aba8cc8cb4d5d13917476ac3b3a167c201bbbdcd1531a17e7a95fec9cc98285f

General

Target

63bf7f63b356506caf9735dc8a7f2504_JaffaCakes118.exe
Size

313KB
MD5

63bf7f63b356506caf9735dc8a7f2504
SHA1

83e411ff33cc2649babede74022341f28dcc488f
SHA256

aba8cc8cb4d5d13917476ac3b3a167c201bbbdcd1531a17e7a95fec9cc98285f
SHA512

02b738d952fa37e5f573f54f859c2fa785008a4da8b1fff20d6fd3186be86e39b4c5ce78b5d64782ce9b2bceb580882decbed3b5034ca955cdd14d813e470688
SSDEEP

6144:tEupefwSFuiTDEiG6oxdoi0Y9vPRbz6VD6qr8senMNFik8J:tE4efVFlT4l6oIeR6VD6qw3YFikc

Score

6^/10

bootkit persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	63bf7f63b356506caf9735dc8a7f2504_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process
PID 2700 set thread context of 0	2700	63bf7f63b356506caf9735dc8a7f2504_JaffaCakes118.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	63bf7f63b356506caf9735dc8a7f2504_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	63bf7f63b356506caf9735dc8a7f2504_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	63bf7f63b356506caf9735dc8a7f2504_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2700	63bf7f63b356506caf9735dc8a7f2504_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process
PID 2700 wrote to memory of 0	2700	63bf7f63b356506caf9735dc8a7f2504_JaffaCakes118.exe
PID 2700 wrote to memory of 0	2700	63bf7f63b356506caf9735dc8a7f2504_JaffaCakes118.exe
PID 2700 wrote to memory of 0	2700	63bf7f63b356506caf9735dc8a7f2504_JaffaCakes118.exe
PID 2700 wrote to memory of 0	2700	63bf7f63b356506caf9735dc8a7f2504_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\63bf7f63b356506caf9735dc8a7f2504_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\63bf7f63b356506caf9735dc8a7f2504_JaffaCakes118.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2700-0-0x0000000000400000-0x00000000004AB000-memory.dmp

Filesize
684KB

Download
memory/2700-29-0x00000000003D0000-0x00000000003D1000-memory.dmp

Filesize
4KB

Download
memory/2700-28-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2700-27-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/2700-26-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/2700-25-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/2700-24-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/2700-23-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/2700-22-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/2700-21-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/2700-20-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/2700-19-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/2700-18-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/2700-17-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/2700-16-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/2700-15-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/2700-14-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/2700-13-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/2700-12-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/2700-11-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/2700-10-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/2700-9-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/2700-8-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/2700-7-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/2700-6-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/2700-5-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/2700-4-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/2700-3-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/2700-2-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/2700-1-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/2700-33-0x0000000000400000-0x00000000004AB000-memory.dmp

Filesize
684KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads