4244728855560a89e8a4c10ad3c54d1139a0e70e198466d0f864b6083ebdc8de

Reason

Machine shutdown

General

Target

4b1ea697709b01387c828930fcdae181_JaffaCakes118.exe
Size

51KB
MD5

4b1ea697709b01387c828930fcdae181
SHA1

168b0ab8819d80526ae1639e31c4b2b05be61527
SHA256

4244728855560a89e8a4c10ad3c54d1139a0e70e198466d0f864b6083ebdc8de
SHA512

717dce604f3c771a8c74ccb92e5ec5dc67509817afe7088ceaed7e3cf4b60b1e2e95851fe50bd6a4f4fb527cb094fda409107506242a5b96ec9a561e37ea982a
SSDEEP

768:jC5q5QSw2v39N8/PmJ/6F+9ahzMGOzTMwQ7y/u4Wt7Mx1TK42n8xRTSH7:G5q5Q6Nqi/8hqMw9uxMnKOxRTi7

Score

7^/10

bootkit persistence

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4856	x2z8.exe

Executes dropped EXE 2 IoCs

pid	Process
5020	x2z8.exe
4856	x2z8.exe

Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PHYSICALDRIVE0	4b1ea697709b01387c828930fcdae181_JaffaCakes118.exe
File opened for modification	\??\PHYSICALDRIVE0	x2z8.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1156 set thread context of 3208	1156	4b1ea697709b01387c828930fcdae181_JaffaCakes118.exe	88
PID 5020 set thread context of 4856	5020	x2z8.exe	90

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "207"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4856	x2z8.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4360	LogonUI.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1156 wrote to memory of 3208	1156	4b1ea697709b01387c828930fcdae181_JaffaCakes118.exe	88
PID 1156 wrote to memory of 3208	1156	4b1ea697709b01387c828930fcdae181_JaffaCakes118.exe	88
PID 1156 wrote to memory of 3208	1156	4b1ea697709b01387c828930fcdae181_JaffaCakes118.exe	88
PID 1156 wrote to memory of 3208	1156	4b1ea697709b01387c828930fcdae181_JaffaCakes118.exe	88
PID 1156 wrote to memory of 3208	1156	4b1ea697709b01387c828930fcdae181_JaffaCakes118.exe	88
PID 3208 wrote to memory of 5020	3208	4b1ea697709b01387c828930fcdae181_JaffaCakes118.exe	89
PID 3208 wrote to memory of 5020	3208	4b1ea697709b01387c828930fcdae181_JaffaCakes118.exe	89
PID 3208 wrote to memory of 5020	3208	4b1ea697709b01387c828930fcdae181_JaffaCakes118.exe	89
PID 5020 wrote to memory of 4856	5020	x2z8.exe	90
PID 5020 wrote to memory of 4856	5020	x2z8.exe	90
PID 5020 wrote to memory of 4856	5020	x2z8.exe	90
PID 5020 wrote to memory of 4856	5020	x2z8.exe	90
PID 5020 wrote to memory of 4856	5020	x2z8.exe	90

C:\Users\Admin\AppData\Local\Temp\4b1ea697709b01387c828930fcdae181_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4b1ea697709b01387c828930fcdae181_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1156
- C:\Users\Admin\AppData\Local\Temp\4b1ea697709b01387c828930fcdae181_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\4b1ea697709b01387c828930fcdae181_JaffaCakes118.exe"
  2⤵
  - Writes to the Master Boot Record (MBR)
  - Suspicious use of WriteProcessMemory
  PID:3208
- - C:\Users\Admin\AppData\Local\Temp\x2z8.exe
    C:\Users\Admin\AppData\Local\Temp\\x2z8.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:5020
  - - C:\Users\Admin\AppData\Local\Temp\x2z8.exe
      "C:\Users\Admin\AppData\Local\Temp\x2z8.exe"
      4⤵
      Deletes itself
      Executes dropped EXE
      Writes to the Master Boot Record (MBR)
      Suspicious use of AdjustPrivilegeToken
      PID:4856

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3985855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4360

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\fpath.txt

Filesize
84B

MD5
a75132278bb79b16ca77f3b9b80354d1

SHA1
7a724a168bb59657a2f478b820c8895d3f49291a

SHA256
848682e2e48378f45bd48fe476bafad512aaeca49e5e892aec359395a28964ee

SHA512
a36e2fcb961e5251d026e9faaae75e4155f80432a8d5d726444bde01a902336a4a6427de7a099e3f0f7742ab802c351cc712c04110862753abbd8ee79e82a478

Download Submit
C:\Users\Admin\AppData\Local\Temp\x2z8.exe

Filesize
51KB

MD5
4b1ea697709b01387c828930fcdae181

SHA1
168b0ab8819d80526ae1639e31c4b2b05be61527

SHA256
4244728855560a89e8a4c10ad3c54d1139a0e70e198466d0f864b6083ebdc8de

SHA512
717dce604f3c771a8c74ccb92e5ec5dc67509817afe7088ceaed7e3cf4b60b1e2e95851fe50bd6a4f4fb527cb094fda409107506242a5b96ec9a561e37ea982a

Download Submit
memory/1156-3-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/3208-0-0x000000002AA00000-0x000000002AA04000-memory.dmp

Filesize
16KB

Download
memory/3208-2-0x000000002AA00000-0x000000002AA04000-memory.dmp

Filesize
16KB

Download
memory/3208-4-0x000000002AA00000-0x000000002AA04000-memory.dmp

Filesize
16KB

Download
memory/4856-16-0x000000002AA00000-0x000000002AA04000-memory.dmp

Filesize
16KB

Download
memory/5020-12-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads