224ac151cdfd9f16058f7599f6c3b11d81a4ab5c081b0d8cd8de8d28835cc344

Analysis

max time kernel
141s
max time network
120s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
04/07/2024, 07:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2521afdeb143b6a15de93c8404913ae8_JaffaCakes118.exe
Size

351KB
MD5

2521afdeb143b6a15de93c8404913ae8
SHA1

bd59e3ca31dc7f08aab66cb867ce487788c25f92
SHA256

224ac151cdfd9f16058f7599f6c3b11d81a4ab5c081b0d8cd8de8d28835cc344
SHA512

8544f068b3ce7e153f6c14dfe975377e2f2c6a04e093a978ced8e5b580eb8ee5d652d411dd0371e6d1eab44982f7e0b0fa5c7f9b9f768c08d0127e743cc28644
SSDEEP

6144:XC9M1ZHPN53iQe5WydwYGXPyWMM9amUlF9MjLkG6n+aCyIK3ccnMxj0Uv3iZ:oiZvTiMymY4NMMVG83CW1K3DnsYU6Z

Score

6^/10

bootkit persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	2521afdeb143b6a15de93c8404913ae8_JaffaCakes118.exe

Modifies registry class 31 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E3835935-90B9-44B0-2BB6-F3A5A6F87883}\ProgID	2521afdeb143b6a15de93c8404913ae8_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7EE539AA-79A6-D69C-4EDD-C0FF1A101767}	2521afdeb143b6a15de93c8404913ae8_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7EE539AA-79A6-D69C-4EDD-C0FF1A101767}\1.0\0	2521afdeb143b6a15de93c8404913ae8_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E3835935-90B9-44B0-2BB6-F3A5A6F87883}\TypeLib\ = "{7EE539AA-79A6-D69C-4EDD-C0FF1A101767}"	2521afdeb143b6a15de93c8404913ae8_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	2521afdeb143b6a15de93c8404913ae8_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	2521afdeb143b6a15de93c8404913ae8_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7EE539AA-79A6-D69C-4EDD-C0FF1A101767}\1.0\HELPDIR\ = "C:\\Windows\\ehome\\"	2521afdeb143b6a15de93c8404913ae8_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E3835935-90B9-44B0-2BB6-F3A5A6F87883}\TypeLib\	2521afdeb143b6a15de93c8404913ae8_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E3835935-90B9-44B0-2BB6-F3A5A6F87883}\VersionIndependentProgID\	2521afdeb143b6a15de93c8404913ae8_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E3835935-90B9-44B0-2BB6-F3A5A6F87883}\InprocServer32	2521afdeb143b6a15de93c8404913ae8_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E3835935-90B9-44B0-2BB6-F3A5A6F87883}\Programmable\	2521afdeb143b6a15de93c8404913ae8_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E3835935-90B9-44B0-2BB6-F3A5A6F87883}\ = "Hibagqok Geqaskofi Osemopit class"	2521afdeb143b6a15de93c8404913ae8_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E3835935-90B9-44B0-2BB6-F3A5A6F87883}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\ONBttnIELinkedNotes.dll"	2521afdeb143b6a15de93c8404913ae8_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E3835935-90B9-44B0-2BB6-F3A5A6F87883}\TypeLib	2521afdeb143b6a15de93c8404913ae8_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E3835935-90B9-44B0-2BB6-F3A5A6F87883}\VersionIndependentProgID	2521afdeb143b6a15de93c8404913ae8_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E3835935-90B9-44B0-2BB6-F3A5A6F87883}	2521afdeb143b6a15de93c8404913ae8_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7EE539AA-79A6-D69C-4EDD-C0FF1A101767}\	2521afdeb143b6a15de93c8404913ae8_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7EE539AA-79A6-D69C-4EDD-C0FF1A101767}\1.0\0\win32\	2521afdeb143b6a15de93c8404913ae8_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7EE539AA-79A6-D69C-4EDD-C0FF1A101767}\1.0\HELPDIR	2521afdeb143b6a15de93c8404913ae8_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7EE539AA-79A6-D69C-4EDD-C0FF1A101767}\1.0\HELPDIR\	2521afdeb143b6a15de93c8404913ae8_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E3835935-90B9-44B0-2BB6-F3A5A6F87883}\InprocServer32\	2521afdeb143b6a15de93c8404913ae8_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E3835935-90B9-44B0-2BB6-F3A5A6F87883}\ProgID\	2521afdeb143b6a15de93c8404913ae8_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E3835935-90B9-44B0-2BB6-F3A5A6F87883}\Programmable	2521afdeb143b6a15de93c8404913ae8_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7EE539AA-79A6-D69C-4EDD-C0FF1A101767}\1.0	2521afdeb143b6a15de93c8404913ae8_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7EE539AA-79A6-D69C-4EDD-C0FF1A101767}\1.0\0\	2521afdeb143b6a15de93c8404913ae8_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7EE539AA-79A6-D69C-4EDD-C0FF1A101767}\1.0\0\win32\ = "C:\\Windows\\ehome\\ehmsas.exe"	2521afdeb143b6a15de93c8404913ae8_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	2521afdeb143b6a15de93c8404913ae8_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E3835935-90B9-44B0-2BB6-F3A5A6F87883}\ProgID\ = "OneNote.IEAddin.LinkedNotes.14"	2521afdeb143b6a15de93c8404913ae8_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7EE539AA-79A6-D69C-4EDD-C0FF1A101767}\1.0\	2521afdeb143b6a15de93c8404913ae8_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7EE539AA-79A6-D69C-4EDD-C0FF1A101767}\1.0\0\win32	2521afdeb143b6a15de93c8404913ae8_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E3835935-90B9-44B0-2BB6-F3A5A6F87883}\VersionIndependentProgID\ = "OneNote.IEAddin.LinkedNotes"	2521afdeb143b6a15de93c8404913ae8_JaffaCakes118.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1700	2521afdeb143b6a15de93c8404913ae8_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\2521afdeb143b6a15de93c8404913ae8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2521afdeb143b6a15de93c8404913ae8_JaffaCakes118.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:1700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1700-0-0x0000000000400000-0x0000000000633000-memory.dmp

Filesize
2.2MB

Download
memory/1700-16-0x0000000000660000-0x0000000000661000-memory.dmp

Filesize
4KB

Download
memory/1700-15-0x0000000000660000-0x0000000000661000-memory.dmp

Filesize
4KB

Download
memory/1700-14-0x0000000000660000-0x0000000000661000-memory.dmp

Filesize
4KB

Download
memory/1700-13-0x0000000000660000-0x0000000000661000-memory.dmp

Filesize
4KB

Download
memory/1700-12-0x0000000000660000-0x0000000000661000-memory.dmp

Filesize
4KB

Download
memory/1700-11-0x0000000000660000-0x0000000000661000-memory.dmp

Filesize
4KB

Download
memory/1700-10-0x0000000000660000-0x0000000000661000-memory.dmp

Filesize
4KB

Download
memory/1700-9-0x0000000000660000-0x0000000000661000-memory.dmp

Filesize
4KB

Download
memory/1700-8-0x0000000000660000-0x0000000000661000-memory.dmp

Filesize
4KB

Download
memory/1700-7-0x0000000000660000-0x0000000000661000-memory.dmp

Filesize
4KB

Download
memory/1700-6-0x0000000000660000-0x0000000000661000-memory.dmp

Filesize
4KB

Download
memory/1700-5-0x0000000000660000-0x0000000000661000-memory.dmp

Filesize
4KB

Download
memory/1700-4-0x0000000000660000-0x0000000000661000-memory.dmp

Filesize
4KB

Download
memory/1700-3-0x0000000000660000-0x0000000000661000-memory.dmp

Filesize
4KB

Download
memory/1700-2-0x0000000000660000-0x0000000000661000-memory.dmp

Filesize
4KB

Download
memory/1700-1-0x0000000000650000-0x0000000000651000-memory.dmp

Filesize
4KB

Download
memory/1700-21-0x0000000000400000-0x00000000005D8000-memory.dmp

Filesize
1.8MB

Download
memory/1700-20-0x0000000000640000-0x0000000000641000-memory.dmp

Filesize
4KB

Download
memory/1700-19-0x0000000000650000-0x0000000000651000-memory.dmp

Filesize
4KB

Download
memory/1700-18-0x0000000000650000-0x0000000000651000-memory.dmp

Filesize
4KB

Download
memory/1700-17-0x0000000000650000-0x0000000000651000-memory.dmp

Filesize
4KB

Download
memory/1700-22-0x0000000000400000-0x0000000000633000-memory.dmp

Filesize
2.2MB

Download
memory/1700-36-0x0000000000660000-0x0000000000661000-memory.dmp

Filesize
4KB

Download
memory/1700-38-0x0000000000660000-0x0000000000661000-memory.dmp

Filesize
4KB

Download
memory/1700-37-0x0000000000660000-0x0000000000661000-memory.dmp

Filesize
4KB

Download
memory/1700-35-0x0000000000660000-0x0000000000661000-memory.dmp

Filesize
4KB

Download
memory/1700-34-0x0000000000660000-0x0000000000661000-memory.dmp

Filesize
4KB

Download
memory/1700-33-0x0000000000660000-0x0000000000661000-memory.dmp

Filesize
4KB

Download
memory/1700-32-0x0000000000660000-0x0000000000661000-memory.dmp

Filesize
4KB

Download
memory/1700-31-0x0000000000660000-0x0000000000661000-memory.dmp

Filesize
4KB

Download
memory/1700-30-0x0000000000660000-0x0000000000661000-memory.dmp

Filesize
4KB

Download
memory/1700-29-0x0000000000660000-0x0000000000661000-memory.dmp

Filesize
4KB

Download
memory/1700-28-0x0000000000660000-0x0000000000661000-memory.dmp

Filesize
4KB

Download
memory/1700-27-0x0000000000660000-0x0000000000661000-memory.dmp

Filesize
4KB

Download
memory/1700-26-0x0000000000660000-0x0000000000661000-memory.dmp

Filesize
4KB

Download
memory/1700-25-0x0000000000660000-0x0000000000661000-memory.dmp

Filesize
4KB

Download
memory/1700-24-0x0000000000660000-0x0000000000661000-memory.dmp

Filesize
4KB

Download
memory/1700-40-0x0000000000650000-0x0000000000651000-memory.dmp

Filesize
4KB

Download
memory/1700-39-0x0000000000650000-0x0000000000651000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads