9f8d001690b94e75dbb5e8522a86ee25838c43d66ab2e20a2e26c465c49207a0

General

Target

2ad1f2f3b4b2b535d1948448db0bfeba_JaffaCakes118.exe
Size

340KB
MD5

2ad1f2f3b4b2b535d1948448db0bfeba
SHA1

d979a2eacf211dc13abff95ab3b602fe7afe1d12
SHA256

9f8d001690b94e75dbb5e8522a86ee25838c43d66ab2e20a2e26c465c49207a0
SHA512

a92a3f17222522b363c5b9280067671b900f95795e889632f8b911987937d8fd1d7be1db9a97e8ae489340a4b40dd6a5108239266ad9149d9abaa233532e425b
SSDEEP

6144:deTKUiiIKYFXbbYO3XFE4uh9nVW5GJZ2tNYLj8MfsWwBv8L79Vd:YTKY+XbbYT4uhFVzYKj86sWK87rd

Score

6^/10

bootkit persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	2ad1f2f3b4b2b535d1948448db0bfeba_JaffaCakes118.exe

Modifies registry class 3 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	2ad1f2f3b4b2b535d1948448db0bfeba_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	2ad1f2f3b4b2b535d1948448db0bfeba_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	2ad1f2f3b4b2b535d1948448db0bfeba_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2244	2ad1f2f3b4b2b535d1948448db0bfeba_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2244 wrote to memory of 1376	2244	2ad1f2f3b4b2b535d1948448db0bfeba_JaffaCakes118.exe	20
PID 2244 wrote to memory of 1376	2244	2ad1f2f3b4b2b535d1948448db0bfeba_JaffaCakes118.exe	20
PID 2244 wrote to memory of 1376	2244	2ad1f2f3b4b2b535d1948448db0bfeba_JaffaCakes118.exe	20
PID 2244 wrote to memory of 1376	2244	2ad1f2f3b4b2b535d1948448db0bfeba_JaffaCakes118.exe	20
PID 2244 wrote to memory of 1376	2244	2ad1f2f3b4b2b535d1948448db0bfeba_JaffaCakes118.exe	20
PID 2244 wrote to memory of 1376	2244	2ad1f2f3b4b2b535d1948448db0bfeba_JaffaCakes118.exe	20

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1376
- C:\Users\Admin\AppData\Local\Temp\2ad1f2f3b4b2b535d1948448db0bfeba_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\2ad1f2f3b4b2b535d1948448db0bfeba_JaffaCakes118.exe"
  2⤵
  - Writes to the Master Boot Record (MBR)
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2244

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1376-38-0x000000007EFC0000-0x000000007EFC6000-memory.dmp

Filesize
24KB

Download
memory/2244-16-0x0000000001F50000-0x0000000001F51000-memory.dmp

Filesize
4KB

Download
memory/2244-14-0x0000000001F50000-0x0000000001F51000-memory.dmp

Filesize
4KB

Download
memory/2244-30-0x00000000004C0000-0x00000000004C1000-memory.dmp

Filesize
4KB

Download
memory/2244-29-0x00000000004D0000-0x00000000004D1000-memory.dmp

Filesize
4KB

Download
memory/2244-28-0x00000000004A0000-0x00000000004A1000-memory.dmp

Filesize
4KB

Download
memory/2244-27-0x00000000004B0000-0x00000000004B1000-memory.dmp

Filesize
4KB

Download
memory/2244-26-0x0000000001F20000-0x0000000001F21000-memory.dmp

Filesize
4KB

Download
memory/2244-25-0x0000000001F30000-0x0000000001F31000-memory.dmp

Filesize
4KB

Download
memory/2244-24-0x0000000000500000-0x0000000000501000-memory.dmp

Filesize
4KB

Download
memory/2244-23-0x0000000000510000-0x0000000000511000-memory.dmp

Filesize
4KB

Download
memory/2244-13-0x0000000001F50000-0x0000000001F51000-memory.dmp

Filesize
4KB

Download
memory/2244-20-0x00000000003D0000-0x00000000003D1000-memory.dmp

Filesize
4KB

Download
memory/2244-19-0x0000000000300000-0x0000000000301000-memory.dmp

Filesize
4KB

Download
memory/2244-18-0x0000000001F40000-0x0000000001F41000-memory.dmp

Filesize
4KB

Download
memory/2244-17-0x0000000001F50000-0x0000000001F51000-memory.dmp

Filesize
4KB

Download
memory/2244-0-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/2244-31-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download
memory/2244-15-0x0000000001F50000-0x0000000001F51000-memory.dmp

Filesize
4KB

Download
memory/2244-22-0x00000000004E0000-0x00000000004E1000-memory.dmp

Filesize
4KB

Download
memory/2244-12-0x0000000001F50000-0x0000000001F51000-memory.dmp

Filesize
4KB

Download
memory/2244-11-0x0000000001F50000-0x0000000001F51000-memory.dmp

Filesize
4KB

Download
memory/2244-10-0x0000000001F50000-0x0000000001F51000-memory.dmp

Filesize
4KB

Download
memory/2244-9-0x0000000001F50000-0x0000000001F51000-memory.dmp

Filesize
4KB

Download
memory/2244-8-0x0000000001F50000-0x0000000001F51000-memory.dmp

Filesize
4KB

Download
memory/2244-7-0x0000000001F50000-0x0000000001F51000-memory.dmp

Filesize
4KB

Download
memory/2244-6-0x0000000001F50000-0x0000000001F51000-memory.dmp

Filesize
4KB

Download
memory/2244-5-0x0000000001F50000-0x0000000001F51000-memory.dmp

Filesize
4KB

Download
memory/2244-4-0x0000000001F50000-0x0000000001F51000-memory.dmp

Filesize
4KB

Download
memory/2244-3-0x0000000001F50000-0x0000000001F51000-memory.dmp

Filesize
4KB

Download
memory/2244-2-0x0000000001F40000-0x0000000001F41000-memory.dmp

Filesize
4KB

Download
memory/2244-1-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/2244-21-0x00000000004F0000-0x00000000004F1000-memory.dmp

Filesize
4KB

Download
memory/2244-50-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/2244-51-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads