83f980c5f68e2b6fa6c0c4db1fb9e81e531d8f95c5d9722ddde6de83f7c7ffd4

Analysis

max time kernel
94s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07/09/2024, 22:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d2fe26f943be989225b2d2d51f745953_JaffaCakes118.exe
Size

4.3MB
MD5

d2fe26f943be989225b2d2d51f745953
SHA1

ff9ebf350b34458deb732849b6cb1b64b6d576ff
SHA256

83f980c5f68e2b6fa6c0c4db1fb9e81e531d8f95c5d9722ddde6de83f7c7ffd4
SHA512

cbc9597930c637ccdd6c9fa1338f86b6ea1a12c3e774146ffb0647b808bb33f8cd88e3dc20e5711f4ca45646c9cb2a2edb1157a93ad22b42bd4757fff5268ab4
SSDEEP

98304:aqSh5zRZwYeMMIV3PsU6Z8y6TaOphYLYSHinQpUt/YV5DyzFf:ajHYOpCm/s9y

Score

6^/10

bootkit discovery persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	d2fe26f943be989225b2d2d51f745953_JaffaCakes118.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4188	3844	WerFault.exe	82

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d2fe26f943be989225b2d2d51f745953_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3844	d2fe26f943be989225b2d2d51f745953_JaffaCakes118.exe
Token: SeRestorePrivilege	3844	d2fe26f943be989225b2d2d51f745953_JaffaCakes118.exe
Token: SeDebugPrivilege	3844	d2fe26f943be989225b2d2d51f745953_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\d2fe26f943be989225b2d2d51f745953_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d2fe26f943be989225b2d2d51f745953_JaffaCakes118.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3844
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3844 -s 1220
  2⤵
  - Program crash
  PID:4188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3844 -ip 3844
1⤵
PID:4764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads