4523c1b93f87e021ade98f1aad52e1c842af5209ecb429c0e61576b6238640cf

General

Target

40e466dcfb9d45124119384a5653184e_JaffaCakes118.exe
Size

155KB
MD5

40e466dcfb9d45124119384a5653184e
SHA1

47f13106ae50687aa6c32dda1c7dfc4a2e446757
SHA256

4523c1b93f87e021ade98f1aad52e1c842af5209ecb429c0e61576b6238640cf
SHA512

1c32237d6fb8c776b9a30a8dc8dc5377715d47f549d88c4e8f83dc174309d7408041896b4352c6748b421506d44969fb308a4ad8b7b111f7e80c65f4ee256fc1
SSDEEP

3072:oT1/vjai+j6RmtzBSfQ2HtnIbbrMbvT0q8O1cZPzQ7IXMBc+AMP+QfQEhxFyVU7a:o0j6ezBCQ2wwvP6bQ7yMP+DE827Rsk4

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2720	cmd.exe

Modifies WinLogon 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify	40e466dcfb9d45124119384a5653184e_JaffaCakes118.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	40e466dcfb9d45124119384a5653184e_JaffaCakes118.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\fsmgmt.dll	40e466dcfb9d45124119384a5653184e_JaffaCakes118.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	40e466dcfb9d45124119384a5653184e_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	40e466dcfb9d45124119384a5653184e_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	40e466dcfb9d45124119384a5653184e_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeBackupPrivilege	2012	40e466dcfb9d45124119384a5653184e_JaffaCakes118.exe
Token: SeRestorePrivilege	2012	40e466dcfb9d45124119384a5653184e_JaffaCakes118.exe
Token: SeBackupPrivilege	2012	40e466dcfb9d45124119384a5653184e_JaffaCakes118.exe
Token: SeRestorePrivilege	2012	40e466dcfb9d45124119384a5653184e_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 1256	2012	40e466dcfb9d45124119384a5653184e_JaffaCakes118.exe	21
PID 2012 wrote to memory of 2720	2012	40e466dcfb9d45124119384a5653184e_JaffaCakes118.exe	31
PID 2012 wrote to memory of 2720	2012	40e466dcfb9d45124119384a5653184e_JaffaCakes118.exe	31
PID 2012 wrote to memory of 2720	2012	40e466dcfb9d45124119384a5653184e_JaffaCakes118.exe	31
PID 2012 wrote to memory of 2720	2012	40e466dcfb9d45124119384a5653184e_JaffaCakes118.exe	31

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1256
- C:\Users\Admin\AppData\Local\Temp\40e466dcfb9d45124119384a5653184e_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\40e466dcfb9d45124119384a5653184e_JaffaCakes118.exe"
  2⤵
  - Modifies WinLogon
  - Writes to the Master Boot Record (MBR)
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2012
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\DeleteMe.bat
    3⤵
    - Deletes itself
    PID:2720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\DeleteMe.bat

Filesize
237B

MD5
873e2ee1f24aedeec6309c7451de9896

SHA1
16b1206b2424f1d07c84a9874634e16ed1b73263

SHA256
5d06fa1ab022daee1aa8e04230b21df6d9cfa92ef74ebc3ad298190471844d72

SHA512
582e71e0a63f540f1d6be8767c01043e46d262e41a5784f14f23c6976c988eabb800eac89ad6a3157b1cacd6bb996c41dc4db11c314a8cc48116996f511ba696

Download Submit
memory/1256-11-0x0000000002710000-0x0000000002711000-memory.dmp

Filesize
4KB

Download
memory/2012-5-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2012-8-0x00000000002B0000-0x00000000002B1000-memory.dmp

Filesize
4KB

Download
memory/2012-7-0x00000000002C0000-0x00000000002C1000-memory.dmp

Filesize
4KB

Download
memory/2012-6-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2012-0-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2012-4-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/2012-3-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2012-2-0x0000000000280000-0x0000000000282000-memory.dmp

Filesize
8KB

Download
memory/2012-9-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/2012-1-0x0000000000250000-0x0000000000280000-memory.dmp

Filesize
192KB

Download
memory/2012-20-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2012-21-0x0000000000250000-0x0000000000280000-memory.dmp

Filesize
192KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads