2945e6656a3346d7f52cc27302fe726cf29524a9909cb098382bf902dbfccc5f

General

Target

2736bea8a744a3a2b09ca5879d2b7a44_JaffaCakes118.exe
Size

134KB
MD5

2736bea8a744a3a2b09ca5879d2b7a44
SHA1

ac78582e7a39158237f6eeacd8bbb28efa69d222
SHA256

2945e6656a3346d7f52cc27302fe726cf29524a9909cb098382bf902dbfccc5f
SHA512

916ebb8b83af94a378bf18500451f4c381231841c2035de7c1bd091abbd9765e8b3443bf17cc7c078e2d889200ab5f4eaa93743cb3fcae8652d000582663901f
SSDEEP

3072:Wro6cA46qRP8lS+jBsK1j0Z9deOd0ieFaw5hN:W/yRP8s++xI8MFzF

Score

6^/10

bootkit persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	2736bea8a744a3a2b09ca5879d2b7a44_JaffaCakes118.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3044 set thread context of 832	3044	2736bea8a744a3a2b09ca5879d2b7a44_JaffaCakes118.exe	83
PID 832 set thread context of 4836	832	2736bea8a744a3a2b09ca5879d2b7a44_JaffaCakes118.exe	86

Modifies Control Panel 3 IoCs

evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\Control Panel\International\Locale = "00000409"	2736bea8a744a3a2b09ca5879d2b7a44_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\Control Panel\International\Locales = "00000409"	2736bea8a744a3a2b09ca5879d2b7a44_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\Control Panel\International\Locale = "00000409"	2736bea8a744a3a2b09ca5879d2b7a44_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
3044	2736bea8a744a3a2b09ca5879d2b7a44_JaffaCakes118.exe
3044	2736bea8a744a3a2b09ca5879d2b7a44_JaffaCakes118.exe
832	2736bea8a744a3a2b09ca5879d2b7a44_JaffaCakes118.exe
832	2736bea8a744a3a2b09ca5879d2b7a44_JaffaCakes118.exe
832	2736bea8a744a3a2b09ca5879d2b7a44_JaffaCakes118.exe
832	2736bea8a744a3a2b09ca5879d2b7a44_JaffaCakes118.exe
832	2736bea8a744a3a2b09ca5879d2b7a44_JaffaCakes118.exe
832	2736bea8a744a3a2b09ca5879d2b7a44_JaffaCakes118.exe
832	2736bea8a744a3a2b09ca5879d2b7a44_JaffaCakes118.exe
832	2736bea8a744a3a2b09ca5879d2b7a44_JaffaCakes118.exe
832	2736bea8a744a3a2b09ca5879d2b7a44_JaffaCakes118.exe
832	2736bea8a744a3a2b09ca5879d2b7a44_JaffaCakes118.exe
832	2736bea8a744a3a2b09ca5879d2b7a44_JaffaCakes118.exe
832	2736bea8a744a3a2b09ca5879d2b7a44_JaffaCakes118.exe
832	2736bea8a744a3a2b09ca5879d2b7a44_JaffaCakes118.exe
832	2736bea8a744a3a2b09ca5879d2b7a44_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeAssignPrimaryTokenPrivilege	832	2736bea8a744a3a2b09ca5879d2b7a44_JaffaCakes118.exe
Token: SeAuditPrivilege	832	2736bea8a744a3a2b09ca5879d2b7a44_JaffaCakes118.exe
Token: SeBackupPrivilege	832	2736bea8a744a3a2b09ca5879d2b7a44_JaffaCakes118.exe
Token: SeChangeNotifyPrivilege	832	2736bea8a744a3a2b09ca5879d2b7a44_JaffaCakes118.exe
Token: SeCreatePagefilePrivilege	832	2736bea8a744a3a2b09ca5879d2b7a44_JaffaCakes118.exe
Token: SeCreatePermanentPrivilege	832	2736bea8a744a3a2b09ca5879d2b7a44_JaffaCakes118.exe
Token: SeCreatePermanentPrivilege	832	2736bea8a744a3a2b09ca5879d2b7a44_JaffaCakes118.exe
Token: SeCreateTokenPrivilege	832	2736bea8a744a3a2b09ca5879d2b7a44_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	832	2736bea8a744a3a2b09ca5879d2b7a44_JaffaCakes118.exe
Token: SeIncreaseQuotaPrivilege	832	2736bea8a744a3a2b09ca5879d2b7a44_JaffaCakes118.exe
Token: SeLoadDriverPrivilege	832	2736bea8a744a3a2b09ca5879d2b7a44_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	832	2736bea8a744a3a2b09ca5879d2b7a44_JaffaCakes118.exe
Token: SeMachineAccountPrivilege	832	2736bea8a744a3a2b09ca5879d2b7a44_JaffaCakes118.exe
Token: SeProfSingleProcessPrivilege	832	2736bea8a744a3a2b09ca5879d2b7a44_JaffaCakes118.exe
Token: SeRemoteShutdownPrivilege	832	2736bea8a744a3a2b09ca5879d2b7a44_JaffaCakes118.exe
Token: SeRestorePrivilege	832	2736bea8a744a3a2b09ca5879d2b7a44_JaffaCakes118.exe
Token: SeSecurityPrivilege	832	2736bea8a744a3a2b09ca5879d2b7a44_JaffaCakes118.exe
Token: SeShutdownPrivilege	832	2736bea8a744a3a2b09ca5879d2b7a44_JaffaCakes118.exe
Token: SeSystemEnvironmentPrivilege	832	2736bea8a744a3a2b09ca5879d2b7a44_JaffaCakes118.exe
Token: SeSystemProfilePrivilege	832	2736bea8a744a3a2b09ca5879d2b7a44_JaffaCakes118.exe
Token: SeSystemtimePrivilege	832	2736bea8a744a3a2b09ca5879d2b7a44_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	832	2736bea8a744a3a2b09ca5879d2b7a44_JaffaCakes118.exe
Token: SeTcbPrivilege	832	2736bea8a744a3a2b09ca5879d2b7a44_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3044	2736bea8a744a3a2b09ca5879d2b7a44_JaffaCakes118.exe
832	2736bea8a744a3a2b09ca5879d2b7a44_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 3044 wrote to memory of 832	3044	2736bea8a744a3a2b09ca5879d2b7a44_JaffaCakes118.exe	83
PID 3044 wrote to memory of 832	3044	2736bea8a744a3a2b09ca5879d2b7a44_JaffaCakes118.exe	83
PID 3044 wrote to memory of 832	3044	2736bea8a744a3a2b09ca5879d2b7a44_JaffaCakes118.exe	83
PID 3044 wrote to memory of 832	3044	2736bea8a744a3a2b09ca5879d2b7a44_JaffaCakes118.exe	83
PID 3044 wrote to memory of 832	3044	2736bea8a744a3a2b09ca5879d2b7a44_JaffaCakes118.exe	83
PID 3044 wrote to memory of 832	3044	2736bea8a744a3a2b09ca5879d2b7a44_JaffaCakes118.exe	83
PID 3044 wrote to memory of 832	3044	2736bea8a744a3a2b09ca5879d2b7a44_JaffaCakes118.exe	83
PID 832 wrote to memory of 4836	832	2736bea8a744a3a2b09ca5879d2b7a44_JaffaCakes118.exe	86
PID 832 wrote to memory of 4836	832	2736bea8a744a3a2b09ca5879d2b7a44_JaffaCakes118.exe	86
PID 832 wrote to memory of 4836	832	2736bea8a744a3a2b09ca5879d2b7a44_JaffaCakes118.exe	86
PID 832 wrote to memory of 4836	832	2736bea8a744a3a2b09ca5879d2b7a44_JaffaCakes118.exe	86
PID 832 wrote to memory of 4836	832	2736bea8a744a3a2b09ca5879d2b7a44_JaffaCakes118.exe	86
PID 832 wrote to memory of 4836	832	2736bea8a744a3a2b09ca5879d2b7a44_JaffaCakes118.exe	86
PID 832 wrote to memory of 4836	832	2736bea8a744a3a2b09ca5879d2b7a44_JaffaCakes118.exe	86

C:\Users\Admin\AppData\Local\Temp\2736bea8a744a3a2b09ca5879d2b7a44_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2736bea8a744a3a2b09ca5879d2b7a44_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3044
- C:\Users\Admin\AppData\Local\Temp\2736bea8a744a3a2b09ca5879d2b7a44_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\2736bea8a744a3a2b09ca5879d2b7a44_JaffaCakes118.exe
  2⤵
  - Writes to the Master Boot Record (MBR)
  - Suspicious use of SetThreadContext
  - Modifies Control Panel
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:832
- - C:\Users\Admin\AppData\Local\Temp\2736bea8a744a3a2b09ca5879d2b7a44_JaffaCakes118.exe
    C:\Users\Admin\AppData\Local\Temp\2736bea8a744a3a2b09ca5879d2b7a44_JaffaCakes118.exe
    3⤵
    PID:4836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/832-170-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/832-172-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/832-173-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/832-176-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/832-175-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/832-499-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4836-493-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4836-495-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4836-496-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads