4816d810ae4dd54a4d5480040ad5d79098b25a85e78cdec283a098a1dac77a89

General

Target

756020405aa0a54006634a6d5ec6d60f_JaffaCakes118.exe
Size

310KB
MD5

756020405aa0a54006634a6d5ec6d60f
SHA1

ce67f4edb0fcb3c6e75bd8d159699ca6404c1ad0
SHA256

4816d810ae4dd54a4d5480040ad5d79098b25a85e78cdec283a098a1dac77a89
SHA512

47a712558fd938c56d508a48edc0e74efd4efe24ef20e2c7f68756f0a6c565c35b08177816e95f5c65016fd7d7409503ed7a7f8dfc48c77ab0814dedfc43b076
SSDEEP

6144:56opnzGlwxyeZ8K1tZoznzGfWqSv6vug45OHim8HyjIvix:UotGlmyeJZo3GfWpvyv45OCmMvix

Score

6^/10

bootkit discovery persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1542.003

Processes:

756020405aa0a54006634a6d5ec6d60f_JaffaCakes118.exe

description ioc process

File opened for modification \??\PhysicalDrive0 756020405aa0a54006634a6d5ec6d60f_JaffaCakes118.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	756020405aa0a54006634a6d5ec6d60f_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

756020405aa0a54006634a6d5ec6d60f_JaffaCakes118.exe

description	pid	process	target process
PID 2376 set thread context of 2992	2376	756020405aa0a54006634a6d5ec6d60f_JaffaCakes118.exe	756020405aa0a54006634a6d5ec6d60f_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

756020405aa0a54006634a6d5ec6d60f_JaffaCakes118.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 756020405aa0a54006634a6d5ec6d60f_JaffaCakes118.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	756020405aa0a54006634a6d5ec6d60f_JaffaCakes118.exe

Modifies registry class 3 IoCs

Processes:

756020405aa0a54006634a6d5ec6d60f_JaffaCakes118.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	756020405aa0a54006634a6d5ec6d60f_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	756020405aa0a54006634a6d5ec6d60f_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	756020405aa0a54006634a6d5ec6d60f_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

756020405aa0a54006634a6d5ec6d60f_JaffaCakes118.exe

pid process

2992 756020405aa0a54006634a6d5ec6d60f_JaffaCakes118.exe
2992 756020405aa0a54006634a6d5ec6d60f_JaffaCakes118.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

756020405aa0a54006634a6d5ec6d60f_JaffaCakes118.exe

pid process

2376 756020405aa0a54006634a6d5ec6d60f_JaffaCakes118.exe

pid	process
2992	756020405aa0a54006634a6d5ec6d60f_JaffaCakes118.exe
2992	756020405aa0a54006634a6d5ec6d60f_JaffaCakes118.exe

pid	process
2376	756020405aa0a54006634a6d5ec6d60f_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

756020405aa0a54006634a6d5ec6d60f_JaffaCakes118.exe756020405aa0a54006634a6d5ec6d60f_JaffaCakes118.exe

description	pid	process	target process
PID 2376 wrote to memory of 2992	2376	756020405aa0a54006634a6d5ec6d60f_JaffaCakes118.exe	756020405aa0a54006634a6d5ec6d60f_JaffaCakes118.exe
PID 2376 wrote to memory of 2992	2376	756020405aa0a54006634a6d5ec6d60f_JaffaCakes118.exe	756020405aa0a54006634a6d5ec6d60f_JaffaCakes118.exe
PID 2376 wrote to memory of 2992	2376	756020405aa0a54006634a6d5ec6d60f_JaffaCakes118.exe	756020405aa0a54006634a6d5ec6d60f_JaffaCakes118.exe
PID 2376 wrote to memory of 2992	2376	756020405aa0a54006634a6d5ec6d60f_JaffaCakes118.exe	756020405aa0a54006634a6d5ec6d60f_JaffaCakes118.exe
PID 2376 wrote to memory of 2992	2376	756020405aa0a54006634a6d5ec6d60f_JaffaCakes118.exe	756020405aa0a54006634a6d5ec6d60f_JaffaCakes118.exe
PID 2376 wrote to memory of 2992	2376	756020405aa0a54006634a6d5ec6d60f_JaffaCakes118.exe	756020405aa0a54006634a6d5ec6d60f_JaffaCakes118.exe
PID 2376 wrote to memory of 2992	2376	756020405aa0a54006634a6d5ec6d60f_JaffaCakes118.exe	756020405aa0a54006634a6d5ec6d60f_JaffaCakes118.exe
PID 2376 wrote to memory of 2992	2376	756020405aa0a54006634a6d5ec6d60f_JaffaCakes118.exe	756020405aa0a54006634a6d5ec6d60f_JaffaCakes118.exe
PID 2376 wrote to memory of 2992	2376	756020405aa0a54006634a6d5ec6d60f_JaffaCakes118.exe	756020405aa0a54006634a6d5ec6d60f_JaffaCakes118.exe
PID 2376 wrote to memory of 2992	2376	756020405aa0a54006634a6d5ec6d60f_JaffaCakes118.exe	756020405aa0a54006634a6d5ec6d60f_JaffaCakes118.exe
PID 2992 wrote to memory of 1256	2992	756020405aa0a54006634a6d5ec6d60f_JaffaCakes118.exe	Explorer.EXE
PID 2992 wrote to memory of 1256	2992	756020405aa0a54006634a6d5ec6d60f_JaffaCakes118.exe	Explorer.EXE
PID 2992 wrote to memory of 1256	2992	756020405aa0a54006634a6d5ec6d60f_JaffaCakes118.exe	Explorer.EXE
PID 2992 wrote to memory of 1256	2992	756020405aa0a54006634a6d5ec6d60f_JaffaCakes118.exe	Explorer.EXE

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1256

C:\Users\Admin\AppData\Local\Temp\756020405aa0a54006634a6d5ec6d60f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\756020405aa0a54006634a6d5ec6d60f_JaffaCakes118.exe"
2⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2376

C:\Users\Admin\AppData\Local\Temp\756020405aa0a54006634a6d5ec6d60f_JaffaCakes118.exe
C:\Users\Admin\AppData\Local\Temp\756020405aa0a54006634a6d5ec6d60f_JaffaCakes118.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1256-32-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/1256-35-0x000000007EFD0000-0x000000007EFD1000-memory.dmp

Filesize
4KB

Download
memory/2376-12-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2376-6-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2376-3-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2376-8-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2376-9-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2376-11-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2376-10-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2376-15-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2376-14-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2376-13-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2376-1-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2376-5-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2376-0-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2376-30-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2376-2-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2992-16-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2992-27-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2992-26-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2992-24-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2992-22-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2992-20-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2992-28-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2992-18-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2992-31-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads