5bb848cbe59e2bb031a3fa7c006443cf7bc4db0f326fcede679762c01d51eb53

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
26-07-2024 12:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

740372080ee530c8546873b51b19cd61_JaffaCakes118.exe
Size

24KB
MD5

740372080ee530c8546873b51b19cd61
SHA1

f40696730799fb7333b9fc4a114d530f472131a5
SHA256

5bb848cbe59e2bb031a3fa7c006443cf7bc4db0f326fcede679762c01d51eb53
SHA512

867f807c05915d9f4f4899b22aa1a33b75205525bedf798e566761c4d658ceee4628f345be2c0d7303e02ac3014ea83eab93f3f49cae40deb909eda91df71bf4
SSDEEP

384:jxrhv7U29zbzGkvr212SOfcN99OKagHuuadAoJ3n:jXvzg2SOo9FpHulJ3

Score

6^/10

bootkit discovery persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PHYSICALDRIVE0	740372080ee530c8546873b51b19cd61_JaffaCakes118.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Nt_File_Temp\	740372080ee530c8546873b51b19cd61_JaffaCakes118.exe
File created	C:\Windows\Nt_File_Temp\__write_ok__	740372080ee530c8546873b51b19cd61_JaffaCakes118.exe
File created	C:\Windows\Nt_File_Temp\__temp.bat	740372080ee530c8546873b51b19cd61_JaffaCakes118.exe
File created	C:\Windows\Nt_File_Temp\hook.sys	740372080ee530c8546873b51b19cd61_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	740372080ee530c8546873b51b19cd61_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
472	Process not Found

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2160 wrote to memory of 2836	2160	740372080ee530c8546873b51b19cd61_JaffaCakes118.exe	28
PID 2160 wrote to memory of 2836	2160	740372080ee530c8546873b51b19cd61_JaffaCakes118.exe	28
PID 2160 wrote to memory of 2836	2160	740372080ee530c8546873b51b19cd61_JaffaCakes118.exe	28
PID 2160 wrote to memory of 2836	2160	740372080ee530c8546873b51b19cd61_JaffaCakes118.exe	28
PID 2836 wrote to memory of 2892	2836	cmd.exe	30
PID 2836 wrote to memory of 2892	2836	cmd.exe	30
PID 2836 wrote to memory of 2892	2836	cmd.exe	30
PID 2836 wrote to memory of 2892	2836	cmd.exe	30
PID 2836 wrote to memory of 2908	2836	cmd.exe	31
PID 2836 wrote to memory of 2908	2836	cmd.exe	31
PID 2836 wrote to memory of 2908	2836	cmd.exe	31
PID 2836 wrote to memory of 2908	2836	cmd.exe	31

C:\Users\Admin\AppData\Local\Temp\740372080ee530c8546873b51b19cd61_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\740372080ee530c8546873b51b19cd61_JaffaCakes118.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2160
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\Nt_File_Temp\__temp.bat
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2836
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2892
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\dllcache /T /C /G Admin:f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Nt_File_Temp\__temp.bat

Filesize
58B

MD5
8e53a0ddda1d88ced2ba2bd7ba5d6564

SHA1
a61e89ecc5417381c751786c74ffd0a3cc0f00c0

SHA256
618296b57b78fd4e26920a36a94a890c3d4223275733a88ff032dd9c987dc32d

SHA512
1139432b97fede2fe56d7d9faf804e208255f9bcabdd32a069ecb8864028acbd34f035ff28a9df23b7dce8fd24183ba6baccda72b812b4e2de79c17fa977db99

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads