f178e94e09564ded2bc619b2a3a80ebd29be5b6e30fa446d16465505359e19fc

Analysis

max time kernel
140s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
09/07/2024, 10:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

30187df5048190715cbdb08137f81e23_JaffaCakes118.exe
Size

3.3MB
MD5

30187df5048190715cbdb08137f81e23
SHA1

1933d1db4d48c481348a6d08b23ad314e7176156
SHA256

f178e94e09564ded2bc619b2a3a80ebd29be5b6e30fa446d16465505359e19fc
SHA512

1f2cf14de8833000159d11e16726b9a3fbc038283791c9408ec538d1e4a810b3b87189151166b97bd96e131f00074252c0cbb2a6927071b76c6bcaa9903b0644
SSDEEP

98304:EQm/xhU827iAIHKvXcxRcXUaRaGPO+yzQai:EQm8/3CUXcbqRaGm7zO

Score

7^/10

bootkit evasion persistence trojan

Malware Config

Signatures

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1015551233-1106003478-1645743776-1000\Software\Wine	30187df5048190715cbdb08137f81e23_JaffaCakes118.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	30187df5048190715cbdb08137f81e23_JaffaCakes118.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	30187df5048190715cbdb08137f81e23_JaffaCakes118.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
3928	30187df5048190715cbdb08137f81e23_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3928	30187df5048190715cbdb08137f81e23_JaffaCakes118.exe
3928	30187df5048190715cbdb08137f81e23_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3928	30187df5048190715cbdb08137f81e23_JaffaCakes118.exe
3928	30187df5048190715cbdb08137f81e23_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\30187df5048190715cbdb08137f81e23_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\30187df5048190715cbdb08137f81e23_JaffaCakes118.exe"
1⤵
- Identifies Wine through registry keys
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3928-0-0x0000000000400000-0x00000000014E2000-memory.dmp

Filesize
16.9MB

Download
memory/3928-1-0x0000000000401000-0x000000000065D000-memory.dmp

Filesize
2.4MB

Download
memory/3928-2-0x0000000000400000-0x00000000014E2000-memory.dmp

Filesize
16.9MB

Download
memory/3928-3-0x0000000000400000-0x00000000014E2000-memory.dmp

Filesize
16.9MB

Download
memory/3928-4-0x0000000000400000-0x00000000014E2000-memory.dmp

Filesize
16.9MB

Download
memory/3928-5-0x0000000000400000-0x00000000014E2000-memory.dmp

Filesize
16.9MB

Download
memory/3928-6-0x0000000000400000-0x00000000014E2000-memory.dmp

Filesize
16.9MB

Download
memory/3928-7-0x0000000000400000-0x00000000014E2000-memory.dmp

Filesize
16.9MB

Download
memory/3928-8-0x0000000000400000-0x00000000014E2000-memory.dmp

Filesize
16.9MB

Download
memory/3928-9-0x0000000000400000-0x00000000014E2000-memory.dmp

Filesize
16.9MB

Download
memory/3928-10-0x0000000000400000-0x00000000014E2000-memory.dmp

Filesize
16.9MB

Download
memory/3928-11-0x0000000000400000-0x00000000014E2000-memory.dmp

Filesize
16.9MB

Download
memory/3928-12-0x0000000000400000-0x00000000014E2000-memory.dmp

Filesize
16.9MB

Download
memory/3928-13-0x0000000000400000-0x00000000014E2000-memory.dmp

Filesize
16.9MB

Download
memory/3928-14-0x0000000000400000-0x00000000014E2000-memory.dmp

Filesize
16.9MB

Download
memory/3928-15-0x0000000000400000-0x00000000014E2000-memory.dmp

Filesize
16.9MB

Download
memory/3928-16-0x0000000000400000-0x00000000014E2000-memory.dmp

Filesize
16.9MB

Download
memory/3928-17-0x0000000000400000-0x00000000014E2000-memory.dmp

Filesize
16.9MB

Download
memory/3928-18-0x0000000000400000-0x00000000014E2000-memory.dmp

Filesize
16.9MB

Download
memory/3928-19-0x0000000000400000-0x00000000014E2000-memory.dmp

Filesize
16.9MB

Download
memory/3928-20-0x0000000000400000-0x00000000014E2000-memory.dmp

Filesize
16.9MB

Download
memory/3928-21-0x0000000000400000-0x00000000014E2000-memory.dmp

Filesize
16.9MB

Download
memory/3928-22-0x0000000000400000-0x00000000014E2000-memory.dmp

Filesize
16.9MB

Download
memory/3928-23-0x0000000000400000-0x00000000014E2000-memory.dmp

Filesize
16.9MB

Download
memory/3928-24-0x0000000000400000-0x00000000014E2000-memory.dmp

Filesize
16.9MB

Download
memory/3928-25-0x0000000000400000-0x00000000014E2000-memory.dmp

Filesize
16.9MB

Download
memory/3928-26-0x0000000000400000-0x00000000014E2000-memory.dmp

Filesize
16.9MB

Download
memory/3928-27-0x0000000000400000-0x00000000014E2000-memory.dmp

Filesize
16.9MB

Download
memory/3928-28-0x0000000000400000-0x00000000014E2000-memory.dmp

Filesize
16.9MB

Download
memory/3928-29-0x0000000000400000-0x00000000014E2000-memory.dmp

Filesize
16.9MB

Download
memory/3928-30-0x0000000000400000-0x00000000014E2000-memory.dmp

Filesize
16.9MB

Download
memory/3928-31-0x0000000000400000-0x00000000014E2000-memory.dmp

Filesize
16.9MB

Download
memory/3928-32-0x0000000000400000-0x00000000014E2000-memory.dmp

Filesize
16.9MB

Download
memory/3928-33-0x0000000000400000-0x00000000014E2000-memory.dmp

Filesize
16.9MB

Download
memory/3928-34-0x0000000000400000-0x00000000014E2000-memory.dmp

Filesize
16.9MB

Download
memory/3928-35-0x0000000000400000-0x00000000014E2000-memory.dmp

Filesize
16.9MB

Download
memory/3928-36-0x0000000000400000-0x00000000014E2000-memory.dmp

Filesize
16.9MB

Download