61fd7c4a7f77f24819424035d32e2e39036f7d8ff010db58c1d67cf74b0d621d

Analysis

max time kernel
15s
max time network
20s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
18/08/2024, 00:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a4c9d3c95e49171b86528e14b293122c_JaffaCakes118.exe
Size

207KB
MD5

a4c9d3c95e49171b86528e14b293122c
SHA1

3c47e9fbe915efada773da51dcb3c441b476a71c
SHA256

61fd7c4a7f77f24819424035d32e2e39036f7d8ff010db58c1d67cf74b0d621d
SHA512

6197426b1901eef19c7cb915b4d99d3270b9bb3336d37eaba0fe604c058a0c645893ca21844959e1b3fb621f2cf960ef68db355afd15f282c5eac53af444e2a5
SSDEEP

3072:CqpgyUSD07z8WtoV96HM0XnpvTyQvGn+nCuhTr8npE3dvvq9aGNLlc0/3uEP/+dt:C+gl7zhq4TyQOI5JgpcvqNplcP2lsJm4

Score

6^/10

bootkit discovery persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	a4c9d3c95e49171b86528e14b293122c_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2948 set thread context of 2884	2948	a4c9d3c95e49171b86528e14b293122c_JaffaCakes118.exe	29

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a4c9d3c95e49171b86528e14b293122c_JaffaCakes118.exe

Modifies registry class 3 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	a4c9d3c95e49171b86528e14b293122c_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	a4c9d3c95e49171b86528e14b293122c_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	a4c9d3c95e49171b86528e14b293122c_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2948	a4c9d3c95e49171b86528e14b293122c_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2948 wrote to memory of 2884	2948	a4c9d3c95e49171b86528e14b293122c_JaffaCakes118.exe	29
PID 2948 wrote to memory of 2884	2948	a4c9d3c95e49171b86528e14b293122c_JaffaCakes118.exe	29
PID 2948 wrote to memory of 2884	2948	a4c9d3c95e49171b86528e14b293122c_JaffaCakes118.exe	29
PID 2948 wrote to memory of 2884	2948	a4c9d3c95e49171b86528e14b293122c_JaffaCakes118.exe	29
PID 2948 wrote to memory of 2884	2948	a4c9d3c95e49171b86528e14b293122c_JaffaCakes118.exe	29
PID 2948 wrote to memory of 2884	2948	a4c9d3c95e49171b86528e14b293122c_JaffaCakes118.exe	29
PID 2948 wrote to memory of 2884	2948	a4c9d3c95e49171b86528e14b293122c_JaffaCakes118.exe	29
PID 2948 wrote to memory of 2884	2948	a4c9d3c95e49171b86528e14b293122c_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\a4c9d3c95e49171b86528e14b293122c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a4c9d3c95e49171b86528e14b293122c_JaffaCakes118.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2948
- C:\Users\Admin\AppData\Local\Temp\a4c9d3c95e49171b86528e14b293122c_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\a4c9d3c95e49171b86528e14b293122c_JaffaCakes118.exe
  2⤵
  PID:2884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2884-34-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2884-40-0x0000000000400000-0x00000000004083A0-memory.dmp

Filesize
32KB

Download
memory/2884-39-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2884-35-0x0000000000400000-0x00000000004083A0-memory.dmp

Filesize
32KB

Download
memory/2884-36-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2948-31-0x0000000002540000-0x0000000002541000-memory.dmp

Filesize
4KB

Download
memory/2948-27-0x00000000024F0000-0x00000000024F1000-memory.dmp

Filesize
4KB

Download
memory/2948-4-0x00000000024B0000-0x00000000024B1000-memory.dmp

Filesize
4KB

Download
memory/2948-3-0x00000000024B0000-0x00000000024B1000-memory.dmp

Filesize
4KB

Download
memory/2948-2-0x00000000003D0000-0x00000000003D7000-memory.dmp

Filesize
28KB

Download
memory/2948-17-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/2948-16-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2948-15-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/2948-14-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2948-13-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2948-12-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/2948-33-0x0000000002680000-0x0000000002681000-memory.dmp

Filesize
4KB

Download
memory/2948-32-0x0000000002690000-0x0000000002691000-memory.dmp

Filesize
4KB

Download
memory/2948-0-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/2948-30-0x0000000002550000-0x0000000002551000-memory.dmp

Filesize
4KB

Download
memory/2948-29-0x0000000002520000-0x0000000002521000-memory.dmp

Filesize
4KB

Download
memory/2948-28-0x0000000002530000-0x0000000002531000-memory.dmp

Filesize
4KB

Download
memory/2948-5-0x00000000024C0000-0x00000000024C1000-memory.dmp

Filesize
4KB

Download
memory/2948-26-0x0000000002500000-0x0000000002501000-memory.dmp

Filesize
4KB

Download
memory/2948-25-0x00000000024D0000-0x00000000024D1000-memory.dmp

Filesize
4KB

Download
memory/2948-24-0x00000000024E0000-0x00000000024E1000-memory.dmp

Filesize
4KB

Download
memory/2948-23-0x00000000024B0000-0x00000000024B1000-memory.dmp

Filesize
4KB

Download
memory/2948-22-0x00000000024C0000-0x00000000024C1000-memory.dmp

Filesize
4KB

Download
memory/2948-21-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/2948-20-0x00000000002E0000-0x00000000002E1000-memory.dmp

Filesize
4KB

Download
memory/2948-19-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/2948-18-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/2948-6-0x00000000024C0000-0x00000000024C1000-memory.dmp

Filesize
4KB

Download
memory/2948-38-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/2948-7-0x00000000024C0000-0x00000000024C1000-memory.dmp

Filesize
4KB

Download
memory/2948-8-0x00000000024C0000-0x00000000024C1000-memory.dmp

Filesize
4KB

Download
memory/2948-9-0x0000000000240000-0x0000000000250000-memory.dmp

Filesize
64KB

Download
memory/2948-10-0x00000000003C0000-0x00000000003C1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads