6ae66b7b79c744e67b99734cda26f2c888d09090782bcbfa07526d758312be10

Analysis

max time kernel
26s
max time network
119s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
18/08/2024, 22:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a88b259246381f8b6833740ee7771ae4_JaffaCakes118.exe
Size

111KB
MD5

a88b259246381f8b6833740ee7771ae4
SHA1

f19d55c4b75a55c739f261c5985b25efd82ebceb
SHA256

6ae66b7b79c744e67b99734cda26f2c888d09090782bcbfa07526d758312be10
SHA512

874595b813b5e4f189324fbb6848fb3d9ed29e1f7b94b2215740a00c0d32afca87ae0ee0a722774374b6b9912e09d83a66811ab425958438c1f9d1682a893d09
SSDEEP

768:4XYuzaBxXQehqbbg6zrrzCg7gDjlE/Fy+ZmDCHA+DLOvGOhl4Ih3Wa0z4Zy:NxXQ0qbXrHClDjiYfCg66vV7NrZy

Score

7^/10

bootkit discovery persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1664	LiveUpdate360_769_.exe

Loads dropped DLL 4 IoCs

pid	Process
2692	a88b259246381f8b6833740ee7771ae4_JaffaCakes118.exe
1664	LiveUpdate360_769_.exe
1664	LiveUpdate360_769_.exe
1664	LiveUpdate360_769_.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PHYSICALDRIVE0	a88b259246381f8b6833740ee7771ae4_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a88b259246381f8b6833740ee7771ae4_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LiveUpdate360_769_.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2692	a88b259246381f8b6833740ee7771ae4_JaffaCakes118.exe
2692	a88b259246381f8b6833740ee7771ae4_JaffaCakes118.exe
1664	LiveUpdate360_769_.exe
1664	LiveUpdate360_769_.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2692	a88b259246381f8b6833740ee7771ae4_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2692 wrote to memory of 1664	2692	a88b259246381f8b6833740ee7771ae4_JaffaCakes118.exe	30
PID 2692 wrote to memory of 1664	2692	a88b259246381f8b6833740ee7771ae4_JaffaCakes118.exe	30
PID 2692 wrote to memory of 1664	2692	a88b259246381f8b6833740ee7771ae4_JaffaCakes118.exe	30
PID 2692 wrote to memory of 1664	2692	a88b259246381f8b6833740ee7771ae4_JaffaCakes118.exe	30
PID 2692 wrote to memory of 1664	2692	a88b259246381f8b6833740ee7771ae4_JaffaCakes118.exe	30
PID 2692 wrote to memory of 1664	2692	a88b259246381f8b6833740ee7771ae4_JaffaCakes118.exe	30
PID 2692 wrote to memory of 1664	2692	a88b259246381f8b6833740ee7771ae4_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\a88b259246381f8b6833740ee7771ae4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a88b259246381f8b6833740ee7771ae4_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2692
- C:\Users\Admin\AppData\Local\Temp\LiveUpdate360_769_.exe
  C:\Users\Admin\AppData\Local\Temp\\LiveUpdate360_769_.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Network Service Discovery

T1046

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\LiveUpdate360_769_.exe

Filesize
27KB

MD5
941442f09a7143eae0a25d5732df780d

SHA1
d031c3a20a3594d0d1dc9043ffd4cc00ddc0b522

SHA256
a6e78672cafa4fe4f75537fe2cc8ee9acd2af7cf444ef36c390ad8f2ae502a7c

SHA512
b4df6be5ae8086f60aa3d44c400cb2274c0b860d8865059076023205215800f631e56e81f8769628a40cc274344e9c229204c41b48d1b44a7c19f54e7127c267

Download Submit
memory/1664-8-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/1664-13-0x0000000000020000-0x0000000000023000-memory.dmp

Filesize
12KB

Download
memory/1664-11-0x0000000000020000-0x0000000000023000-memory.dmp

Filesize
12KB

Download
memory/1664-14-0x0000000000401000-0x0000000000402000-memory.dmp

Filesize
4KB

Download
memory/1664-15-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/1664-16-0x0000000000020000-0x0000000000023000-memory.dmp

Filesize
12KB

Download
memory/1664-17-0x0000000000020000-0x0000000000023000-memory.dmp

Filesize
12KB

Download
memory/2692-3-0x0000000000270000-0x0000000000273000-memory.dmp

Filesize
12KB

Download
memory/2692-5-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download