f178e94e09564ded2bc619b2a3a80ebd29be5b6e30fa446d16465505359e19fc

General

Target

30187df5048190715cbdb08137f81e23_JaffaCakes118.exe
Size

3.3MB
MD5

30187df5048190715cbdb08137f81e23
SHA1

1933d1db4d48c481348a6d08b23ad314e7176156
SHA256

f178e94e09564ded2bc619b2a3a80ebd29be5b6e30fa446d16465505359e19fc
SHA512

1f2cf14de8833000159d11e16726b9a3fbc038283791c9408ec538d1e4a810b3b87189151166b97bd96e131f00074252c0cbb2a6927071b76c6bcaa9903b0644
SSDEEP

98304:EQm/xhU827iAIHKvXcxRcXUaRaGPO+yzQai:EQm8/3CUXcbqRaGm7zO

Score

7^/10

bootkit evasion persistence trojan

Malware Config

Signatures

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Wine	30187df5048190715cbdb08137f81e23_JaffaCakes118.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	30187df5048190715cbdb08137f81e23_JaffaCakes118.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	30187df5048190715cbdb08137f81e23_JaffaCakes118.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1748	30187df5048190715cbdb08137f81e23_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1748	30187df5048190715cbdb08137f81e23_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1748	30187df5048190715cbdb08137f81e23_JaffaCakes118.exe
1748	30187df5048190715cbdb08137f81e23_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\30187df5048190715cbdb08137f81e23_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\30187df5048190715cbdb08137f81e23_JaffaCakes118.exe"
1⤵
- Identifies Wine through registry keys
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Virtualization/Sandbox Evasion

1

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1748-0-0x0000000000400000-0x00000000014E2000-memory.dmp

Filesize
16.9MB

Download
memory/1748-1-0x0000000000401000-0x000000000065D000-memory.dmp

Filesize
2.4MB

Download
memory/1748-2-0x0000000000400000-0x00000000014E2000-memory.dmp

Filesize
16.9MB

Download
memory/1748-3-0x0000000000400000-0x00000000014E2000-memory.dmp

Filesize
16.9MB

Download
memory/1748-4-0x0000000000400000-0x00000000014E2000-memory.dmp

Filesize
16.9MB

Download
memory/1748-5-0x0000000000400000-0x00000000014E2000-memory.dmp

Filesize
16.9MB

Download
memory/1748-6-0x0000000000400000-0x00000000014E2000-memory.dmp

Filesize
16.9MB

Download
memory/1748-7-0x0000000000400000-0x00000000014E2000-memory.dmp

Filesize
16.9MB

Download
memory/1748-8-0x0000000000400000-0x00000000014E2000-memory.dmp

Filesize
16.9MB

Download
memory/1748-9-0x0000000000400000-0x00000000014E2000-memory.dmp

Filesize
16.9MB

Download
memory/1748-10-0x0000000000400000-0x00000000014E2000-memory.dmp

Filesize
16.9MB

Download
memory/1748-11-0x0000000000400000-0x00000000014E2000-memory.dmp

Filesize
16.9MB

Download
memory/1748-12-0x0000000000400000-0x00000000014E2000-memory.dmp

Filesize
16.9MB

Download
memory/1748-13-0x0000000000400000-0x00000000014E2000-memory.dmp

Filesize
16.9MB

Download
memory/1748-14-0x0000000000400000-0x00000000014E2000-memory.dmp

Filesize
16.9MB

Download
memory/1748-15-0x0000000000400000-0x00000000014E2000-memory.dmp

Filesize
16.9MB

Download
memory/1748-16-0x0000000000400000-0x00000000014E2000-memory.dmp

Filesize
16.9MB

Download
memory/1748-17-0x0000000000400000-0x00000000014E2000-memory.dmp

Filesize
16.9MB

Download
memory/1748-18-0x0000000000400000-0x00000000014E2000-memory.dmp

Filesize
16.9MB

Download
memory/1748-19-0x0000000000400000-0x00000000014E2000-memory.dmp

Filesize
16.9MB

Download
memory/1748-20-0x0000000000400000-0x00000000014E2000-memory.dmp

Filesize
16.9MB

Download
memory/1748-21-0x0000000000400000-0x00000000014E2000-memory.dmp

Filesize
16.9MB

Download
memory/1748-22-0x0000000000400000-0x00000000014E2000-memory.dmp

Filesize
16.9MB

Download
memory/1748-23-0x0000000000400000-0x00000000014E2000-memory.dmp

Filesize
16.9MB

Download
memory/1748-24-0x0000000000400000-0x00000000014E2000-memory.dmp

Filesize
16.9MB

Download
memory/1748-25-0x0000000000400000-0x00000000014E2000-memory.dmp

Filesize
16.9MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads