6b4873002d634c6fb95365e155e4c04f0e1e8d00d5bf2efa4f49983ceee76801

General

Target

283a451f7af245c8661281d38af80c83_JaffaCakes118.exe
Size

480KB
MD5

283a451f7af245c8661281d38af80c83
SHA1

6114af9fa60c0cc3d8e68da79aec20ee5b98388b
SHA256

6b4873002d634c6fb95365e155e4c04f0e1e8d00d5bf2efa4f49983ceee76801
SHA512

56dca00c2f69391b39488defccdbedfa8e2c0da665e433f4c5fbf0e1faab43afd1c835ba1885ba7d4e7f4af264df15e1aa7e1b8eb756901fed13cb9a79ee8970
SSDEEP

12288:uRv3sTbz5eilM0dTz7Myg5DKDM5ubuZCW:uB3sPz5qCTHcuDM5/

Score

6^/10

bootkit persistence

Malware Config

Signatures

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	283a451f7af245c8661281d38af80c83_JaffaCakes118.exe
File opened (read-only)	\??\K:	283a451f7af245c8661281d38af80c83_JaffaCakes118.exe
File opened (read-only)	\??\M:	283a451f7af245c8661281d38af80c83_JaffaCakes118.exe
File opened (read-only)	\??\N:	283a451f7af245c8661281d38af80c83_JaffaCakes118.exe
File opened (read-only)	\??\U:	283a451f7af245c8661281d38af80c83_JaffaCakes118.exe
File opened (read-only)	\??\V:	283a451f7af245c8661281d38af80c83_JaffaCakes118.exe
File opened (read-only)	\??\W:	283a451f7af245c8661281d38af80c83_JaffaCakes118.exe
File opened (read-only)	\??\B:	283a451f7af245c8661281d38af80c83_JaffaCakes118.exe
File opened (read-only)	\??\G:	283a451f7af245c8661281d38af80c83_JaffaCakes118.exe
File opened (read-only)	\??\H:	283a451f7af245c8661281d38af80c83_JaffaCakes118.exe
File opened (read-only)	\??\Q:	283a451f7af245c8661281d38af80c83_JaffaCakes118.exe
File opened (read-only)	\??\S:	283a451f7af245c8661281d38af80c83_JaffaCakes118.exe
File opened (read-only)	\??\R:	283a451f7af245c8661281d38af80c83_JaffaCakes118.exe
File opened (read-only)	\??\Z:	283a451f7af245c8661281d38af80c83_JaffaCakes118.exe
File opened (read-only)	\??\X:	283a451f7af245c8661281d38af80c83_JaffaCakes118.exe
File opened (read-only)	\??\E:	283a451f7af245c8661281d38af80c83_JaffaCakes118.exe
File opened (read-only)	\??\I:	283a451f7af245c8661281d38af80c83_JaffaCakes118.exe
File opened (read-only)	\??\J:	283a451f7af245c8661281d38af80c83_JaffaCakes118.exe
File opened (read-only)	\??\L:	283a451f7af245c8661281d38af80c83_JaffaCakes118.exe
File opened (read-only)	\??\O:	283a451f7af245c8661281d38af80c83_JaffaCakes118.exe
File opened (read-only)	\??\P:	283a451f7af245c8661281d38af80c83_JaffaCakes118.exe
File opened (read-only)	\??\T:	283a451f7af245c8661281d38af80c83_JaffaCakes118.exe
File opened (read-only)	\??\Y:	283a451f7af245c8661281d38af80c83_JaffaCakes118.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	283a451f7af245c8661281d38af80c83_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	283a451f7af245c8661281d38af80c83_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	283a451f7af245c8661281d38af80c83_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	283a451f7af245c8661281d38af80c83_JaffaCakes118.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2324	283a451f7af245c8661281d38af80c83_JaffaCakes118.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2324	283a451f7af245c8661281d38af80c83_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2324	283a451f7af245c8661281d38af80c83_JaffaCakes118.exe
2324	283a451f7af245c8661281d38af80c83_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\283a451f7af245c8661281d38af80c83_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\283a451f7af245c8661281d38af80c83_JaffaCakes118.exe"
1⤵
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2324

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2324-0-0x0000000000400000-0x00000000005AB000-memory.dmp

Filesize
1.7MB

Download
memory/2324-1-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2324-2-0x0000000000270000-0x00000000002A0000-memory.dmp

Filesize
192KB

Download
memory/2324-3-0x0000000000260000-0x0000000000263000-memory.dmp

Filesize
12KB

Download
memory/2324-11-0x0000000002170000-0x0000000002171000-memory.dmp

Filesize
4KB

Download
memory/2324-10-0x00000000002B0000-0x00000000002B1000-memory.dmp

Filesize
4KB

Download
memory/2324-9-0x00000000002C0000-0x00000000002C1000-memory.dmp

Filesize
4KB

Download
memory/2324-8-0x00000000002D0000-0x00000000002D1000-memory.dmp

Filesize
4KB

Download
memory/2324-7-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2324-6-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2324-5-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/2324-4-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/2324-13-0x00000000002E0000-0x00000000002E1000-memory.dmp

Filesize
4KB

Download
memory/2324-12-0x0000000000380000-0x0000000000381000-memory.dmp

Filesize
4KB

Download
memory/2324-14-0x0000000000400000-0x00000000005AB000-memory.dmp

Filesize
1.7MB

Download
memory/2324-15-0x0000000000270000-0x00000000002A0000-memory.dmp

Filesize
192KB

Download
memory/2324-17-0x0000000002170000-0x0000000002171000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads