dded610274cae6b30e5978520f8fd2a9a915e347bf7cd7dab37ff077049d2f5f

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
11/07/2024, 05:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

37eeefc678cbdded1c7798d10c286f18_JaffaCakes118.exe
Size

331KB
MD5

37eeefc678cbdded1c7798d10c286f18
SHA1

dd8673023ae6855c7f7f09aef2b131ed1be685af
SHA256

dded610274cae6b30e5978520f8fd2a9a915e347bf7cd7dab37ff077049d2f5f
SHA512

21f6f17b551b1c2df3687e60906aaf75286900748d26bd5966f6d83273837305755cc7049b15d4207423b90bbb0afb892bd071d766261eb3cf77b18d7d837fe0
SSDEEP

6144:i1glyu6VrzBUNCK70gqMk+qJdh4HzyYtsFM24TyQOGoQbwyUx/F8pKMOO9io:i59BUNCK7l5qJIGYtsSvT0SuCtOS

Score

8^/10

bootkit persistence upx

Malware Config

Signatures

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\SysWOW64\drivers\XsxWrAM.exe	37eeefc678cbdded1c7798d10c286f18_JaffaCakes118.exe
File opened for modification	C:\WINDOWS\SysWOW64\drivers\XsxWrAM.exe	37eeefc678cbdded1c7798d10c286f18_JaffaCakes118.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2808-32-0x0000000000400000-0x0000000000472000-memory.dmp	upx
behavioral1/memory/2808-33-0x0000000000400000-0x0000000000472000-memory.dmp	upx
behavioral1/memory/2808-35-0x0000000000400000-0x0000000000472000-memory.dmp	upx
behavioral1/memory/2808-62-0x0000000000400000-0x0000000000472000-memory.dmp	upx

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	37eeefc678cbdded1c7798d10c286f18_JaffaCakes118.exe

Drops autorun.inf file 1 TTPs 18 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	\??\A:\autorun.inf	37eeefc678cbdded1c7798d10c286f18_JaffaCakes118.exe
File opened for modification	\??\G:\autorun.inf	37eeefc678cbdded1c7798d10c286f18_JaffaCakes118.exe
File opened for modification	\??\H:\autorun.inf	37eeefc678cbdded1c7798d10c286f18_JaffaCakes118.exe
File opened for modification	\??\Y:\autorun.inf	37eeefc678cbdded1c7798d10c286f18_JaffaCakes118.exe
File opened for modification	C:\autorun.inf	37eeefc678cbdded1c7798d10c286f18_JaffaCakes118.exe
File opened for modification	D:\autorun.inf	37eeefc678cbdded1c7798d10c286f18_JaffaCakes118.exe
File opened for modification	F:\autorun.inf	37eeefc678cbdded1c7798d10c286f18_JaffaCakes118.exe
File opened for modification	\??\i:\autorun.inf	37eeefc678cbdded1c7798d10c286f18_JaffaCakes118.exe
File opened for modification	\??\N:\autorun.inf	37eeefc678cbdded1c7798d10c286f18_JaffaCakes118.exe
File opened for modification	\??\B:\autorun.inf	37eeefc678cbdded1c7798d10c286f18_JaffaCakes118.exe
File opened for modification	\??\M:\autorun.inf	37eeefc678cbdded1c7798d10c286f18_JaffaCakes118.exe
File opened for modification	\??\P:\autorun.inf	37eeefc678cbdded1c7798d10c286f18_JaffaCakes118.exe
File opened for modification	\??\R:\autorun.inf	37eeefc678cbdded1c7798d10c286f18_JaffaCakes118.exe
File opened for modification	\??\E:\autorun.inf	37eeefc678cbdded1c7798d10c286f18_JaffaCakes118.exe
File opened for modification	\??\J:\autorun.inf	37eeefc678cbdded1c7798d10c286f18_JaffaCakes118.exe
File opened for modification	\??\K:\autorun.inf	37eeefc678cbdded1c7798d10c286f18_JaffaCakes118.exe
File opened for modification	\??\L:\autorun.inf	37eeefc678cbdded1c7798d10c286f18_JaffaCakes118.exe
File opened for modification	\??\O:\autorun.inf	37eeefc678cbdded1c7798d10c286f18_JaffaCakes118.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\SysWOW64\XsxWrAM.exe	37eeefc678cbdded1c7798d10c286f18_JaffaCakes118.exe
File opened for modification	C:\WINDOWS\SysWOW64\XsxWrAM.exe	37eeefc678cbdded1c7798d10c286f18_JaffaCakes118.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2288 set thread context of 2808	2288	37eeefc678cbdded1c7798d10c286f18_JaffaCakes118.exe	30
PID 2288 set thread context of 0	2288	37eeefc678cbdded1c7798d10c286f18_JaffaCakes118.exe
PID 2808 set thread context of 2672	2808	37eeefc678cbdded1c7798d10c286f18_JaffaCakes118.exe	31

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File created	C:\Program Files\Messenger\XsxWrAM.exe	37eeefc678cbdded1c7798d10c286f18_JaffaCakes118.exe
File created	C:\Program Files\Internet Download Manager\XsxWrAM.exe	37eeefc678cbdded1c7798d10c286f18_JaffaCakes118.exe
File created	C:\Program Files\XsxWrAM.exe	37eeefc678cbdded1c7798d10c286f18_JaffaCakes118.exe
File opened for modification	C:\Program Files\XsxWrAM.exe	37eeefc678cbdded1c7798d10c286f18_JaffaCakes118.exe
File created	C:\Program Files\WinRAR\XsxWrAM.exe	37eeefc678cbdded1c7798d10c286f18_JaffaCakes118.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\WINDOWS\XsxWrAM.exe	37eeefc678cbdded1c7798d10c286f18_JaffaCakes118.exe
File opened for modification	C:\WINDOWS\XsxWrAM.exe	37eeefc678cbdded1c7798d10c286f18_JaffaCakes118.exe
File created	C:\WINDOWS\Help\XsxWrAM.exe	37eeefc678cbdded1c7798d10c286f18_JaffaCakes118.exe
File opened for modification	C:\WINDOWS\Help\XsxWrAM.exe	37eeefc678cbdded1c7798d10c286f18_JaffaCakes118.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	37eeefc678cbdded1c7798d10c286f18_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	37eeefc678cbdded1c7798d10c286f18_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	37eeefc678cbdded1c7798d10c286f18_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2672	37eeefc678cbdded1c7798d10c286f18_JaffaCakes118.exe
2672	37eeefc678cbdded1c7798d10c286f18_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2288	37eeefc678cbdded1c7798d10c286f18_JaffaCakes118.exe
2808	37eeefc678cbdded1c7798d10c286f18_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 2288 wrote to memory of 2808	2288	37eeefc678cbdded1c7798d10c286f18_JaffaCakes118.exe	30
PID 2288 wrote to memory of 2808	2288	37eeefc678cbdded1c7798d10c286f18_JaffaCakes118.exe	30
PID 2288 wrote to memory of 2808	2288	37eeefc678cbdded1c7798d10c286f18_JaffaCakes118.exe	30
PID 2288 wrote to memory of 2808	2288	37eeefc678cbdded1c7798d10c286f18_JaffaCakes118.exe	30
PID 2288 wrote to memory of 2808	2288	37eeefc678cbdded1c7798d10c286f18_JaffaCakes118.exe	30
PID 2288 wrote to memory of 2808	2288	37eeefc678cbdded1c7798d10c286f18_JaffaCakes118.exe	30
PID 2288 wrote to memory of 2808	2288	37eeefc678cbdded1c7798d10c286f18_JaffaCakes118.exe	30
PID 2288 wrote to memory of 2808	2288	37eeefc678cbdded1c7798d10c286f18_JaffaCakes118.exe	30
PID 2288 wrote to memory of 2808	2288	37eeefc678cbdded1c7798d10c286f18_JaffaCakes118.exe	30
PID 2288 wrote to memory of 0	2288	37eeefc678cbdded1c7798d10c286f18_JaffaCakes118.exe
PID 2288 wrote to memory of 0	2288	37eeefc678cbdded1c7798d10c286f18_JaffaCakes118.exe
PID 2288 wrote to memory of 0	2288	37eeefc678cbdded1c7798d10c286f18_JaffaCakes118.exe
PID 2288 wrote to memory of 0	2288	37eeefc678cbdded1c7798d10c286f18_JaffaCakes118.exe
PID 2288 wrote to memory of 0	2288	37eeefc678cbdded1c7798d10c286f18_JaffaCakes118.exe
PID 2808 wrote to memory of 2672	2808	37eeefc678cbdded1c7798d10c286f18_JaffaCakes118.exe	31
PID 2808 wrote to memory of 2672	2808	37eeefc678cbdded1c7798d10c286f18_JaffaCakes118.exe	31
PID 2808 wrote to memory of 2672	2808	37eeefc678cbdded1c7798d10c286f18_JaffaCakes118.exe	31
PID 2808 wrote to memory of 2672	2808	37eeefc678cbdded1c7798d10c286f18_JaffaCakes118.exe	31
PID 2808 wrote to memory of 2672	2808	37eeefc678cbdded1c7798d10c286f18_JaffaCakes118.exe	31
PID 2808 wrote to memory of 2672	2808	37eeefc678cbdded1c7798d10c286f18_JaffaCakes118.exe	31
PID 2808 wrote to memory of 2672	2808	37eeefc678cbdded1c7798d10c286f18_JaffaCakes118.exe	31
PID 2808 wrote to memory of 2672	2808	37eeefc678cbdded1c7798d10c286f18_JaffaCakes118.exe	31
PID 2672 wrote to memory of 1228	2672	37eeefc678cbdded1c7798d10c286f18_JaffaCakes118.exe	21
PID 2672 wrote to memory of 1228	2672	37eeefc678cbdded1c7798d10c286f18_JaffaCakes118.exe	21
PID 2672 wrote to memory of 1228	2672	37eeefc678cbdded1c7798d10c286f18_JaffaCakes118.exe	21
PID 2672 wrote to memory of 1228	2672	37eeefc678cbdded1c7798d10c286f18_JaffaCakes118.exe	21

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1228
- C:\Users\Admin\AppData\Local\Temp\37eeefc678cbdded1c7798d10c286f18_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\37eeefc678cbdded1c7798d10c286f18_JaffaCakes118.exe"
  2⤵
  - Drops file in Drivers directory
  - Writes to the Master Boot Record (MBR)
  - Drops autorun.inf file
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2288
- - C:\Users\Admin\AppData\Local\Temp\37eeefc678cbdded1c7798d10c286f18_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\37eeefc678cbdded1c7798d10c286f18_JaffaCakes118.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2808
  - - C:\Users\Admin\AppData\Local\Temp\37eeefc678cbdded1c7798d10c286f18_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\37eeefc678cbdded1c7798d10c286f18_JaffaCakes118.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\XsxWrAM.exe

Filesize
331KB

MD5
37eeefc678cbdded1c7798d10c286f18

SHA1
dd8673023ae6855c7f7f09aef2b131ed1be685af

SHA256
dded610274cae6b30e5978520f8fd2a9a915e347bf7cd7dab37ff077049d2f5f

SHA512
21f6f17b551b1c2df3687e60906aaf75286900748d26bd5966f6d83273837305755cc7049b15d4207423b90bbb0afb892bd071d766261eb3cf77b18d7d837fe0

Download Submit
memory/1228-65-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/2288-22-0x00000000005D0000-0x00000000005D1000-memory.dmp

Filesize
4KB

Download
memory/2288-25-0x00000000007E0000-0x00000000007E1000-memory.dmp

Filesize
4KB

Download
memory/2288-1-0x0000000000390000-0x0000000000393000-memory.dmp

Filesize
12KB

Download
memory/2288-0-0x0000000000400000-0x0000000000513000-memory.dmp

Filesize
1.1MB

Download
memory/2288-8-0x0000000000380000-0x0000000000381000-memory.dmp

Filesize
4KB

Download
memory/2288-9-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/2288-10-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2288-11-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2288-12-0x00000000003C0000-0x00000000003C1000-memory.dmp

Filesize
4KB

Download
memory/2288-13-0x0000000000520000-0x0000000000521000-memory.dmp

Filesize
4KB

Download
memory/2288-14-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/2288-15-0x0000000000540000-0x0000000000541000-memory.dmp

Filesize
4KB

Download
memory/2288-16-0x0000000000530000-0x0000000000531000-memory.dmp

Filesize
4KB

Download
memory/2288-17-0x0000000000560000-0x0000000000561000-memory.dmp

Filesize
4KB

Download
memory/2288-18-0x0000000000550000-0x0000000000551000-memory.dmp

Filesize
4KB

Download
memory/2288-19-0x0000000000580000-0x0000000000581000-memory.dmp

Filesize
4KB

Download
memory/2288-20-0x0000000000570000-0x0000000000571000-memory.dmp

Filesize
4KB

Download
memory/2288-21-0x0000000000760000-0x0000000000761000-memory.dmp

Filesize
4KB

Download
memory/2288-5-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/2288-23-0x0000000000780000-0x0000000000781000-memory.dmp

Filesize
4KB

Download
memory/2288-2-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/2288-26-0x00000000007D0000-0x00000000007D1000-memory.dmp

Filesize
4KB

Download
memory/2288-24-0x0000000000770000-0x0000000000771000-memory.dmp

Filesize
4KB

Download
memory/2288-27-0x0000000000800000-0x0000000000801000-memory.dmp

Filesize
4KB

Download
memory/2288-28-0x00000000007F0000-0x00000000007F1000-memory.dmp

Filesize
4KB

Download
memory/2288-29-0x0000000000820000-0x0000000000821000-memory.dmp

Filesize
4KB

Download
memory/2288-30-0x0000000000810000-0x0000000000811000-memory.dmp

Filesize
4KB

Download
memory/2288-31-0x0000000004F80000-0x0000000005093000-memory.dmp

Filesize
1.1MB

Download
memory/2288-4-0x0000000000520000-0x0000000000521000-memory.dmp

Filesize
4KB

Download
memory/2288-57-0x0000000000400000-0x0000000000513000-memory.dmp

Filesize
1.1MB

Download
memory/2288-3-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/2672-58-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2672-59-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2672-64-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/2672-77-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2808-35-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/2808-33-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/2808-62-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/2808-63-0x0000000002890000-0x00000000029A3000-memory.dmp

Filesize
1.1MB

Download
memory/2808-32-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/2808-79-0x0000000002890000-0x00000000029A3000-memory.dmp

Filesize
1.1MB

Download