9139f96f2eeb23fcec4a5acd380cb9146e4f6342eb4800e8adfad18d7bc17f5a

Analysis

max time kernel
119s
max time network
127s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
06/07/2024, 13:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

28631d0fdafc463f3926aa952deb83b0_JaffaCakes118.exe
Size

1.4MB
MD5

28631d0fdafc463f3926aa952deb83b0
SHA1

71707a56a8825af2213b55f1b4eacccc73c8142f
SHA256

9139f96f2eeb23fcec4a5acd380cb9146e4f6342eb4800e8adfad18d7bc17f5a
SHA512

1666949c3f395a9f6d76dae14bce851a5587ff3414d0d001a4bfa30860559facf4cf1dc03dea0cd3a11102ac08524168bfe9b2074ab05c34afe5c485f015940e
SSDEEP

24576:G66tHG/0zL4SeSekrKhG0AmaeC3dODxv6806U9oQT/6Adz2SuI0V:6Hz4SeS+J/BS80h//6AdE

Score

7^/10

bootkit persistence vmprotect

Malware Config

Signatures

Loads dropped DLL 9 IoCs

pid	Process
2220	28631d0fdafc463f3926aa952deb83b0_JaffaCakes118.exe
2220	28631d0fdafc463f3926aa952deb83b0_JaffaCakes118.exe
2220	28631d0fdafc463f3926aa952deb83b0_JaffaCakes118.exe
2220	28631d0fdafc463f3926aa952deb83b0_JaffaCakes118.exe
2220	28631d0fdafc463f3926aa952deb83b0_JaffaCakes118.exe
2220	28631d0fdafc463f3926aa952deb83b0_JaffaCakes118.exe
2220	28631d0fdafc463f3926aa952deb83b0_JaffaCakes118.exe
2220	28631d0fdafc463f3926aa952deb83b0_JaffaCakes118.exe
2220	28631d0fdafc463f3926aa952deb83b0_JaffaCakes118.exe

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral1/memory/2220-0-0x0000000000400000-0x000000000073F000-memory.dmp	vmprotect
behavioral1/memory/2220-1-0x0000000000400000-0x000000000073F000-memory.dmp	vmprotect
behavioral1/memory/2220-50-0x0000000000400000-0x000000000073F000-memory.dmp	vmprotect

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	28631d0fdafc463f3926aa952deb83b0_JaffaCakes118.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\ceAte×¢Èë.ime	28631d0fdafc463f3926aa952deb83b0_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\TesSafe.dll	28631d0fdafc463f3926aa952deb83b0_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\ceAte×¢Èë1.ime	28631d0fdafc463f3926aa952deb83b0_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\ÄÚ´æ´úÂë.txt	28631d0fdafc463f3926aa952deb83b0_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\TesSafe.dll	28631d0fdafc463f3926aa952deb83b0_JaffaCakes118.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2220	28631d0fdafc463f3926aa952deb83b0_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main	28631d0fdafc463f3926aa952deb83b0_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2220	28631d0fdafc463f3926aa952deb83b0_JaffaCakes118.exe
2220	28631d0fdafc463f3926aa952deb83b0_JaffaCakes118.exe
2220	28631d0fdafc463f3926aa952deb83b0_JaffaCakes118.exe
2220	28631d0fdafc463f3926aa952deb83b0_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\28631d0fdafc463f3926aa952deb83b0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\28631d0fdafc463f3926aa952deb83b0_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2220

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\ceAte×¢Èë.ime

Filesize
52KB

MD5
2d7b961ac438989934b40a0cf24afee5

SHA1
368df5447119d94eaf0b3c473b1fedc18e1e99ba

SHA256
a1f9f8dc2095758bc4bed386ad9ab31d6cfc427b2fd04661ef3c74ca7057bd29

SHA512
55a33536218732ec7a388e59546af778987af79a6ba9147032ef5733d8a472030a151f7bb084d14b32bea04ad008998cd94a959f8ca36c14b3bb9c61b3989a01

Download Submit
memory/2220-0-0x0000000000400000-0x000000000073F000-memory.dmp

Filesize
3.2MB

Download
memory/2220-1-0x0000000000400000-0x000000000073F000-memory.dmp

Filesize
3.2MB

Download
memory/2220-50-0x0000000000400000-0x000000000073F000-memory.dmp

Filesize
3.2MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads