990ae56392ced57dc4ce9fa40f6986bd53b28caa2e15cd402bf7b4daf2c3c4ae

General

Target

5da7edef44bd632085e25c6dea8b1ffe_JaffaCakes118.exe
Size

580KB
MD5

5da7edef44bd632085e25c6dea8b1ffe
SHA1

96f6c1e93f93f240cf18c1265139da3433dae449
SHA256

990ae56392ced57dc4ce9fa40f6986bd53b28caa2e15cd402bf7b4daf2c3c4ae
SHA512

96298dab7e6487737bb4cc4e54dbcf7e68f608a92a02cd1b742ddca82dce1b51e610083c76ce11e5af12eb7f404e261a95c953440eb1b58d3ee3f00304bb5999
SSDEEP

12288:0WjKsYs1aoIPIzQXahXX5qAlZ0VzYKj86sFt7/QpTx:0C1bcXahTX0pYOUt7a

Score

6^/10

bootkit persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	5da7edef44bd632085e25c6dea8b1ffe_JaffaCakes118.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 900 set thread context of 2860	900	5da7edef44bd632085e25c6dea8b1ffe_JaffaCakes118.exe	31
PID 900 set thread context of 0	900	5da7edef44bd632085e25c6dea8b1ffe_JaffaCakes118.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	5da7edef44bd632085e25c6dea8b1ffe_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	5da7edef44bd632085e25c6dea8b1ffe_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	5da7edef44bd632085e25c6dea8b1ffe_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2860	5da7edef44bd632085e25c6dea8b1ffe_JaffaCakes118.exe
2860	5da7edef44bd632085e25c6dea8b1ffe_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
900	5da7edef44bd632085e25c6dea8b1ffe_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 900 wrote to memory of 2860	900	5da7edef44bd632085e25c6dea8b1ffe_JaffaCakes118.exe	31
PID 900 wrote to memory of 2860	900	5da7edef44bd632085e25c6dea8b1ffe_JaffaCakes118.exe	31
PID 900 wrote to memory of 2860	900	5da7edef44bd632085e25c6dea8b1ffe_JaffaCakes118.exe	31
PID 900 wrote to memory of 2860	900	5da7edef44bd632085e25c6dea8b1ffe_JaffaCakes118.exe	31
PID 900 wrote to memory of 2860	900	5da7edef44bd632085e25c6dea8b1ffe_JaffaCakes118.exe	31
PID 900 wrote to memory of 2860	900	5da7edef44bd632085e25c6dea8b1ffe_JaffaCakes118.exe	31
PID 900 wrote to memory of 2860	900	5da7edef44bd632085e25c6dea8b1ffe_JaffaCakes118.exe	31
PID 900 wrote to memory of 2860	900	5da7edef44bd632085e25c6dea8b1ffe_JaffaCakes118.exe	31
PID 900 wrote to memory of 0	900	5da7edef44bd632085e25c6dea8b1ffe_JaffaCakes118.exe
PID 900 wrote to memory of 0	900	5da7edef44bd632085e25c6dea8b1ffe_JaffaCakes118.exe
PID 900 wrote to memory of 0	900	5da7edef44bd632085e25c6dea8b1ffe_JaffaCakes118.exe
PID 900 wrote to memory of 0	900	5da7edef44bd632085e25c6dea8b1ffe_JaffaCakes118.exe
PID 2860 wrote to memory of 1136	2860	5da7edef44bd632085e25c6dea8b1ffe_JaffaCakes118.exe	20
PID 2860 wrote to memory of 1136	2860	5da7edef44bd632085e25c6dea8b1ffe_JaffaCakes118.exe	20
PID 2860 wrote to memory of 1136	2860	5da7edef44bd632085e25c6dea8b1ffe_JaffaCakes118.exe	20
PID 2860 wrote to memory of 1136	2860	5da7edef44bd632085e25c6dea8b1ffe_JaffaCakes118.exe	20

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1136
- C:\Users\Admin\AppData\Local\Temp\5da7edef44bd632085e25c6dea8b1ffe_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\5da7edef44bd632085e25c6dea8b1ffe_JaffaCakes118.exe"
  2⤵
  - Writes to the Master Boot Record (MBR)
  - Suspicious use of SetThreadContext
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:900
- - C:\Users\Admin\AppData\Local\Temp\5da7edef44bd632085e25c6dea8b1ffe_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\5da7edef44bd632085e25c6dea8b1ffe_JaffaCakes118.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/900-10-0x00000000003A0000-0x00000000003A1000-memory.dmp

Filesize
4KB

Download
memory/900-9-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/900-1-0x00000000003A0000-0x00000000003A1000-memory.dmp

Filesize
4KB

Download
memory/900-23-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/900-22-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/900-21-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/900-20-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/900-19-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/900-18-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/900-17-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/900-16-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/900-15-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/900-14-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/900-13-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/900-12-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/900-11-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/900-2-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/900-8-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/900-0-0x0000000000400000-0x0000000000528000-memory.dmp

Filesize
1.2MB

Download
memory/900-7-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/900-6-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/900-5-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/900-4-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/900-3-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/900-24-0x0000000000400000-0x0000000000528000-memory.dmp

Filesize
1.2MB

Download
memory/900-25-0x0000000000390000-0x0000000000391000-memory.dmp

Filesize
4KB

Download
memory/900-33-0x0000000000400000-0x0000000000528000-memory.dmp

Filesize
1.2MB

Download
memory/900-29-0x0000000003820000-0x0000000003948000-memory.dmp

Filesize
1.2MB

Download
memory/1136-34-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/2860-30-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2860-32-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2860-28-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2860-46-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads