53fc1bbf0dbcb61f30ec7873f2a06eff5c2012b9571039f59ea6f030e10c1495

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
20/07/2024, 01:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5e919669b5c10051c44d6c616bebc9d9_JaffaCakes118.exe
Size

424KB
MD5

5e919669b5c10051c44d6c616bebc9d9
SHA1

2145c18503bee06d76467a5b38b83f3b7f9a4f6e
SHA256

53fc1bbf0dbcb61f30ec7873f2a06eff5c2012b9571039f59ea6f030e10c1495
SHA512

9adfa16da7217c1026754ef11726e77943b2b9c41b75cfe88e07df7e683c6fa17379dea48370295fa8c9992e1dafd199b743a616e46d300fdfd43f771e1297d2
SSDEEP

6144:wiryibmJGc715gyUsrgVhuMrKV4jF9GZZMtGOkq84BVMT:wirdbaG8CyUsr+0h4jFAZNhq84BVMT

Score

10^/10

bootkit evasion persistence

Malware Config

Signatures

Modifies firewall policy service 3 TTPs 2 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\5e919669b5c10051c44d6c616bebc9d9_JaffaCakes118.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\5e919669b5c10051c44d6c616bebc9d9_JaffaCakes118.exe:*:Enabled:@xpsp2res.dll,-22019"	5e919669b5c10051c44d6c616bebc9d9_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	5e919669b5c10051c44d6c616bebc9d9_JaffaCakes118.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	5e919669b5c10051c44d6c616bebc9d9_JaffaCakes118.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2348 set thread context of 11496	2348	5e919669b5c10051c44d6c616bebc9d9_JaffaCakes118.exe	30
PID 11496 set thread context of 2496	11496	5e919669b5c10051c44d6c616bebc9d9_JaffaCakes118.exe	31

Suspicious behavior: EnumeratesProcesses 55 IoCs

pid	Process
2348	5e919669b5c10051c44d6c616bebc9d9_JaffaCakes118.exe
2348	5e919669b5c10051c44d6c616bebc9d9_JaffaCakes118.exe
2348	5e919669b5c10051c44d6c616bebc9d9_JaffaCakes118.exe
2348	5e919669b5c10051c44d6c616bebc9d9_JaffaCakes118.exe
2348	5e919669b5c10051c44d6c616bebc9d9_JaffaCakes118.exe
2348	5e919669b5c10051c44d6c616bebc9d9_JaffaCakes118.exe
2348	5e919669b5c10051c44d6c616bebc9d9_JaffaCakes118.exe
2348	5e919669b5c10051c44d6c616bebc9d9_JaffaCakes118.exe
2348	5e919669b5c10051c44d6c616bebc9d9_JaffaCakes118.exe
2348	5e919669b5c10051c44d6c616bebc9d9_JaffaCakes118.exe
2348	5e919669b5c10051c44d6c616bebc9d9_JaffaCakes118.exe
2348	5e919669b5c10051c44d6c616bebc9d9_JaffaCakes118.exe
2348	5e919669b5c10051c44d6c616bebc9d9_JaffaCakes118.exe
2348	5e919669b5c10051c44d6c616bebc9d9_JaffaCakes118.exe
2348	5e919669b5c10051c44d6c616bebc9d9_JaffaCakes118.exe
2348	5e919669b5c10051c44d6c616bebc9d9_JaffaCakes118.exe
2348	5e919669b5c10051c44d6c616bebc9d9_JaffaCakes118.exe
2348	5e919669b5c10051c44d6c616bebc9d9_JaffaCakes118.exe
2348	5e919669b5c10051c44d6c616bebc9d9_JaffaCakes118.exe
2348	5e919669b5c10051c44d6c616bebc9d9_JaffaCakes118.exe
2348	5e919669b5c10051c44d6c616bebc9d9_JaffaCakes118.exe
2348	5e919669b5c10051c44d6c616bebc9d9_JaffaCakes118.exe
2348	5e919669b5c10051c44d6c616bebc9d9_JaffaCakes118.exe
2348	5e919669b5c10051c44d6c616bebc9d9_JaffaCakes118.exe
2348	5e919669b5c10051c44d6c616bebc9d9_JaffaCakes118.exe
2348	5e919669b5c10051c44d6c616bebc9d9_JaffaCakes118.exe
2348	5e919669b5c10051c44d6c616bebc9d9_JaffaCakes118.exe
2348	5e919669b5c10051c44d6c616bebc9d9_JaffaCakes118.exe
2348	5e919669b5c10051c44d6c616bebc9d9_JaffaCakes118.exe
2348	5e919669b5c10051c44d6c616bebc9d9_JaffaCakes118.exe
2348	5e919669b5c10051c44d6c616bebc9d9_JaffaCakes118.exe
2348	5e919669b5c10051c44d6c616bebc9d9_JaffaCakes118.exe
2348	5e919669b5c10051c44d6c616bebc9d9_JaffaCakes118.exe
2348	5e919669b5c10051c44d6c616bebc9d9_JaffaCakes118.exe
2348	5e919669b5c10051c44d6c616bebc9d9_JaffaCakes118.exe
2348	5e919669b5c10051c44d6c616bebc9d9_JaffaCakes118.exe
2348	5e919669b5c10051c44d6c616bebc9d9_JaffaCakes118.exe
2348	5e919669b5c10051c44d6c616bebc9d9_JaffaCakes118.exe
2348	5e919669b5c10051c44d6c616bebc9d9_JaffaCakes118.exe
2348	5e919669b5c10051c44d6c616bebc9d9_JaffaCakes118.exe
2348	5e919669b5c10051c44d6c616bebc9d9_JaffaCakes118.exe
2348	5e919669b5c10051c44d6c616bebc9d9_JaffaCakes118.exe
2348	5e919669b5c10051c44d6c616bebc9d9_JaffaCakes118.exe
2348	5e919669b5c10051c44d6c616bebc9d9_JaffaCakes118.exe
11496	5e919669b5c10051c44d6c616bebc9d9_JaffaCakes118.exe
11496	5e919669b5c10051c44d6c616bebc9d9_JaffaCakes118.exe
11496	5e919669b5c10051c44d6c616bebc9d9_JaffaCakes118.exe
11496	5e919669b5c10051c44d6c616bebc9d9_JaffaCakes118.exe
11496	5e919669b5c10051c44d6c616bebc9d9_JaffaCakes118.exe
11496	5e919669b5c10051c44d6c616bebc9d9_JaffaCakes118.exe
11496	5e919669b5c10051c44d6c616bebc9d9_JaffaCakes118.exe
11496	5e919669b5c10051c44d6c616bebc9d9_JaffaCakes118.exe
11496	5e919669b5c10051c44d6c616bebc9d9_JaffaCakes118.exe
11496	5e919669b5c10051c44d6c616bebc9d9_JaffaCakes118.exe
11496	5e919669b5c10051c44d6c616bebc9d9_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeAssignPrimaryTokenPrivilege	11496	5e919669b5c10051c44d6c616bebc9d9_JaffaCakes118.exe
Token: SeAuditPrivilege	11496	5e919669b5c10051c44d6c616bebc9d9_JaffaCakes118.exe
Token: SeBackupPrivilege	11496	5e919669b5c10051c44d6c616bebc9d9_JaffaCakes118.exe
Token: SeChangeNotifyPrivilege	11496	5e919669b5c10051c44d6c616bebc9d9_JaffaCakes118.exe
Token: SeCreatePagefilePrivilege	11496	5e919669b5c10051c44d6c616bebc9d9_JaffaCakes118.exe
Token: SeCreatePermanentPrivilege	11496	5e919669b5c10051c44d6c616bebc9d9_JaffaCakes118.exe
Token: SeCreatePermanentPrivilege	11496	5e919669b5c10051c44d6c616bebc9d9_JaffaCakes118.exe
Token: SeCreateTokenPrivilege	11496	5e919669b5c10051c44d6c616bebc9d9_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	11496	5e919669b5c10051c44d6c616bebc9d9_JaffaCakes118.exe
Token: SeIncreaseQuotaPrivilege	11496	5e919669b5c10051c44d6c616bebc9d9_JaffaCakes118.exe
Token: SeLoadDriverPrivilege	11496	5e919669b5c10051c44d6c616bebc9d9_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	11496	5e919669b5c10051c44d6c616bebc9d9_JaffaCakes118.exe
Token: SeMachineAccountPrivilege	11496	5e919669b5c10051c44d6c616bebc9d9_JaffaCakes118.exe
Token: SeProfSingleProcessPrivilege	11496	5e919669b5c10051c44d6c616bebc9d9_JaffaCakes118.exe
Token: SeRemoteShutdownPrivilege	11496	5e919669b5c10051c44d6c616bebc9d9_JaffaCakes118.exe
Token: SeRestorePrivilege	11496	5e919669b5c10051c44d6c616bebc9d9_JaffaCakes118.exe
Token: SeSecurityPrivilege	11496	5e919669b5c10051c44d6c616bebc9d9_JaffaCakes118.exe
Token: SeShutdownPrivilege	11496	5e919669b5c10051c44d6c616bebc9d9_JaffaCakes118.exe
Token: SeSystemEnvironmentPrivilege	11496	5e919669b5c10051c44d6c616bebc9d9_JaffaCakes118.exe
Token: SeSystemProfilePrivilege	11496	5e919669b5c10051c44d6c616bebc9d9_JaffaCakes118.exe
Token: SeSystemtimePrivilege	11496	5e919669b5c10051c44d6c616bebc9d9_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	11496	5e919669b5c10051c44d6c616bebc9d9_JaffaCakes118.exe
Token: SeTcbPrivilege	11496	5e919669b5c10051c44d6c616bebc9d9_JaffaCakes118.exe
Token: SeDebugPrivilege	11496	5e919669b5c10051c44d6c616bebc9d9_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2348	5e919669b5c10051c44d6c616bebc9d9_JaffaCakes118.exe
11496	5e919669b5c10051c44d6c616bebc9d9_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 2348 wrote to memory of 11496	2348	5e919669b5c10051c44d6c616bebc9d9_JaffaCakes118.exe	30
PID 2348 wrote to memory of 11496	2348	5e919669b5c10051c44d6c616bebc9d9_JaffaCakes118.exe	30
PID 2348 wrote to memory of 11496	2348	5e919669b5c10051c44d6c616bebc9d9_JaffaCakes118.exe	30
PID 2348 wrote to memory of 11496	2348	5e919669b5c10051c44d6c616bebc9d9_JaffaCakes118.exe	30
PID 2348 wrote to memory of 11496	2348	5e919669b5c10051c44d6c616bebc9d9_JaffaCakes118.exe	30
PID 2348 wrote to memory of 11496	2348	5e919669b5c10051c44d6c616bebc9d9_JaffaCakes118.exe	30
PID 2348 wrote to memory of 11496	2348	5e919669b5c10051c44d6c616bebc9d9_JaffaCakes118.exe	30
PID 2348 wrote to memory of 11496	2348	5e919669b5c10051c44d6c616bebc9d9_JaffaCakes118.exe	30
PID 11496 wrote to memory of 2496	11496	5e919669b5c10051c44d6c616bebc9d9_JaffaCakes118.exe	31
PID 11496 wrote to memory of 2496	11496	5e919669b5c10051c44d6c616bebc9d9_JaffaCakes118.exe	31
PID 11496 wrote to memory of 2496	11496	5e919669b5c10051c44d6c616bebc9d9_JaffaCakes118.exe	31
PID 11496 wrote to memory of 2496	11496	5e919669b5c10051c44d6c616bebc9d9_JaffaCakes118.exe	31
PID 11496 wrote to memory of 2496	11496	5e919669b5c10051c44d6c616bebc9d9_JaffaCakes118.exe	31
PID 11496 wrote to memory of 2496	11496	5e919669b5c10051c44d6c616bebc9d9_JaffaCakes118.exe	31
PID 11496 wrote to memory of 2496	11496	5e919669b5c10051c44d6c616bebc9d9_JaffaCakes118.exe	31
PID 11496 wrote to memory of 2496	11496	5e919669b5c10051c44d6c616bebc9d9_JaffaCakes118.exe	31
PID 11496 wrote to memory of 2496	11496	5e919669b5c10051c44d6c616bebc9d9_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\5e919669b5c10051c44d6c616bebc9d9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5e919669b5c10051c44d6c616bebc9d9_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Users\Admin\AppData\Local\Temp\5e919669b5c10051c44d6c616bebc9d9_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\5e919669b5c10051c44d6c616bebc9d9_JaffaCakes118.exe
  2⤵
  - Modifies firewall policy service
  - Writes to the Master Boot Record (MBR)
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:11496
- - C:\Users\Admin\AppData\Local\Temp\5e919669b5c10051c44d6c616bebc9d9_JaffaCakes118.exe
    C:\Users\Admin\AppData\Local\Temp\5e919669b5c10051c44d6c616bebc9d9_JaffaCakes118.exe -f
    3⤵
    PID:2496

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2496-5424-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2496-5425-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2496-5427-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2496-5429-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2496-5431-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2496-5437-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2496-5436-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2496-5435-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2496-5433-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/11496-5353-0x00000000002C0000-0x00000000002DE000-memory.dmp

Filesize
120KB

Download
memory/11496-5383-0x00000000002C0000-0x00000000002E4000-memory.dmp

Filesize
144KB

Download
memory/11496-5074-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/11496-5077-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/11496-5073-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/11496-5323-0x0000000000280000-0x0000000000299000-memory.dmp

Filesize
100KB

Download
memory/11496-5324-0x0000000000280000-0x0000000000299000-memory.dmp

Filesize
100KB

Download
memory/11496-5325-0x0000000000280000-0x0000000000289000-memory.dmp

Filesize
36KB

Download
memory/11496-5346-0x0000000000280000-0x000000000028D000-memory.dmp

Filesize
52KB

Download
memory/11496-5344-0x0000000000280000-0x0000000000282000-memory.dmp

Filesize
8KB

Download
memory/11496-5343-0x0000000000280000-0x0000000000282000-memory.dmp

Filesize
8KB

Download
memory/11496-5348-0x00000000027E0000-0x00000000028A9000-memory.dmp

Filesize
804KB

Download
memory/11496-5347-0x0000000000280000-0x000000000028D000-memory.dmp

Filesize
52KB

Download
memory/11496-5351-0x00000000027E0000-0x00000000028A9000-memory.dmp

Filesize
804KB

Download
memory/11496-5352-0x00000000002C0000-0x00000000002DE000-memory.dmp

Filesize
120KB

Download
memory/11496-5072-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/11496-5354-0x00000000002C0000-0x00000000002ED000-memory.dmp

Filesize
180KB

Download
memory/11496-5355-0x00000000002C0000-0x00000000002ED000-memory.dmp

Filesize
180KB

Download
memory/11496-5360-0x00000000002C0000-0x000000000030D000-memory.dmp

Filesize
308KB

Download
memory/11496-5361-0x00000000002C0000-0x000000000030D000-memory.dmp

Filesize
308KB

Download
memory/11496-5382-0x00000000002C0000-0x00000000002E4000-memory.dmp

Filesize
144KB

Download
memory/11496-5076-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/11496-5384-0x00000000027E0000-0x0000000002886000-memory.dmp

Filesize
664KB

Download
memory/11496-5385-0x00000000027E0000-0x0000000002886000-memory.dmp

Filesize
664KB

Download
memory/11496-5386-0x0000000000280000-0x000000000028B000-memory.dmp

Filesize
44KB

Download
memory/11496-5387-0x0000000000280000-0x000000000028B000-memory.dmp

Filesize
44KB

Download
memory/11496-5388-0x00000000002C0000-0x00000000002F1000-memory.dmp

Filesize
196KB

Download
memory/11496-5389-0x00000000002C0000-0x00000000002D2000-memory.dmp

Filesize
72KB

Download
memory/11496-5410-0x00000000027E0000-0x000000000284B000-memory.dmp

Filesize
428KB

Download
memory/11496-5414-0x00000000027E0000-0x000000000284B000-memory.dmp

Filesize
428KB

Download
memory/11496-5415-0x00000000027E0000-0x0000000002879000-memory.dmp

Filesize
612KB

Download
memory/11496-5069-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/11496-5061-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/11496-5057-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/11496-5053-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/11496-5416-0x00000000027E0000-0x0000000002879000-memory.dmp

Filesize
612KB

Download
memory/11496-5417-0x00000000002C0000-0x000000000030D000-memory.dmp

Filesize
308KB

Download
memory/11496-5418-0x00000000002C0000-0x000000000030D000-memory.dmp

Filesize
308KB

Download
memory/11496-5419-0x00000000027E0000-0x0000000002851000-memory.dmp

Filesize
452KB

Download
memory/11496-5420-0x0000000000280000-0x0000000000288000-memory.dmp

Filesize
32KB

Download
memory/11496-5439-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download