0x00000000003E1000-memory.dmp
memory/2104-18-0x00000000003E0000-0x00000000003E1000-memory.dmp
memory/2104-17-0x00000000003E0000-0x00000000003E1000-memory.dmp
memory/2104-16-0x00000000003E0000-0x00000000003E1000-memory.dmp
memory/2104-15-0x00000000003E0000-0x00000000003E1000-memory.dmp
memory/2104-14-0x00000000003E0000-0x00000000003E1000-memory.dmp
memory/2104-13-0x00000000003E0000-0x00000000003E1000-memory.dmp
memory/2104-12-0x00000000003E0000-0x00000000003E1000-memory.dmp
memory/2104-11-0x00000000003E0000-0x00000000003E1000-memory.dmp
memory/2104-10-0x00000000003E0000-0x00000000003E1000-memory.dmp
memory/2104-9-0x00000000003E0000-0x00000000003E1000-memory.dmp
memory/2104-8-0x00000000003E0000-0x00000000003E1000-memory.dmp
memory/2104-7-0x00000000003E0000-0x00000000003E1000-memory.dmp
memory/2104-6-0x00000000003E0000-0x00000000003E1000-memory.dmp
memory/2104-5-0x00000000003E0000-0x00000000003E1000-memory.dmp
memory/2104-4-0x00000000003E0000-0x00000000003E1000-memory.dmp
memory/2104-3-0x00000000003E0000-0x00000000003E1000-memory.dmp
memory/2104-2-0x00000000003E0000-0x00000000003E1000-memory.dmp
memory/2104-1-0x00000000003E0000-0x00000000003E1000-memory.dmp
memory/2104-62-0x0000000000400000-0x000000000054E000-memory.dmp
memory/2104-63-0x00000000003E0000-0x00000000003E1000-memory.dmp
memory/2104-97-0x00000000003F0000-0x00000000003F1000-memory.dmp
memory/2104-96-0x00000000003F0000-0x00000000003F1000-memory.dmp
memory/2104-95-0x00000000003F0000-0x00000000003F1000-memory.dmp
memory/2104-94-0x00000000003F0000-0x00000000003F1000-memory.dmp
memory/2104-93-0x00000000003F0000-0x00000000003F1000-memory.dmp
memory/2104-92-0x00000000003F0000-0x00000000003F1000-memory.dmp
memory/2104-91-0x00000000003F0000-0x00000000003F1000-memory.dmp
memory/2104-90-0x00000000003F0000-0x00000000003F1000-memory.dmp
memory/2104-89-0x00000000003F0000-0x00000000003F1000-memory.dmp
memory/2104-88-0x00000000003F0000-0x00000000003F1000-memory.dmp
memory/2104-87-0x00000000003F0000-0x00000000003F1000-memory.dmp
memory/2104-86-0x00000000003E0000-0x00000000003E1000-memory.dmp
memory/2104-85-0x00000000003E0000-0x00000000003E1000-memory.dmp
memory/2104-84-0x00000000003E0000-0x00000000003E1000-memory.dmp
memory/2104-83-0x00000000003E0000-0x00000000003E1000-memory.dmp
memory/2104-82-0x00000000003E0000-0x00000000003E1000-memory.dmp
memory/2104-81-0x00000000003E0000-0x00000000003E1000-memory.dmp
memory/2104-80-0x00000000003E0000-0x00000000003E1000-memory.dmp
memory/2104-79-0x00000000003E0000-0x00000000003E1000-memory.dmp
memory/2104-78-0x00000000003E0000-0x00000000003E1000-memory.dmp
memory/2104-77-0x00000000003E0000-0x00000000003E1000-memory.dmp
memory/2104-76-0x00000000003E0000-0x00000000003E1000-memory.dmp
memory/2104-75-0x00000000003E0000-0x00000000003E1000-memory.dmp
memory/2104-74-0x00000000003E0000-0x00000000003E1000-memory.dmp
memory/2104-73-0x00000000003E0000-0x00000000003E1000-memory.dmp
memory/2104-72-0x00000000003E0000-0x00000000003E1000-memory.dmp
memory/2104-71-0x00000000003E0000-0x00000000003E1000-memory.dmp
memory/2104-70-0x00000000003E0000-0x00000000003E1000-memory.dmp
memory/2104-69-0x00000000003E0000-0x00000000003E1000-memory.dmp
memory/2104-68-0x00000000003E0000-0x00000000003E1000-memory.dmp
memory/2104-67-0x00000000003E0000-0x00000000003E1000-memory.dmp
memory/2104-66-0x00000000003E0000-0x00000000003E1000-memory.dmp
memory/2104-65-0x00000000003E0000-0x00000000003E1000-memory.dmp