e709e6d40a47e56750f4c43e119021e9807d82e2b46b9a2fb925c945bd7d8a31

General

Target

61a013f39ea79a22c5fd0bc4c778d36e_JaffaCakes118.exe
Size

225KB
MD5

61a013f39ea79a22c5fd0bc4c778d36e
SHA1

a4d9bd1d371d591e3108b13e530ed18efa539c3c
SHA256

e709e6d40a47e56750f4c43e119021e9807d82e2b46b9a2fb925c945bd7d8a31
SHA512

03e645fcb3b29aeb939631add17c23149397c049127dc81d2617e12c6d9b4dfe48a26798f94e3192303d9f23916030844945afb5bb1b761f596fba0e572cb1f6
SSDEEP

6144:rr1T53sflPSZWnVW5GJZ2tNYLj8MfstHhjqHT0YLo54j/P:rrralcOVzYKj86stBioY3jH

Score

6^/10

bootkit persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	61a013f39ea79a22c5fd0bc4c778d36e_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2372 set thread context of 2984	2372	61a013f39ea79a22c5fd0bc4c778d36e_JaffaCakes118.exe	30

Modifies registry class 3 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	61a013f39ea79a22c5fd0bc4c778d36e_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	61a013f39ea79a22c5fd0bc4c778d36e_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	61a013f39ea79a22c5fd0bc4c778d36e_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2984	61a013f39ea79a22c5fd0bc4c778d36e_JaffaCakes118.exe
2984	61a013f39ea79a22c5fd0bc4c778d36e_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2372	61a013f39ea79a22c5fd0bc4c778d36e_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 2984	2372	61a013f39ea79a22c5fd0bc4c778d36e_JaffaCakes118.exe	30
PID 2372 wrote to memory of 2984	2372	61a013f39ea79a22c5fd0bc4c778d36e_JaffaCakes118.exe	30
PID 2372 wrote to memory of 2984	2372	61a013f39ea79a22c5fd0bc4c778d36e_JaffaCakes118.exe	30
PID 2372 wrote to memory of 2984	2372	61a013f39ea79a22c5fd0bc4c778d36e_JaffaCakes118.exe	30
PID 2372 wrote to memory of 2984	2372	61a013f39ea79a22c5fd0bc4c778d36e_JaffaCakes118.exe	30
PID 2372 wrote to memory of 2984	2372	61a013f39ea79a22c5fd0bc4c778d36e_JaffaCakes118.exe	30
PID 2372 wrote to memory of 2984	2372	61a013f39ea79a22c5fd0bc4c778d36e_JaffaCakes118.exe	30
PID 2372 wrote to memory of 2984	2372	61a013f39ea79a22c5fd0bc4c778d36e_JaffaCakes118.exe	30
PID 2984 wrote to memory of 1252	2984	61a013f39ea79a22c5fd0bc4c778d36e_JaffaCakes118.exe	21
PID 2984 wrote to memory of 1252	2984	61a013f39ea79a22c5fd0bc4c778d36e_JaffaCakes118.exe	21
PID 2984 wrote to memory of 1252	2984	61a013f39ea79a22c5fd0bc4c778d36e_JaffaCakes118.exe	21
PID 2984 wrote to memory of 1252	2984	61a013f39ea79a22c5fd0bc4c778d36e_JaffaCakes118.exe	21

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1252
- C:\Users\Admin\AppData\Local\Temp\61a013f39ea79a22c5fd0bc4c778d36e_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\61a013f39ea79a22c5fd0bc4c778d36e_JaffaCakes118.exe"
  2⤵
  - Writes to the Master Boot Record (MBR)
  - Suspicious use of SetThreadContext
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2372
- - C:\Users\Admin\AppData\Local\Temp\61a013f39ea79a22c5fd0bc4c778d36e_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\61a013f39ea79a22c5fd0bc4c778d36e_JaffaCakes118.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1252-29-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/2372-18-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/2372-10-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/2372-7-0x0000000000510000-0x0000000000511000-memory.dmp

Filesize
4KB

Download
memory/2372-6-0x00000000001D0000-0x00000000001E0000-memory.dmp

Filesize
64KB

Download
memory/2372-4-0x00000000005C0000-0x00000000005C1000-memory.dmp

Filesize
4KB

Download
memory/2372-3-0x00000000005C0000-0x00000000005C1000-memory.dmp

Filesize
4KB

Download
memory/2372-2-0x00000000005B0000-0x00000000005B1000-memory.dmp

Filesize
4KB

Download
memory/2372-22-0x00000000005D0000-0x00000000005D1000-memory.dmp

Filesize
4KB

Download
memory/2372-21-0x00000000005E0000-0x00000000005E1000-memory.dmp

Filesize
4KB

Download
memory/2372-20-0x00000000005B0000-0x00000000005B1000-memory.dmp

Filesize
4KB

Download
memory/2372-19-0x00000000005C0000-0x00000000005C1000-memory.dmp

Filesize
4KB

Download
memory/2372-0-0x0000000000400000-0x0000000000488000-memory.dmp

Filesize
544KB

Download
memory/2372-9-0x0000000000530000-0x0000000000531000-memory.dmp

Filesize
4KB

Download
memory/2372-1-0x0000000000520000-0x0000000000523000-memory.dmp

Filesize
12KB

Download
memory/2372-11-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/2372-14-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/2372-13-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/2372-12-0x0000000000540000-0x0000000000541000-memory.dmp

Filesize
4KB

Download
memory/2372-15-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/2372-17-0x00000000003C0000-0x00000000003C1000-memory.dmp

Filesize
4KB

Download
memory/2372-26-0x0000000000400000-0x0000000000488000-memory.dmp

Filesize
544KB

Download
memory/2372-16-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/2984-27-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/2984-23-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2984-24-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2984-41-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads