e7975e4dce0f8070e0e99492d4bdd8e89b406ae48a36728daa1592b394cdfcbf

Analysis

max time kernel
3s
max time network
3s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27/06/2024, 19:56

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

17531f25cfacf2d072048f555e19b111_JaffaCakes118.exe
Size

31KB
MD5

17531f25cfacf2d072048f555e19b111
SHA1

de32e6bf5efcadd783a242d751c610266d1c366a
SHA256

e7975e4dce0f8070e0e99492d4bdd8e89b406ae48a36728daa1592b394cdfcbf
SHA512

84fd41ec6c1eda50e0cc7e2496b5652afc121a757bada8507564c5b821ede72456071841bc8e8f763848be9d459df00a333f452f92a8038286924be2e686895d
SSDEEP

768:iglI5snqq2fIk8Z2I90NQ66bfQgkKXwR:di5/7I90q6sEowR

Score

7^/10

bootkit persistence upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2304	x2z8.exe

Executes dropped EXE 1 IoCs

pid	Process
2304	x2z8.exe

Loads dropped DLL 2 IoCs

pid	Process
2928	17531f25cfacf2d072048f555e19b111_JaffaCakes118.exe
2928	17531f25cfacf2d072048f555e19b111_JaffaCakes118.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2928-0-0x000000002AA00000-0x000000002AA20000-memory.dmp	upx
behavioral1/files/0x0033000000014817-5.dat	upx
behavioral1/memory/2304-14-0x000000002AA00000-0x000000002AA20000-memory.dmp	upx

Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PHYSICALDRIVE0	17531f25cfacf2d072048f555e19b111_JaffaCakes118.exe
File opened for modification	\??\PHYSICALDRIVE0	x2z8.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2304	x2z8.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2928 wrote to memory of 2304	2928	17531f25cfacf2d072048f555e19b111_JaffaCakes118.exe	28
PID 2928 wrote to memory of 2304	2928	17531f25cfacf2d072048f555e19b111_JaffaCakes118.exe	28
PID 2928 wrote to memory of 2304	2928	17531f25cfacf2d072048f555e19b111_JaffaCakes118.exe	28
PID 2928 wrote to memory of 2304	2928	17531f25cfacf2d072048f555e19b111_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\17531f25cfacf2d072048f555e19b111_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\17531f25cfacf2d072048f555e19b111_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious use of WriteProcessMemory
PID:2928
- C:\Users\Admin\AppData\Local\Temp\x2z8.exe
  C:\Users\Admin\AppData\Local\Temp\\x2z8.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Writes to the Master Boot Record (MBR)
  - Suspicious use of AdjustPrivilegeToken
  PID:2304

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
1⤵
PID:3036

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x1
1⤵
PID:2452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\fpath.txt

Filesize
84B

MD5
07de81e7531c6297eb5ede13a741bc6d

SHA1
8499cb17ba7e270f977eb360606eb8eedfe062ae

SHA256
87d336ee045f5e1c4444babd06b46b01ec9f163658b5e6c4236d7f2effdcfe20

SHA512
3cb9f87d46a590225beba3101622001647ed2864b25476ac0263fc48c5c990fe2381155a84cef94404649721206962f4cfc23d2d18d984775222a188ec2519c9

Download Submit
\Users\Admin\AppData\Local\Temp\x2z8.exe

Filesize
31KB

MD5
17531f25cfacf2d072048f555e19b111

SHA1
de32e6bf5efcadd783a242d751c610266d1c366a

SHA256
e7975e4dce0f8070e0e99492d4bdd8e89b406ae48a36728daa1592b394cdfcbf

SHA512
84fd41ec6c1eda50e0cc7e2496b5652afc121a757bada8507564c5b821ede72456071841bc8e8f763848be9d459df00a333f452f92a8038286924be2e686895d

Download Submit
memory/2304-14-0x000000002AA00000-0x000000002AA20000-memory.dmp

Filesize
128KB

Download
memory/2304-16-0x000000002AA00000-0x000000002AA20000-memory.dmp

Filesize
128KB

Download
memory/2452-19-0x0000000002AB0000-0x0000000002AB1000-memory.dmp

Filesize
4KB

Download
memory/2928-0-0x000000002AA00000-0x000000002AA20000-memory.dmp

Filesize
128KB

Download
memory/2928-1-0x0000000000220000-0x0000000000223000-memory.dmp

Filesize
12KB

Download
memory/2928-4-0x000000002AA00000-0x000000002AA20000-memory.dmp

Filesize
128KB

Download
memory/2928-13-0x0000000000490000-0x00000000004B0000-memory.dmp

Filesize
128KB

Download
memory/3036-18-0x0000000002F10000-0x0000000002F11000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads