a6e6016a27f170b79dae9744cd72611aee8b6eb3d04dbb880f0959cae1af8307

Analysis

max time kernel
141s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
12/09/2024, 16:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dc9167100e66934785317f5de84d4644_JaffaCakes118.exe
Size

325KB
MD5

dc9167100e66934785317f5de84d4644
SHA1

cc002633a57ec145ffd6d51c4bbb4aea0db3efa1
SHA256

a6e6016a27f170b79dae9744cd72611aee8b6eb3d04dbb880f0959cae1af8307
SHA512

8d873bb04e7d6de0c5306d5ef1f3ce81de2f9ff278435a6eab2b59ce8c039c9da966966a989d37c35158ec213ece2c5b2ea553d37079dd459dfd434cb5df69d5
SSDEEP

6144:bYCoZxAWIs0MduQPl6AWXXNL5SOYJc+eKLCiKlcY3GWWaA+i:ECoZx+sduQw1X3SOYQK2dZ3GWWx

Score

7^/10

bootkit discovery persistence upx

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
2388	dc9167100e66934785317f5de84d4644_JaffaCakes118.exe
2388	dc9167100e66934785317f5de84d4644_JaffaCakes118.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2388-0-0x0000000000400000-0x00000000004AA000-memory.dmp	upx
behavioral1/memory/2388-24-0x0000000000400000-0x00000000004AA000-memory.dmp	upx
behavioral1/memory/2388-25-0x0000000000400000-0x00000000004AA000-memory.dmp	upx
behavioral1/memory/2388-26-0x0000000000400000-0x00000000004AA000-memory.dmp	upx

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	dc9167100e66934785317f5de84d4644_JaffaCakes118.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\SAItest.txt	dc9167100e66934785317f5de84d4644_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dc9167100e66934785317f5de84d4644_JaffaCakes118.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8554E885-8D59-40B2-8110-9161600F8183}\ProxyStubClsid32	dc9167100e66934785317f5de84d4644_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\SAI.Instantiator.1	dc9167100e66934785317f5de84d4644_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6FD31ED6-7C94-4bbc-8E95-F927F4D3A949}	dc9167100e66934785317f5de84d4644_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8554E885-8D59-40B2-8110-9161600F8183}	dc9167100e66934785317f5de84d4644_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7027DF82-2C23-4825-B8F0-F049A25761CF}\1.0\FLAGS\ = "0"	dc9167100e66934785317f5de84d4644_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8554E885-8D59-40B2-8110-9161600F8183}\TypeLib	dc9167100e66934785317f5de84d4644_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6FD31ED6-7C94-4bbc-8E95-F927F4D3A949}\ProgID	dc9167100e66934785317f5de84d4644_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7027DF82-2C23-4825-B8F0-F049A25761CF}\1.0\HELPDIR	dc9167100e66934785317f5de84d4644_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8554E885-8D59-40B2-8110-9161600F8183}	dc9167100e66934785317f5de84d4644_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6FD31ED6-7C94-4bbc-8E95-F927F4D3A949}\ = "Instantiator Class"	dc9167100e66934785317f5de84d4644_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6FD31ED6-7C94-4bbc-8E95-F927F4D3A949}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\SAIInstantiator.dll"	dc9167100e66934785317f5de84d4644_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7027DF82-2C23-4825-B8F0-F049A25761CF}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\SAIInstantiator.dll"	dc9167100e66934785317f5de84d4644_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8554E885-8D59-40B2-8110-9161600F8183}\TypeLib\ = "{7027DF82-2C23-4825-B8F0-F049A25761CF}"	dc9167100e66934785317f5de84d4644_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8554E885-8D59-40B2-8110-9161600F8183}\ = "IInstantiator"	dc9167100e66934785317f5de84d4644_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8554E885-8D59-40B2-8110-9161600F8183}\ProxyStubClsid32	dc9167100e66934785317f5de84d4644_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{28EBA486-52AA-4F65-8500-88B31D25031E}\ = "SAIInstantiator"	dc9167100e66934785317f5de84d4644_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SAI.Instantiator.1\CLSID	dc9167100e66934785317f5de84d4644_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7027DF82-2C23-4825-B8F0-F049A25761CF}\1.0	dc9167100e66934785317f5de84d4644_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8554E885-8D59-40B2-8110-9161600F8183}\TypeLib\Version = "1.0"	dc9167100e66934785317f5de84d4644_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\SAI.Instantiator\CLSID	dc9167100e66934785317f5de84d4644_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8554E885-8D59-40B2-8110-9161600F8183}\ProxyStubClsid32	dc9167100e66934785317f5de84d4644_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\SAI.Instantiator.1\CLSID	dc9167100e66934785317f5de84d4644_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6FD31ED6-7C94-4bbc-8E95-F927F4D3A949}\Programmable	dc9167100e66934785317f5de84d4644_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6FD31ED6-7C94-4bbc-8E95-F927F4D3A949}\TypeLib	dc9167100e66934785317f5de84d4644_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\SAIInstantiator.DLL	dc9167100e66934785317f5de84d4644_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SAI.Instantiator\CurVer\ = "SAI.Instantiator.1"	dc9167100e66934785317f5de84d4644_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6FD31ED6-7C94-4bbc-8E95-F927F4D3A949}	dc9167100e66934785317f5de84d4644_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\SAI.Instantiator	dc9167100e66934785317f5de84d4644_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6FD31ED6-7C94-4bbc-8E95-F927F4D3A949}\VersionIndependentProgID	dc9167100e66934785317f5de84d4644_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{28EBA486-52AA-4F65-8500-88B31D25031E}	dc9167100e66934785317f5de84d4644_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8554E885-8D59-40B2-8110-9161600F8183}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	dc9167100e66934785317f5de84d4644_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8554E885-8D59-40B2-8110-9161600F8183}\TypeLib	dc9167100e66934785317f5de84d4644_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SAI.Instantiator\CLSID	dc9167100e66934785317f5de84d4644_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6FD31ED6-7C94-4bbc-8E95-F927F4D3A949}\VersionIndependentProgID	dc9167100e66934785317f5de84d4644_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7027DF82-2C23-4825-B8F0-F049A25761CF}	dc9167100e66934785317f5de84d4644_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8554E885-8D59-40B2-8110-9161600F8183}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	dc9167100e66934785317f5de84d4644_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{28EBA486-52AA-4F65-8500-88B31D25031E}	dc9167100e66934785317f5de84d4644_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8554E885-8D59-40B2-8110-9161600F8183}\ = "IInstantiator"	dc9167100e66934785317f5de84d4644_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8554E885-8D59-40B2-8110-9161600F8183}\TypeLib	dc9167100e66934785317f5de84d4644_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7027DF82-2C23-4825-B8F0-F049A25761CF}\1.0\0\win32	dc9167100e66934785317f5de84d4644_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\SAIInstantiator.DLL\AppID = "{28EBA486-52AA-4F65-8500-88B31D25031E}"	dc9167100e66934785317f5de84d4644_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SAI.Instantiator	dc9167100e66934785317f5de84d4644_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SAI.Instantiator\CurVer	dc9167100e66934785317f5de84d4644_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7027DF82-2C23-4825-B8F0-F049A25761CF}\1.0\0\win32	dc9167100e66934785317f5de84d4644_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7027DF82-2C23-4825-B8F0-F049A25761CF}\1.0\HELPDIR	dc9167100e66934785317f5de84d4644_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8554E885-8D59-40B2-8110-9161600F8183}\ProxyStubClsid32	dc9167100e66934785317f5de84d4644_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\SAIInstantiator.DLL	dc9167100e66934785317f5de84d4644_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SAI.Instantiator.1	dc9167100e66934785317f5de84d4644_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SAI.Instantiator\ = "Instantiator Class"	dc9167100e66934785317f5de84d4644_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6FD31ED6-7C94-4bbc-8E95-F927F4D3A949}\ProgID\ = "SAI.Instantiator.1"	dc9167100e66934785317f5de84d4644_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6FD31ED6-7C94-4bbc-8E95-F927F4D3A949}\TypeLib	dc9167100e66934785317f5de84d4644_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7027DF82-2C23-4825-B8F0-F049A25761CF}	dc9167100e66934785317f5de84d4644_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6FD31ED6-7C94-4bbc-8E95-F927F4D3A949}\VersionIndependentProgID\ = "SAI.Instantiator"	dc9167100e66934785317f5de84d4644_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7027DF82-2C23-4825-B8F0-F049A25761CF}\1.0\0	dc9167100e66934785317f5de84d4644_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8554E885-8D59-40B2-8110-9161600F8183}	dc9167100e66934785317f5de84d4644_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8554E885-8D59-40B2-8110-9161600F8183}	dc9167100e66934785317f5de84d4644_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\SAI.Instantiator\CurVer	dc9167100e66934785317f5de84d4644_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7027DF82-2C23-4825-B8F0-F049A25761CF}\1.0	dc9167100e66934785317f5de84d4644_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SAI.Instantiator.1\ = "Instantiator Class"	dc9167100e66934785317f5de84d4644_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SAI.Instantiator\CLSID\ = "{6FD31ED6-7C94-4bbc-8E95-F927F4D3A949}"	dc9167100e66934785317f5de84d4644_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6FD31ED6-7C94-4bbc-8E95-F927F4D3A949}\ProgID	dc9167100e66934785317f5de84d4644_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6FD31ED6-7C94-4bbc-8E95-F927F4D3A949}\TypeLib\ = "{7027DF82-2C23-4825-B8F0-F049A25761CF}"	dc9167100e66934785317f5de84d4644_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7027DF82-2C23-4825-B8F0-F049A25761CF}\1.0\ = "SAIInstantiator 1.0 Type Library"	dc9167100e66934785317f5de84d4644_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8554E885-8D59-40B2-8110-9161600F8183}\TypeLib	dc9167100e66934785317f5de84d4644_JaffaCakes118.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2388	dc9167100e66934785317f5de84d4644_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\dc9167100e66934785317f5de84d4644_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\dc9167100e66934785317f5de84d4644_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:2388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\SAIInstantiator.dll

Filesize
96KB

MD5
f35fe3d4022ba008e0e39a1b064ee494

SHA1
30d0c7810b79a702939556f11857154424b33c44

SHA256
97d3ed7ed207ba552486d14956250aae7b1749a328125477c01a78928f04efa9

SHA512
11c0713175f173c814a34243633b22a9ba27a498e22b0f5d79439cb087c81a537827069986a4bfa2002a31bb7215e71a2047c98578ea50a64ee75212ff77ef0b

Download Submit
memory/2388-0-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download
memory/2388-24-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download
memory/2388-25-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download
memory/2388-26-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads