c66d52bcf29db1ff263f01381f2da1fdb0e582b69227a0f43de6ec251aac47b6

Analysis

max time kernel
148s
max time network
121s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
21-09-2024 03:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eefde0896c38953d97338c9be9c989c5_JaffaCakes118.exe
Size

1.4MB
MD5

eefde0896c38953d97338c9be9c989c5
SHA1

8f60fb6bb8d8f591d35f646fe8034bb1f25cc5c3
SHA256

c66d52bcf29db1ff263f01381f2da1fdb0e582b69227a0f43de6ec251aac47b6
SHA512

ebed225526cdebbe8a67077090bbf50c97016743d8c992e5797644776423d1fe84464686d2a9a5ea5e570a07eda712fca92e480f38b650a3db1f94225a7ac06b
SSDEEP

24576:4d33RjEptwxaf4mqVlb2mn91c91PzdOUfoZgTVuxk1G9Pyed5iTKXUg5N:G33RjEptwxaf4mW91c91Pfo2TV0k1GZB

Score

7^/10

bootkit discovery persistence

Malware Config

Signatures

Executes dropped EXE 5 IoCs

pid	Process
2972	reptile.exe
780	reptile.exe
2924	csrss.exe
2796	Setup.exe
2748	csrss.exe

Loads dropped DLL 12 IoCs

pid	Process
772	eefde0896c38953d97338c9be9c989c5_JaffaCakes118.exe
772	eefde0896c38953d97338c9be9c989c5_JaffaCakes118.exe
2972	reptile.exe
2972	reptile.exe
2972	reptile.exe
2972	reptile.exe
780	reptile.exe
780	reptile.exe
780	reptile.exe
772	eefde0896c38953d97338c9be9c989c5_JaffaCakes118.exe
2796	Setup.exe
2796	Setup.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	eefde0896c38953d97338c9be9c989c5_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows UDP Control Center = "csrss.exe"	reptile.exe

Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	reptile.exe
File opened for modification	\??\PhysicalDrive0	csrss.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2972 set thread context of 780	2972	reptile.exe	31
PID 2924 set thread context of 2748	2924	csrss.exe	34

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\caps\caps.db	Setup.exe
File created	C:\Program Files (x86)\Common Files\Adobe\caps\caps.db-journal	Setup.exe
File created	C:\Program Files (x86)\Common Files\Adobe\backup\caps.db	Setup.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\backup\caps.db	Setup.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\csrss.exe	reptile.exe
File opened for modification	C:\Windows\csrss.exe	reptile.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eefde0896c38953d97338c9be9c989c5_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reptile.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reptile.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2972	reptile.exe
Token: SeDebugPrivilege	2924	csrss.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2972	reptile.exe
2924	csrss.exe
2796	Setup.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 772 wrote to memory of 2972	772	eefde0896c38953d97338c9be9c989c5_JaffaCakes118.exe	30
PID 772 wrote to memory of 2972	772	eefde0896c38953d97338c9be9c989c5_JaffaCakes118.exe	30
PID 772 wrote to memory of 2972	772	eefde0896c38953d97338c9be9c989c5_JaffaCakes118.exe	30
PID 772 wrote to memory of 2972	772	eefde0896c38953d97338c9be9c989c5_JaffaCakes118.exe	30
PID 772 wrote to memory of 2972	772	eefde0896c38953d97338c9be9c989c5_JaffaCakes118.exe	30
PID 772 wrote to memory of 2972	772	eefde0896c38953d97338c9be9c989c5_JaffaCakes118.exe	30
PID 772 wrote to memory of 2972	772	eefde0896c38953d97338c9be9c989c5_JaffaCakes118.exe	30
PID 2972 wrote to memory of 780	2972	reptile.exe	31
PID 2972 wrote to memory of 780	2972	reptile.exe	31
PID 2972 wrote to memory of 780	2972	reptile.exe	31
PID 2972 wrote to memory of 780	2972	reptile.exe	31
PID 2972 wrote to memory of 780	2972	reptile.exe	31
PID 2972 wrote to memory of 780	2972	reptile.exe	31
PID 2972 wrote to memory of 780	2972	reptile.exe	31
PID 2972 wrote to memory of 780	2972	reptile.exe	31
PID 2972 wrote to memory of 780	2972	reptile.exe	31
PID 2972 wrote to memory of 780	2972	reptile.exe	31
PID 2972 wrote to memory of 780	2972	reptile.exe	31
PID 2972 wrote to memory of 780	2972	reptile.exe	31
PID 780 wrote to memory of 2924	780	reptile.exe	32
PID 780 wrote to memory of 2924	780	reptile.exe	32
PID 780 wrote to memory of 2924	780	reptile.exe	32
PID 780 wrote to memory of 2924	780	reptile.exe	32
PID 780 wrote to memory of 2924	780	reptile.exe	32
PID 780 wrote to memory of 2924	780	reptile.exe	32
PID 780 wrote to memory of 2924	780	reptile.exe	32
PID 772 wrote to memory of 2796	772	eefde0896c38953d97338c9be9c989c5_JaffaCakes118.exe	33
PID 772 wrote to memory of 2796	772	eefde0896c38953d97338c9be9c989c5_JaffaCakes118.exe	33
PID 772 wrote to memory of 2796	772	eefde0896c38953d97338c9be9c989c5_JaffaCakes118.exe	33
PID 772 wrote to memory of 2796	772	eefde0896c38953d97338c9be9c989c5_JaffaCakes118.exe	33
PID 772 wrote to memory of 2796	772	eefde0896c38953d97338c9be9c989c5_JaffaCakes118.exe	33
PID 772 wrote to memory of 2796	772	eefde0896c38953d97338c9be9c989c5_JaffaCakes118.exe	33
PID 772 wrote to memory of 2796	772	eefde0896c38953d97338c9be9c989c5_JaffaCakes118.exe	33
PID 2924 wrote to memory of 2748	2924	csrss.exe	34
PID 2924 wrote to memory of 2748	2924	csrss.exe	34
PID 2924 wrote to memory of 2748	2924	csrss.exe	34
PID 2924 wrote to memory of 2748	2924	csrss.exe	34
PID 2924 wrote to memory of 2748	2924	csrss.exe	34
PID 2924 wrote to memory of 2748	2924	csrss.exe	34
PID 2924 wrote to memory of 2748	2924	csrss.exe	34
PID 2924 wrote to memory of 2748	2924	csrss.exe	34
PID 2924 wrote to memory of 2748	2924	csrss.exe	34

C:\Users\Admin\AppData\Local\Temp\eefde0896c38953d97338c9be9c989c5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\eefde0896c38953d97338c9be9c989c5_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:772
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\reptile.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\reptile.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Writes to the Master Boot Record (MBR)
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2972
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\reptile.exe
    "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\reptile.exe" c:\users\admin\appdata\local\temp\Program.exehµßt
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:780
  - - C:\Windows\csrss.exe
      "C:\Windows\csrss.exe"
      4⤵
      Executes dropped EXE
      Writes to the Master Boot Record (MBR)
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2924
    - - C:\Windows\csrss.exe
        
        "C:\Windows\csrss.exe" c:\users\admin\appdata\local\temp\Program.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2748
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Setup.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Setup.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Common Files\Adobe\caps\caps.db

Filesize
26KB

MD5
8fdf28dfd592f2a2c8846f83f73390dd

SHA1
18be2802d2c76be9ea9a5ff4c086fbbafa4599c3

SHA256
6c9a0169d1afd716897488cca76182efe0fc624b46fb5a41c6e23270d296d829

SHA512
53a8a0867e00d612666885236c391246bacc4fbd2ea0a713ff38cd6c783db00273bbd462cc069875a8b0ea1a59ff4b28d1847d796c8c8e70fec68840016f38f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ahmbed.gz

Filesize
221B

MD5
6d7052a1b26813ab81bd4b5b421185b7

SHA1
848ffc98d1a355ad825060b123c654aa06b28bd1

SHA256
c7e1475dbf7d8b5ef96a5aaf42450862bcface9bb3292cc68da64f5462987a22

SHA512
40cfc3a9398a8329685955d5e108f52304415b9bccadb36ac4b6d8284f8cfa11b263666c8a6b9f7ad899a2fefd65d5d90ad61300c92ed4b68af03e57ba037747

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\reptile.exe

Filesize
92KB

MD5
cdb58de65a54f38f3e46c6de55e1a373

SHA1
1bc4f6cedcfc0099dc05afcb92fba8d22ce7389c

SHA256
9411c2ffa962afc5302fb79476f6d2a4f8c75e81cb0d6784b5074d5b172b97f6

SHA512
53ef1b8dd938dd2e90eb937541f4d994cb295057d6eb2665ec7263fd43c0ef84b663ae920e1718c38d0695a7d37eab62a40306d849b2e48bba2d5c436bde3808

Download Submit
C:\Users\Admin\AppData\Local\Temp\test.htm

Filesize
3B

MD5
6057f13c496ecf7fd777ceb9e79ae285

SHA1
7f550a9f4c44173a37664d938f1355f0f92a47a7

SHA256
fa690b82061edfd2852629aeba8a8977b57e40fcb77d1a7a28b26cba62591204

SHA512
0601d109d0d2b0fa9c4484b4a5c94ee5ecc62ccec3bd7d99e972d18994d0e2e42f6d0fcfc41216a5ab72ee7af96d213e1c314abdde40f52731ff24c2bf8f7323

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\Setup.exe

Filesize
2.9MB

MD5
ae591cef7a3ec455f3742041ce6c8b46

SHA1
7b634779c128bf8bb5658166dcdb3dc60b7eca5d

SHA256
cbe0ed650456afa91e9e30689a035ff730751a80da541fe634abcb0c1e383ea4

SHA512
720686d002250bf4e7faa0240025481e4b18811f873ca1492e0bcfda599ad1497bea719d530d98f08c6edb9fccfe448f716aa5cd200664bc29d4a636c08a3254

Download Submit
memory/780-30-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/780-32-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/780-28-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/780-26-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/780-24-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/780-34-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/780-58-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/780-42-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/780-43-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/780-37-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/2748-81-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/2748-106-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/2748-101-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/2748-102-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/2748-103-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/2748-104-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/2748-105-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/2748-77-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2748-107-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/2748-108-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/2748-109-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/2748-110-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/2748-111-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/2748-112-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/2748-113-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/2748-114-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads