60d577305e44ad18f69668a7cc94d1f1e443679f617a0e2a64c2f815dd36a4f5

Analysis

max time kernel
141s
max time network
118s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
04-07-2024 00:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

24041253e112a67f1fe46cb8c3383d00_JaffaCakes118.exe
Size

313KB
MD5

24041253e112a67f1fe46cb8c3383d00
SHA1

4789403e21263ae5177f894e27b90369b46b4b2b
SHA256

60d577305e44ad18f69668a7cc94d1f1e443679f617a0e2a64c2f815dd36a4f5
SHA512

15ee315a51ddfe70fd8e341ba8059192f6d0ea4fe0ddfbe0f22a6f88b10b89d31e4bbe96197a8c93169028d26d16df273882f42ef94a0d653569c21505a71c76
SSDEEP

6144:7VDIykF3mQt0fZv9YC5fn+aCyIK3ccnMxj6YClOam8y:7hedmUWY2W1K3DnsZCcH

Score

6^/10

bootkit persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	24041253e112a67f1fe46cb8c3383d00_JaffaCakes118.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
3044	24041253e112a67f1fe46cb8c3383d00_JaffaCakes118.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	24041253e112a67f1fe46cb8c3383d00_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	24041253e112a67f1fe46cb8c3383d00_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	24041253e112a67f1fe46cb8c3383d00_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3044	24041253e112a67f1fe46cb8c3383d00_JaffaCakes118.exe
3044	24041253e112a67f1fe46cb8c3383d00_JaffaCakes118.exe
3044	24041253e112a67f1fe46cb8c3383d00_JaffaCakes118.exe

Suspicious behavior: MapViewOfSection 22 IoCs

pid	Process
3044	24041253e112a67f1fe46cb8c3383d00_JaffaCakes118.exe
3044	24041253e112a67f1fe46cb8c3383d00_JaffaCakes118.exe
3044	24041253e112a67f1fe46cb8c3383d00_JaffaCakes118.exe
3044	24041253e112a67f1fe46cb8c3383d00_JaffaCakes118.exe
3044	24041253e112a67f1fe46cb8c3383d00_JaffaCakes118.exe
3044	24041253e112a67f1fe46cb8c3383d00_JaffaCakes118.exe
3044	24041253e112a67f1fe46cb8c3383d00_JaffaCakes118.exe
3044	24041253e112a67f1fe46cb8c3383d00_JaffaCakes118.exe
3044	24041253e112a67f1fe46cb8c3383d00_JaffaCakes118.exe
3044	24041253e112a67f1fe46cb8c3383d00_JaffaCakes118.exe
3044	24041253e112a67f1fe46cb8c3383d00_JaffaCakes118.exe
3044	24041253e112a67f1fe46cb8c3383d00_JaffaCakes118.exe
3044	24041253e112a67f1fe46cb8c3383d00_JaffaCakes118.exe
3044	24041253e112a67f1fe46cb8c3383d00_JaffaCakes118.exe
3044	24041253e112a67f1fe46cb8c3383d00_JaffaCakes118.exe
3044	24041253e112a67f1fe46cb8c3383d00_JaffaCakes118.exe
3044	24041253e112a67f1fe46cb8c3383d00_JaffaCakes118.exe
3044	24041253e112a67f1fe46cb8c3383d00_JaffaCakes118.exe
3044	24041253e112a67f1fe46cb8c3383d00_JaffaCakes118.exe
3044	24041253e112a67f1fe46cb8c3383d00_JaffaCakes118.exe
3044	24041253e112a67f1fe46cb8c3383d00_JaffaCakes118.exe
3044	24041253e112a67f1fe46cb8c3383d00_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3044	24041253e112a67f1fe46cb8c3383d00_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3044 wrote to memory of 380	3044	24041253e112a67f1fe46cb8c3383d00_JaffaCakes118.exe	3
PID 3044 wrote to memory of 380	3044	24041253e112a67f1fe46cb8c3383d00_JaffaCakes118.exe	3
PID 3044 wrote to memory of 380	3044	24041253e112a67f1fe46cb8c3383d00_JaffaCakes118.exe	3
PID 3044 wrote to memory of 380	3044	24041253e112a67f1fe46cb8c3383d00_JaffaCakes118.exe	3
PID 3044 wrote to memory of 380	3044	24041253e112a67f1fe46cb8c3383d00_JaffaCakes118.exe	3
PID 3044 wrote to memory of 380	3044	24041253e112a67f1fe46cb8c3383d00_JaffaCakes118.exe	3
PID 3044 wrote to memory of 380	3044	24041253e112a67f1fe46cb8c3383d00_JaffaCakes118.exe	3
PID 3044 wrote to memory of 392	3044	24041253e112a67f1fe46cb8c3383d00_JaffaCakes118.exe	4
PID 3044 wrote to memory of 392	3044	24041253e112a67f1fe46cb8c3383d00_JaffaCakes118.exe	4
PID 3044 wrote to memory of 392	3044	24041253e112a67f1fe46cb8c3383d00_JaffaCakes118.exe	4
PID 3044 wrote to memory of 392	3044	24041253e112a67f1fe46cb8c3383d00_JaffaCakes118.exe	4
PID 3044 wrote to memory of 392	3044	24041253e112a67f1fe46cb8c3383d00_JaffaCakes118.exe	4
PID 3044 wrote to memory of 392	3044	24041253e112a67f1fe46cb8c3383d00_JaffaCakes118.exe	4
PID 3044 wrote to memory of 392	3044	24041253e112a67f1fe46cb8c3383d00_JaffaCakes118.exe	4
PID 3044 wrote to memory of 428	3044	24041253e112a67f1fe46cb8c3383d00_JaffaCakes118.exe	5
PID 3044 wrote to memory of 428	3044	24041253e112a67f1fe46cb8c3383d00_JaffaCakes118.exe	5
PID 3044 wrote to memory of 428	3044	24041253e112a67f1fe46cb8c3383d00_JaffaCakes118.exe	5
PID 3044 wrote to memory of 428	3044	24041253e112a67f1fe46cb8c3383d00_JaffaCakes118.exe	5
PID 3044 wrote to memory of 428	3044	24041253e112a67f1fe46cb8c3383d00_JaffaCakes118.exe	5
PID 3044 wrote to memory of 428	3044	24041253e112a67f1fe46cb8c3383d00_JaffaCakes118.exe	5
PID 3044 wrote to memory of 428	3044	24041253e112a67f1fe46cb8c3383d00_JaffaCakes118.exe	5
PID 3044 wrote to memory of 472	3044	24041253e112a67f1fe46cb8c3383d00_JaffaCakes118.exe	6
PID 3044 wrote to memory of 472	3044	24041253e112a67f1fe46cb8c3383d00_JaffaCakes118.exe	6
PID 3044 wrote to memory of 472	3044	24041253e112a67f1fe46cb8c3383d00_JaffaCakes118.exe	6
PID 3044 wrote to memory of 472	3044	24041253e112a67f1fe46cb8c3383d00_JaffaCakes118.exe	6
PID 3044 wrote to memory of 472	3044	24041253e112a67f1fe46cb8c3383d00_JaffaCakes118.exe	6
PID 3044 wrote to memory of 472	3044	24041253e112a67f1fe46cb8c3383d00_JaffaCakes118.exe	6
PID 3044 wrote to memory of 472	3044	24041253e112a67f1fe46cb8c3383d00_JaffaCakes118.exe	6
PID 3044 wrote to memory of 488	3044	24041253e112a67f1fe46cb8c3383d00_JaffaCakes118.exe	7
PID 3044 wrote to memory of 488	3044	24041253e112a67f1fe46cb8c3383d00_JaffaCakes118.exe	7
PID 3044 wrote to memory of 488	3044	24041253e112a67f1fe46cb8c3383d00_JaffaCakes118.exe	7
PID 3044 wrote to memory of 488	3044	24041253e112a67f1fe46cb8c3383d00_JaffaCakes118.exe	7
PID 3044 wrote to memory of 488	3044	24041253e112a67f1fe46cb8c3383d00_JaffaCakes118.exe	7
PID 3044 wrote to memory of 488	3044	24041253e112a67f1fe46cb8c3383d00_JaffaCakes118.exe	7
PID 3044 wrote to memory of 488	3044	24041253e112a67f1fe46cb8c3383d00_JaffaCakes118.exe	7
PID 3044 wrote to memory of 496	3044	24041253e112a67f1fe46cb8c3383d00_JaffaCakes118.exe	8
PID 3044 wrote to memory of 496	3044	24041253e112a67f1fe46cb8c3383d00_JaffaCakes118.exe	8
PID 3044 wrote to memory of 496	3044	24041253e112a67f1fe46cb8c3383d00_JaffaCakes118.exe	8
PID 3044 wrote to memory of 496	3044	24041253e112a67f1fe46cb8c3383d00_JaffaCakes118.exe	8
PID 3044 wrote to memory of 496	3044	24041253e112a67f1fe46cb8c3383d00_JaffaCakes118.exe	8
PID 3044 wrote to memory of 496	3044	24041253e112a67f1fe46cb8c3383d00_JaffaCakes118.exe	8
PID 3044 wrote to memory of 496	3044	24041253e112a67f1fe46cb8c3383d00_JaffaCakes118.exe	8
PID 3044 wrote to memory of 596	3044	24041253e112a67f1fe46cb8c3383d00_JaffaCakes118.exe	9
PID 3044 wrote to memory of 596	3044	24041253e112a67f1fe46cb8c3383d00_JaffaCakes118.exe	9
PID 3044 wrote to memory of 596	3044	24041253e112a67f1fe46cb8c3383d00_JaffaCakes118.exe	9
PID 3044 wrote to memory of 596	3044	24041253e112a67f1fe46cb8c3383d00_JaffaCakes118.exe	9
PID 3044 wrote to memory of 596	3044	24041253e112a67f1fe46cb8c3383d00_JaffaCakes118.exe	9
PID 3044 wrote to memory of 596	3044	24041253e112a67f1fe46cb8c3383d00_JaffaCakes118.exe	9
PID 3044 wrote to memory of 596	3044	24041253e112a67f1fe46cb8c3383d00_JaffaCakes118.exe	9
PID 3044 wrote to memory of 672	3044	24041253e112a67f1fe46cb8c3383d00_JaffaCakes118.exe	10
PID 3044 wrote to memory of 672	3044	24041253e112a67f1fe46cb8c3383d00_JaffaCakes118.exe	10
PID 3044 wrote to memory of 672	3044	24041253e112a67f1fe46cb8c3383d00_JaffaCakes118.exe	10
PID 3044 wrote to memory of 672	3044	24041253e112a67f1fe46cb8c3383d00_JaffaCakes118.exe	10
PID 3044 wrote to memory of 672	3044	24041253e112a67f1fe46cb8c3383d00_JaffaCakes118.exe	10
PID 3044 wrote to memory of 672	3044	24041253e112a67f1fe46cb8c3383d00_JaffaCakes118.exe	10
PID 3044 wrote to memory of 672	3044	24041253e112a67f1fe46cb8c3383d00_JaffaCakes118.exe	10
PID 3044 wrote to memory of 748	3044	24041253e112a67f1fe46cb8c3383d00_JaffaCakes118.exe	11
PID 3044 wrote to memory of 748	3044	24041253e112a67f1fe46cb8c3383d00_JaffaCakes118.exe	11
PID 3044 wrote to memory of 748	3044	24041253e112a67f1fe46cb8c3383d00_JaffaCakes118.exe	11
PID 3044 wrote to memory of 748	3044	24041253e112a67f1fe46cb8c3383d00_JaffaCakes118.exe	11
PID 3044 wrote to memory of 748	3044	24041253e112a67f1fe46cb8c3383d00_JaffaCakes118.exe	11
PID 3044 wrote to memory of 748	3044	24041253e112a67f1fe46cb8c3383d00_JaffaCakes118.exe	11
PID 3044 wrote to memory of 748	3044	24041253e112a67f1fe46cb8c3383d00_JaffaCakes118.exe	11
PID 3044 wrote to memory of 812	3044	24041253e112a67f1fe46cb8c3383d00_JaffaCakes118.exe	12

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:380
- C:\Windows\system32\services.exe
  C:\Windows\system32\services.exe
  2⤵
  PID:472
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch
    3⤵
    PID:596
  - - C:\Windows\system32\DllHost.exe
      C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
      4⤵
      PID:1500
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k RPCSS
    3⤵
    PID:672
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    3⤵
    PID:748
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    3⤵
    PID:812
  - - C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      4⤵
      PID:1152
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs
    3⤵
    PID:848
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalService
    3⤵
    PID:964
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k NetworkService
    3⤵
    PID:112
- - C:\Windows\System32\spoolsv.exe
    C:\Windows\System32\spoolsv.exe
    3⤵
    PID:1020
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
    3⤵
    PID:1060
- - C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    3⤵
    PID:1104
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
    3⤵
    PID:2352
- - C:\Windows\system32\sppsvc.exe
    C:\Windows\system32\sppsvc.exe
    3⤵
    PID:1988
- C:\Windows\system32\lsass.exe
  C:\Windows\system32\lsass.exe
  2⤵
  PID:488
- C:\Windows\system32\lsm.exe
  C:\Windows\system32\lsm.exe
  2⤵
  PID:496

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:392

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:428

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1188
- C:\Users\Admin\AppData\Local\Temp\24041253e112a67f1fe46cb8c3383d00_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\24041253e112a67f1fe46cb8c3383d00_JaffaCakes118.exe"
  2⤵
  - Writes to the Master Boot Record (MBR)
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3044

C:\Users\Admin\AppData\Local\Temp\1471563133\zmstage.exe
C:\Users\Admin\AppData\Local\Temp\1471563133\zmstage.exe
1⤵
PID:2052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3044-0-0x0000000000400000-0x00000000004C9000-memory.dmp

Filesize
804KB

Download
memory/3044-2-0x0000000077600000-0x0000000077601000-memory.dmp

Filesize
4KB

Download
memory/3044-1-0x00000000775FF000-0x0000000077600000-memory.dmp

Filesize
4KB

Download
memory/3044-7-0x0000000001FD0000-0x0000000001FD1000-memory.dmp

Filesize
4KB

Download
memory/3044-6-0x0000000002070000-0x0000000002071000-memory.dmp

Filesize
4KB

Download
memory/3044-5-0x0000000002080000-0x0000000002081000-memory.dmp

Filesize
4KB

Download
memory/3044-4-0x0000000002440000-0x0000000002441000-memory.dmp

Filesize
4KB

Download
memory/3044-3-0x0000000001FE0000-0x0000000001FE1000-memory.dmp

Filesize
4KB

Download
memory/3044-11-0x0000000002090000-0x0000000002091000-memory.dmp

Filesize
4KB

Download
memory/3044-10-0x00000000020A0000-0x00000000020A1000-memory.dmp

Filesize
4KB

Download
memory/3044-9-0x00000000020F0000-0x00000000020F1000-memory.dmp

Filesize
4KB

Download
memory/3044-8-0x0000000002100000-0x0000000002101000-memory.dmp

Filesize
4KB

Download
memory/3044-12-0x0000000000400000-0x00000000004C9000-memory.dmp

Filesize
804KB

Download
memory/3044-13-0x0000000000400000-0x00000000004C9000-memory.dmp

Filesize
804KB

Download
memory/3044-14-0x0000000000400000-0x00000000004C9000-memory.dmp

Filesize
804KB

Download
memory/3044-15-0x0000000000400000-0x00000000004C9000-memory.dmp

Filesize
804KB

Download
memory/3044-16-0x0000000000400000-0x00000000004C9000-memory.dmp

Filesize
804KB

Download
memory/3044-17-0x0000000000400000-0x00000000004C9000-memory.dmp

Filesize
804KB

Download
memory/3044-18-0x0000000000400000-0x00000000004C9000-memory.dmp

Filesize
804KB

Download
memory/3044-19-0x0000000000400000-0x00000000004C9000-memory.dmp

Filesize
804KB

Download
memory/3044-20-0x0000000000400000-0x00000000004C9000-memory.dmp

Filesize
804KB

Download
memory/3044-21-0x0000000000400000-0x00000000004C9000-memory.dmp

Filesize
804KB

Download
memory/3044-22-0x0000000000400000-0x00000000004C9000-memory.dmp

Filesize
804KB

Download
memory/3044-23-0x0000000000400000-0x00000000004C9000-memory.dmp

Filesize
804KB

Download
memory/3044-24-0x0000000000400000-0x00000000004C9000-memory.dmp

Filesize
804KB

Download
memory/3044-25-0x0000000000400000-0x00000000004C9000-memory.dmp

Filesize
804KB

Download
memory/3044-26-0x0000000000400000-0x00000000004C9000-memory.dmp

Filesize
804KB

Download