08f256c6e701a5fa65b6713d494c29263abc88cacb01ffa3a263b8e2666780e6

General

Target

748ccae997e411b6cb7986b0c435233f_JaffaCakes118.exe
Size

265KB
MD5

748ccae997e411b6cb7986b0c435233f
SHA1

ddd06b24cd1416f7f7898a07d913a5d4cfdc43f0
SHA256

08f256c6e701a5fa65b6713d494c29263abc88cacb01ffa3a263b8e2666780e6
SHA512

2c81f183376ea4d13e3890bf2fc9bc92df6063d76edaf2e767bdbc17df949e68ae245b3b3cb5a99a79e7dc048ab08e4f0fd4765dc24a69a89d2c72fe263174db
SSDEEP

6144:gACs80oCRlhjZ+f4bTpD+4TyQOI5JgpcvqNplc42LcUTeD:gnsHlPhjZ+fIDnT0Iw5pd2LhSD

Score

6^/10

bootkit discovery persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1542.003

Processes:

748ccae997e411b6cb7986b0c435233f_JaffaCakes118.exe

description ioc process

File opened for modification \??\PhysicalDrive0 748ccae997e411b6cb7986b0c435233f_JaffaCakes118.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	748ccae997e411b6cb7986b0c435233f_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

748ccae997e411b6cb7986b0c435233f_JaffaCakes118.exe

description	pid	process	target process
PID 1732 set thread context of 2844	1732	748ccae997e411b6cb7986b0c435233f_JaffaCakes118.exe	748ccae997e411b6cb7986b0c435233f_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

748ccae997e411b6cb7986b0c435233f_JaffaCakes118.exe748ccae997e411b6cb7986b0c435233f_JaffaCakes118.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	748ccae997e411b6cb7986b0c435233f_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	748ccae997e411b6cb7986b0c435233f_JaffaCakes118.exe

Modifies registry class 3 IoCs

Processes:

748ccae997e411b6cb7986b0c435233f_JaffaCakes118.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	748ccae997e411b6cb7986b0c435233f_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	748ccae997e411b6cb7986b0c435233f_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	748ccae997e411b6cb7986b0c435233f_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

748ccae997e411b6cb7986b0c435233f_JaffaCakes118.exe

pid process

1732 748ccae997e411b6cb7986b0c435233f_JaffaCakes118.exe

pid	process
1732	748ccae997e411b6cb7986b0c435233f_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

748ccae997e411b6cb7986b0c435233f_JaffaCakes118.exe

description	pid	process	target process
PID 1732 wrote to memory of 2844	1732	748ccae997e411b6cb7986b0c435233f_JaffaCakes118.exe	748ccae997e411b6cb7986b0c435233f_JaffaCakes118.exe
PID 1732 wrote to memory of 2844	1732	748ccae997e411b6cb7986b0c435233f_JaffaCakes118.exe	748ccae997e411b6cb7986b0c435233f_JaffaCakes118.exe
PID 1732 wrote to memory of 2844	1732	748ccae997e411b6cb7986b0c435233f_JaffaCakes118.exe	748ccae997e411b6cb7986b0c435233f_JaffaCakes118.exe
PID 1732 wrote to memory of 2844	1732	748ccae997e411b6cb7986b0c435233f_JaffaCakes118.exe	748ccae997e411b6cb7986b0c435233f_JaffaCakes118.exe
PID 1732 wrote to memory of 2844	1732	748ccae997e411b6cb7986b0c435233f_JaffaCakes118.exe	748ccae997e411b6cb7986b0c435233f_JaffaCakes118.exe
PID 1732 wrote to memory of 2844	1732	748ccae997e411b6cb7986b0c435233f_JaffaCakes118.exe	748ccae997e411b6cb7986b0c435233f_JaffaCakes118.exe
PID 1732 wrote to memory of 2844	1732	748ccae997e411b6cb7986b0c435233f_JaffaCakes118.exe	748ccae997e411b6cb7986b0c435233f_JaffaCakes118.exe
PID 1732 wrote to memory of 2844	1732	748ccae997e411b6cb7986b0c435233f_JaffaCakes118.exe	748ccae997e411b6cb7986b0c435233f_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\748ccae997e411b6cb7986b0c435233f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\748ccae997e411b6cb7986b0c435233f_JaffaCakes118.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1732

C:\Users\Admin\AppData\Local\Temp\748ccae997e411b6cb7986b0c435233f_JaffaCakes118.exe
C:\Users\Admin\AppData\Local\Temp\748ccae997e411b6cb7986b0c435233f_JaffaCakes118.exe
2⤵
- System Location Discovery: System Language Discovery
PID:2844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1732-7-0x0000000000790000-0x0000000000791000-memory.dmp

Filesize
4KB

Download
memory/1732-10-0x0000000000790000-0x0000000000791000-memory.dmp

Filesize
4KB

Download
memory/1732-0-0x0000000000400000-0x00000000004AE000-memory.dmp

Filesize
696KB

Download
memory/1732-20-0x0000000000770000-0x0000000000771000-memory.dmp

Filesize
4KB

Download
memory/1732-19-0x0000000000500000-0x0000000000501000-memory.dmp

Filesize
4KB

Download
memory/1732-18-0x0000000000750000-0x0000000000751000-memory.dmp

Filesize
4KB

Download
memory/1732-15-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/1732-14-0x0000000000780000-0x0000000000781000-memory.dmp

Filesize
4KB

Download
memory/1732-13-0x0000000000790000-0x0000000000791000-memory.dmp

Filesize
4KB

Download
memory/1732-12-0x0000000000790000-0x0000000000791000-memory.dmp

Filesize
4KB

Download
memory/1732-11-0x0000000000790000-0x0000000000791000-memory.dmp

Filesize
4KB

Download
memory/1732-36-0x0000000000400000-0x00000000004AE000-memory.dmp

Filesize
696KB

Download
memory/1732-9-0x0000000000790000-0x0000000000791000-memory.dmp

Filesize
4KB

Download
memory/1732-8-0x0000000000790000-0x0000000000791000-memory.dmp

Filesize
4KB

Download
memory/1732-21-0x0000000000760000-0x0000000000761000-memory.dmp

Filesize
4KB

Download
memory/1732-5-0x0000000000790000-0x0000000000791000-memory.dmp

Filesize
4KB

Download
memory/1732-1-0x00000000004B0000-0x00000000004B1000-memory.dmp

Filesize
4KB

Download
memory/1732-4-0x0000000000790000-0x0000000000791000-memory.dmp

Filesize
4KB

Download
memory/1732-3-0x0000000000780000-0x0000000000781000-memory.dmp

Filesize
4KB

Download
memory/1732-2-0x0000000000780000-0x0000000000781000-memory.dmp

Filesize
4KB

Download
memory/1732-6-0x0000000000790000-0x0000000000791000-memory.dmp

Filesize
4KB

Download
memory/1732-32-0x0000000002980000-0x0000000002A2E000-memory.dmp

Filesize
696KB

Download
memory/2844-38-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/2844-33-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/2844-30-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2844-28-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2844-26-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2844-22-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2844-34-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2844-37-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2844-24-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads