175a3c84c67e0017ec64848aca432b9ecc37328a2cd5c426cbe5d2a58ed536f3

General

Target

eabf3816d619c186afdd0a57e5ef138b_JaffaCakes118.exe
Size

252KB
MD5

eabf3816d619c186afdd0a57e5ef138b
SHA1

fc33d9b6cea1a9d460418d7514a58ae0cc30e853
SHA256

175a3c84c67e0017ec64848aca432b9ecc37328a2cd5c426cbe5d2a58ed536f3
SHA512

235a35acfad17b556544baafd7529f6fa5b0a26513fc93190201f9ccf454c406b036c91b6133557a1c1c14647ae63063323faef272110b2eeedee36a4836f877
SSDEEP

3072:cJ9Zqle2tsu5oehGHA/pqQLxgdolApXu7Tq/pY+SFuK0Rg:cJ9ZqAyoehfLmdHpeeHc3

Score

6^/10

bootkit discovery persistence

Malware Config

Signatures

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	eabf3816d619c186afdd0a57e5ef138b_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	eabf3816d619c186afdd0a57e5ef138b_JaffaCakes118.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	eabf3816d619c186afdd0a57e5ef138b_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4040 set thread context of 2224	4040	eabf3816d619c186afdd0a57e5ef138b_JaffaCakes118.exe	83

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4512	2224	WerFault.exe	83

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eabf3816d619c186afdd0a57e5ef138b_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4040	eabf3816d619c186afdd0a57e5ef138b_JaffaCakes118.exe
4040	eabf3816d619c186afdd0a57e5ef138b_JaffaCakes118.exe
4040	eabf3816d619c186afdd0a57e5ef138b_JaffaCakes118.exe
4040	eabf3816d619c186afdd0a57e5ef138b_JaffaCakes118.exe
4040	eabf3816d619c186afdd0a57e5ef138b_JaffaCakes118.exe
4040	eabf3816d619c186afdd0a57e5ef138b_JaffaCakes118.exe
4040	eabf3816d619c186afdd0a57e5ef138b_JaffaCakes118.exe
4040	eabf3816d619c186afdd0a57e5ef138b_JaffaCakes118.exe
4040	eabf3816d619c186afdd0a57e5ef138b_JaffaCakes118.exe
4040	eabf3816d619c186afdd0a57e5ef138b_JaffaCakes118.exe
4040	eabf3816d619c186afdd0a57e5ef138b_JaffaCakes118.exe
4040	eabf3816d619c186afdd0a57e5ef138b_JaffaCakes118.exe
4040	eabf3816d619c186afdd0a57e5ef138b_JaffaCakes118.exe
4040	eabf3816d619c186afdd0a57e5ef138b_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 25 IoCs

description	pid	Process
Token: SeAssignPrimaryTokenPrivilege	4040	eabf3816d619c186afdd0a57e5ef138b_JaffaCakes118.exe
Token: SeAuditPrivilege	4040	eabf3816d619c186afdd0a57e5ef138b_JaffaCakes118.exe
Token: SeBackupPrivilege	4040	eabf3816d619c186afdd0a57e5ef138b_JaffaCakes118.exe
Token: SeChangeNotifyPrivilege	4040	eabf3816d619c186afdd0a57e5ef138b_JaffaCakes118.exe
Token: SeCreatePagefilePrivilege	4040	eabf3816d619c186afdd0a57e5ef138b_JaffaCakes118.exe
Token: SeCreatePermanentPrivilege	4040	eabf3816d619c186afdd0a57e5ef138b_JaffaCakes118.exe
Token: SeCreatePermanentPrivilege	4040	eabf3816d619c186afdd0a57e5ef138b_JaffaCakes118.exe
Token: SeCreateTokenPrivilege	4040	eabf3816d619c186afdd0a57e5ef138b_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	4040	eabf3816d619c186afdd0a57e5ef138b_JaffaCakes118.exe
Token: SeIncreaseQuotaPrivilege	4040	eabf3816d619c186afdd0a57e5ef138b_JaffaCakes118.exe
Token: SeLoadDriverPrivilege	4040	eabf3816d619c186afdd0a57e5ef138b_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	4040	eabf3816d619c186afdd0a57e5ef138b_JaffaCakes118.exe
Token: SeMachineAccountPrivilege	4040	eabf3816d619c186afdd0a57e5ef138b_JaffaCakes118.exe
Token: SeProfSingleProcessPrivilege	4040	eabf3816d619c186afdd0a57e5ef138b_JaffaCakes118.exe
Token: SeRemoteShutdownPrivilege	4040	eabf3816d619c186afdd0a57e5ef138b_JaffaCakes118.exe
Token: SeRestorePrivilege	4040	eabf3816d619c186afdd0a57e5ef138b_JaffaCakes118.exe
Token: SeSecurityPrivilege	4040	eabf3816d619c186afdd0a57e5ef138b_JaffaCakes118.exe
Token: SeShutdownPrivilege	4040	eabf3816d619c186afdd0a57e5ef138b_JaffaCakes118.exe
Token: SeSystemEnvironmentPrivilege	4040	eabf3816d619c186afdd0a57e5ef138b_JaffaCakes118.exe
Token: SeSystemProfilePrivilege	4040	eabf3816d619c186afdd0a57e5ef138b_JaffaCakes118.exe
Token: SeSystemtimePrivilege	4040	eabf3816d619c186afdd0a57e5ef138b_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	4040	eabf3816d619c186afdd0a57e5ef138b_JaffaCakes118.exe
Token: SeTcbPrivilege	4040	eabf3816d619c186afdd0a57e5ef138b_JaffaCakes118.exe
Token: SeDebugPrivilege	4040	eabf3816d619c186afdd0a57e5ef138b_JaffaCakes118.exe
Token: SeDebugPrivilege	4040	eabf3816d619c186afdd0a57e5ef138b_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4040	eabf3816d619c186afdd0a57e5ef138b_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4040 wrote to memory of 2224	4040	eabf3816d619c186afdd0a57e5ef138b_JaffaCakes118.exe	83
PID 4040 wrote to memory of 2224	4040	eabf3816d619c186afdd0a57e5ef138b_JaffaCakes118.exe	83
PID 4040 wrote to memory of 2224	4040	eabf3816d619c186afdd0a57e5ef138b_JaffaCakes118.exe	83
PID 4040 wrote to memory of 2224	4040	eabf3816d619c186afdd0a57e5ef138b_JaffaCakes118.exe	83
PID 4040 wrote to memory of 2224	4040	eabf3816d619c186afdd0a57e5ef138b_JaffaCakes118.exe	83
PID 4040 wrote to memory of 2224	4040	eabf3816d619c186afdd0a57e5ef138b_JaffaCakes118.exe	83
PID 4040 wrote to memory of 2224	4040	eabf3816d619c186afdd0a57e5ef138b_JaffaCakes118.exe	83
PID 4040 wrote to memory of 2224	4040	eabf3816d619c186afdd0a57e5ef138b_JaffaCakes118.exe	83
PID 4040 wrote to memory of 2224	4040	eabf3816d619c186afdd0a57e5ef138b_JaffaCakes118.exe	83
PID 4040 wrote to memory of 2224	4040	eabf3816d619c186afdd0a57e5ef138b_JaffaCakes118.exe	83

C:\Users\Admin\AppData\Local\Temp\eabf3816d619c186afdd0a57e5ef138b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\eabf3816d619c186afdd0a57e5ef138b_JaffaCakes118.exe"
1⤵
- Maps connected drives based on registry
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4040
- C:\Users\Admin\AppData\Local\Temp\eabf3816d619c186afdd0a57e5ef138b_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\eabf3816d619c186afdd0a57e5ef138b_JaffaCakes118.exe
  2⤵
  PID:2224
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2224 -s 12
    3⤵
    - Program crash
    PID:4512