43a429f299010901a38d826f1259f3d671a3d22b86269f2db797aadb2268871a

General

Target

2aff309cabf3a3719f176c3eabda5a97_JaffaCakes118.exe
Size

226KB
MD5

2aff309cabf3a3719f176c3eabda5a97
SHA1

cb0b130ee18f575a8911f43a9dd81bf6cf28024a
SHA256

43a429f299010901a38d826f1259f3d671a3d22b86269f2db797aadb2268871a
SHA512

56925a4f2ec0d4bfe442837612a10dd112a60d03d7918992abd0ecc8380415021e01788fe8f4f2177e09d483cd94ac7f826d9da177566dd185276f620dcea137
SSDEEP

6144:/Uwep/Pi1Thqvyy4s2BR9W2FtjXwcCOJvq:MxNi1TKyy4s282Ftjgc1vq

Score

6^/10

bootkit persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	2aff309cabf3a3719f176c3eabda5a97_JaffaCakes118.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2452 set thread context of 2668	2452	2aff309cabf3a3719f176c3eabda5a97_JaffaCakes118.exe	28
PID 2668 set thread context of 2508	2668	2aff309cabf3a3719f176c3eabda5a97_JaffaCakes118.exe	29

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2668	2aff309cabf3a3719f176c3eabda5a97_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2452 wrote to memory of 2668	2452	2aff309cabf3a3719f176c3eabda5a97_JaffaCakes118.exe	28
PID 2452 wrote to memory of 2668	2452	2aff309cabf3a3719f176c3eabda5a97_JaffaCakes118.exe	28
PID 2452 wrote to memory of 2668	2452	2aff309cabf3a3719f176c3eabda5a97_JaffaCakes118.exe	28
PID 2452 wrote to memory of 2668	2452	2aff309cabf3a3719f176c3eabda5a97_JaffaCakes118.exe	28
PID 2452 wrote to memory of 2668	2452	2aff309cabf3a3719f176c3eabda5a97_JaffaCakes118.exe	28
PID 2452 wrote to memory of 2668	2452	2aff309cabf3a3719f176c3eabda5a97_JaffaCakes118.exe	28
PID 2668 wrote to memory of 2508	2668	2aff309cabf3a3719f176c3eabda5a97_JaffaCakes118.exe	29
PID 2668 wrote to memory of 2508	2668	2aff309cabf3a3719f176c3eabda5a97_JaffaCakes118.exe	29
PID 2668 wrote to memory of 2508	2668	2aff309cabf3a3719f176c3eabda5a97_JaffaCakes118.exe	29
PID 2668 wrote to memory of 2508	2668	2aff309cabf3a3719f176c3eabda5a97_JaffaCakes118.exe	29
PID 2668 wrote to memory of 2508	2668	2aff309cabf3a3719f176c3eabda5a97_JaffaCakes118.exe	29
PID 2668 wrote to memory of 2508	2668	2aff309cabf3a3719f176c3eabda5a97_JaffaCakes118.exe	29
PID 2668 wrote to memory of 2508	2668	2aff309cabf3a3719f176c3eabda5a97_JaffaCakes118.exe	29
PID 2668 wrote to memory of 2508	2668	2aff309cabf3a3719f176c3eabda5a97_JaffaCakes118.exe	29
PID 2668 wrote to memory of 2508	2668	2aff309cabf3a3719f176c3eabda5a97_JaffaCakes118.exe	29
PID 2668 wrote to memory of 2508	2668	2aff309cabf3a3719f176c3eabda5a97_JaffaCakes118.exe	29
PID 2508 wrote to memory of 1192	2508	2aff309cabf3a3719f176c3eabda5a97_JaffaCakes118.exe	21
PID 2508 wrote to memory of 1192	2508	2aff309cabf3a3719f176c3eabda5a97_JaffaCakes118.exe	21

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1192
- C:\Users\Admin\AppData\Local\Temp\2aff309cabf3a3719f176c3eabda5a97_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\2aff309cabf3a3719f176c3eabda5a97_JaffaCakes118.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2452
- - C:\Users\Admin\AppData\Local\Temp\2aff309cabf3a3719f176c3eabda5a97_JaffaCakes118.exe
    C:\Users\Admin\AppData\Local\Temp\2aff309cabf3a3719f176c3eabda5a97_JaffaCakes118.exe
    3⤵
    - Writes to the Master Boot Record (MBR)
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2668
  - - C:\Users\Admin\AppData\Local\Temp\2aff309cabf3a3719f176c3eabda5a97_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\2aff309cabf3a3719f176c3eabda5a97_JaffaCakes118.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2508

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1192-30-0x00000000025C0000-0x00000000025CE000-memory.dmp

Filesize
56KB

Download
memory/1192-29-0x00000000025C0000-0x00000000025CE000-memory.dmp

Filesize
56KB

Download
memory/2452-9-0x0000000001C60000-0x0000000001C9C000-memory.dmp

Filesize
240KB

Download
memory/2452-8-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2452-0-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2508-28-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2508-17-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2508-13-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2508-22-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2508-20-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2508-26-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2508-31-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2508-33-0x0000000000401000-0x0000000000408000-memory.dmp

Filesize
28KB

Download
memory/2508-15-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2668-3-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2668-5-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2668-1-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2668-19-0x0000000000230000-0x000000000026C000-memory.dmp

Filesize
240KB

Download
memory/2668-10-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2668-36-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads