Overview

overview

8

Static

static

3

2911627228...18.exe

windows7-x64

7

2911627228...18.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240704-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06-07-2024 17:50

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    29116272281ad7f8b672112fe47d1a17_JaffaCakes118.exe

  • Size

    847KB

  • MD5

    29116272281ad7f8b672112fe47d1a17

  • SHA1

    7fe297ff7b1b88f41a80e1c71327bed4e12a49c6

  • SHA256

    b143c1b25096ec1fc28a227a74d1ff0d2decafcd41b02317d3ed0002f329f043

  • SHA512

    abcb1e965679be5aef5bc025ec1d679394c2c27341ec7a63a67d9fd94142b9f803b77f9ce2fd73aa6a1dbb43b55e40dbdf45a9dd633c42201a831119f0f7b57d

  • SSDEEP

    24576:y3+BG6BhAVGbqQ4sW8xYBrMBJyPVrk8hACSM/:VT6EUz8fqGCS

Score
8/10
bootkitpersistence

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 5 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 29 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in System32 directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 11 IoCs
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\29116272281ad7f8b672112fe47d1a17_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\29116272281ad7f8b672112fe47d1a17_JaffaCakes118.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3916
    • C:\ProgramData\isecurity.exe
      C:\ProgramData\isecurity.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Enumerates connected drives
      • Writes to the Master Boot Record (MBR)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:4988
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 800
        3⤵
        • Program crash
        PID:3720
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 864
        3⤵
        • Program crash
        PID:1584
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 1112
        3⤵
        • Program crash
        PID:4620
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 1108
        3⤵
        • Program crash
        PID:3148
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 1148
        3⤵
        • Program crash
        PID:5000
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 1268
        3⤵
        • Program crash
        PID:864
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 1276
        3⤵
        • Program crash
        PID:2028
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 1276
        3⤵
        • Program crash
        PID:2328
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 1148
        3⤵
        • Program crash
        PID:832
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 1748
        3⤵
        • Program crash
        PID:3308
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 1260
        3⤵
        • Program crash
        PID:2376
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 200 -p 4988 -ip 4988
    1⤵
      PID:1500
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4988 -ip 4988
      1⤵
        PID:3756
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4988 -ip 4988
        1⤵
          PID:3644
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4988 -ip 4988
          1⤵
            PID:116
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4988 -ip 4988
            1⤵
              PID:960
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4988 -ip 4988
              1⤵
                PID:4028
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4988 -ip 4988
                1⤵
                  PID:2372
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4988 -ip 4988
                  1⤵
                    PID:3236
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4988 -ip 4988
                    1⤵
                      PID:1784
                    • C:\Windows\system32\sihost.exe
                      sihost.exe
                      1⤵
                      • Suspicious use of FindShellTrayWindow
                      • Suspicious use of WriteProcessMemory
                      PID:2040
                      • C:\Windows\explorer.exe
                        explorer.exe /LOADSAVEDWINDOWS
                        2⤵
                        • Boot or Logon Autostart Execution: Active Setup
                        • Enumerates connected drives
                        • Checks SCSI registry key(s)
                        • Modifies registry class
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of FindShellTrayWindow
                        • Suspicious use of SendNotifyMessage
                        PID:3960
                    • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
                      "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
                      1⤵
                      • Modifies data under HKEY_USERS
                      • Suspicious use of SetWindowsHookEx
                      PID:880
                    • C:\Windows\system32\sihost.exe
                      sihost.exe
                      1⤵
                      • Suspicious use of FindShellTrayWindow
                      PID:800
                    • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
                      "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
                      1⤵
                      • Drops file in System32 directory
                      • Modifies data under HKEY_USERS
                      • Suspicious use of SetWindowsHookEx
                      PID:4932
                    • C:\Windows\system32\sihost.exe
                      sihost.exe
                      1⤵
                      • Suspicious use of FindShellTrayWindow
                      • Suspicious use of WriteProcessMemory
                      PID:1044
                      • C:\Windows\explorer.exe
                        explorer.exe /LOADSAVEDWINDOWS
                        2⤵
                        • Boot or Logon Autostart Execution: Active Setup
                        • Modifies registry class
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of FindShellTrayWindow
                        • Suspicious use of SendNotifyMessage
                        PID:220
                    • C:\Windows\system32\sihost.exe
                      sihost.exe
                      1⤵
                      • Suspicious use of FindShellTrayWindow
                      • Suspicious use of WriteProcessMemory
                      PID:428
                      • C:\Windows\explorer.exe
                        explorer.exe /LOADSAVEDWINDOWS
                        2⤵
                          PID:3832
                      • C:\Windows\explorer.exe
                        explorer.exe
                        1⤵
                        • Boot or Logon Autostart Execution: Active Setup
                        • Enumerates connected drives
                        • Checks SCSI registry key(s)
                        • Modifies Internet Explorer settings
                        • Modifies registry class
                        • Suspicious behavior: AddClipboardFormatListener
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of FindShellTrayWindow
                        • Suspicious use of SendNotifyMessage
                        • Suspicious use of SetWindowsHookEx
                        PID:5104
                      • C:\Windows\System32\rundll32.exe
                        C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
                        1⤵
                          PID:4336
                        • C:\Windows\system32\sihost.exe
                          sihost.exe
                          1⤵
                          • Suspicious use of FindShellTrayWindow
                          • Suspicious use of WriteProcessMemory
                          PID:2916
                          • C:\Windows\explorer.exe
                            explorer.exe /LOADSAVEDWINDOWS
                            2⤵
                            • Boot or Logon Autostart Execution: Active Setup
                            • Enumerates connected drives
                            • Checks SCSI registry key(s)
                            • Modifies registry class
                            • Suspicious use of AdjustPrivilegeToken
                            • Suspicious use of FindShellTrayWindow
                            • Suspicious use of SendNotifyMessage
                            PID:3752
                        • C:\Windows\system32\sihost.exe
                          sihost.exe
                          1⤵
                          • Suspicious use of FindShellTrayWindow
                          • Suspicious use of WriteProcessMemory
                          PID:876
                          • C:\Windows\explorer.exe
                            explorer.exe /LOADSAVEDWINDOWS
                            2⤵
                            • Boot or Logon Autostart Execution: Active Setup
                            • Enumerates connected drives
                            • Checks SCSI registry key(s)
                            • Modifies registry class
                            • Suspicious use of AdjustPrivilegeToken
                            • Suspicious use of FindShellTrayWindow
                            • Suspicious use of SendNotifyMessage
                            • Suspicious use of SetWindowsHookEx
                            PID:4072
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4988 -ip 4988
                          1⤵
                            PID:4460
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4988 -ip 4988
                            1⤵
                              PID:1820

                            Network

                            MITRE ATT&CK Enterprise v15

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\ProgramData\isecurity.exe
                              Filesize

                              841KB

                              MD5

                              4c5b246fe421ca1b67bd9c339992149d

                              SHA1

                              afe516a0ddeb755597dc02c03953c05435c1d0f6

                              SHA256

                              b8abb0aefce6c74af264aeaacac1e0c716961d9aa446cebbd17c1d358da4dc5b

                              SHA512

                              2291585192cd5d89547137b03dc06ce7bceab5688b6339c7e5812d0203adce973427cf8a40b3ef73223dca4e6f2125420e31bc73a83a9c4b6058693581fbb2aa

                              Download Submit

                            • C:\Users\Admin\AppData\Local\IconCache.db
                              Filesize

                              18KB

                              MD5

                              972d2e45c96cfedecb38e4a1898a720e

                              SHA1

                              baf77e81f7bb48ac37a404ad681f8bfc913b0105

                              SHA256

                              4b1218f8098efa88ac176d6ff67b7e89b04da3e582ec228d0b9ecae91be36184

                              SHA512

                              6d3d00798b4e76d891c7ab20c882159461f867e5e5bf5fb2a2846e24a21fee71c51377b610d8af2bf5cc74460e352f7ca267fdf8e160f1605f1e4e0df4dc908b

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\PenWorkspace\DiscoverCacheData.dat
                              Filesize

                              1022B

                              MD5

                              ef9371e9badc7f04c23a8b7d3aeb9b92

                              SHA1

                              73bad8dc79d0b0b43db5986968a0f2d89a438e42

                              SHA256

                              8f670fcd9796eda728a1dfbc0394f8b321cc04f8addb33615bd365ef25c1735c

                              SHA512

                              076486c28bfbd300f31bb5087b3aa01763594c60ba3c4d19302b5411106124bdba96d7b116b4467fd2ea58b8c756fb18f3368fbaf735b43b8833bcf60af5962c

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\{425CAB31-537E-472E-8F17-FB62A8A3DDA8}.png
                              Filesize

                              6KB

                              MD5

                              099ba37f81c044f6b2609537fdb7d872

                              SHA1

                              470ef859afbce52c017874d77c1695b7b0f9cb87

                              SHA256

                              8c98c856e4d43f705ff9a5c9a55f92e1885765654912b4c75385c3ea2fdef4a7

                              SHA512

                              837e1ad7fe4f5cbc0a87f3703ba211c18f32b20df93b23f681cbd0390d8077adba64cf6454a1bb28df1f7df4cb2cdc021d826b6ef8db890e40f21d618d5eb07a

                              Download Submit

                            • C:\Users\Public\Desktop\Internet Security.lnk
                              Filesize

                              682B

                              MD5

                              6029d4227155b35a4cd8aab9e5c78842

                              SHA1

                              6359729deea853e676fc7e73dda91b3ee077eb22

                              SHA256

                              b31246008c43e70f3ac03193b4cf7064d59ae38e2d50b9e8dd44dfe8527485d9

                              SHA512

                              4db6ba6e6ad0af423c9ff6b9e241a39787c650abbf848ce6619a91f21a6414ccaff3a89171a9937de47156416424f06b2d4b67b346b43470421effc8cca8ca27

                              Download Submit

                            • memory/3916-0-0x00000000004D6000-0x00000000004D7000-memory.dmp

                              Filesize

                              4KB

                              Download

                            • memory/3916-2-0x0000000000400000-0x0000000000500000-memory.dmp

                              Filesize

                              1024KB

                              Download

                            • memory/3916-7-0x0000000000400000-0x0000000000500000-memory.dmp

                              Filesize

                              1024KB

                              Download

                            • memory/3916-1-0x0000000000400000-0x0000000000500000-memory.dmp

                              Filesize

                              1024KB

                              Download

                            • memory/3960-26-0x0000000004710000-0x0000000004711000-memory.dmp

                              Filesize

                              4KB

                              Download

                            • memory/4072-41-0x00000000034C0000-0x00000000034C1000-memory.dmp

                              Filesize

                              4KB

                              Download

                            • memory/4988-29-0x0000000000400000-0x0000000000A3F000-memory.dmp

                              Filesize

                              6.2MB

                              Download

                            • memory/4988-57-0x0000000000400000-0x0000000000A3F000-memory.dmp

                              Filesize

                              6.2MB

                              Download

                            • memory/4988-20-0x0000000000400000-0x0000000000A3F000-memory.dmp

                              Filesize

                              6.2MB

                              Download

                            • memory/4988-19-0x0000000000400000-0x0000000000A3F000-memory.dmp

                              Filesize

                              6.2MB

                              Download

                            • memory/4988-28-0x0000000000400000-0x0000000000A3F000-memory.dmp

                              Filesize

                              6.2MB

                              Download

                            • memory/4988-18-0x0000000000400000-0x0000000000A3F000-memory.dmp

                              Filesize

                              6.2MB

                              Download

                            • memory/4988-17-0x0000000000400000-0x0000000000A3F000-memory.dmp

                              Filesize

                              6.2MB

                              Download

                            • memory/4988-16-0x0000000000400000-0x0000000000A3F000-memory.dmp

                              Filesize

                              6.2MB

                              Download

                            • memory/4988-43-0x0000000000400000-0x0000000000A3F000-memory.dmp

                              Filesize

                              6.2MB

                              Download

                            • memory/4988-14-0x0000000000400000-0x0000000000A3F000-memory.dmp

                              Filesize

                              6.2MB

                              Download

                            • memory/4988-56-0x0000000000400000-0x0000000000A3F000-memory.dmp

                              Filesize

                              6.2MB

                              Download

                            • memory/4988-23-0x0000000000400000-0x0000000000A3F000-memory.dmp

                              Filesize

                              6.2MB

                              Download

                            • memory/4988-58-0x0000000000400000-0x0000000000A3F000-memory.dmp

                              Filesize

                              6.2MB

                              Download

                            • memory/4988-59-0x0000000000400000-0x0000000000A3F000-memory.dmp

                              Filesize

                              6.2MB

                              Download

                            • memory/4988-62-0x0000000000400000-0x0000000000A3F000-memory.dmp

                              Filesize

                              6.2MB

                              Download

                            • memory/4988-65-0x0000000000400000-0x0000000000A3F000-memory.dmp

                              Filesize

                              6.2MB

                              Download

                            • memory/4988-66-0x0000000000400000-0x0000000000A3F000-memory.dmp

                              Filesize

                              6.2MB

                              Download

                            • memory/4988-69-0x0000000000400000-0x0000000000A3F000-memory.dmp

                              Filesize

                              6.2MB

                              Download

                            • memory/4988-70-0x0000000000400000-0x0000000000A3F000-memory.dmp

                              Filesize

                              6.2MB

                              Download

                            • memory/4988-71-0x0000000000400000-0x0000000000A3F000-memory.dmp

                              Filesize

                              6.2MB

                              Download

                            • memory/4988-72-0x0000000000400000-0x0000000000A3F000-memory.dmp

                              Filesize

                              6.2MB

                              Download