daa81f795893bb6d8c9159ad6a8420bd7bd9bd9a31c6bd40213602fef28dd1d1

Analysis

max time kernel
147s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25/09/2024, 12:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f5f9c8087b84746c9ddce270a11286be_JaffaCakes118.exe
Size

158KB
MD5

f5f9c8087b84746c9ddce270a11286be
SHA1

253a9e2564c345d0e4dabb2bb5cfe2e86ca5ee14
SHA256

daa81f795893bb6d8c9159ad6a8420bd7bd9bd9a31c6bd40213602fef28dd1d1
SHA512

0d275fa8095e9744a7047d4b4f9b5f7b74fc2519e40d11b916044365a2ff3a1ab08bcc152e954a4942736857098cbe5484958d4605dea8a50a7c28eae03fbee2
SSDEEP

3072:cdq0eTGVmHbLOuJcW7wYfhD8FkiZOMt8/rrwWoQ4y:cdq0YGI7LBJ/wyOFkik/r0WoQ

Score

8^/10

bootkit discovery persistence

Malware Config

Signatures

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\drivers\etc\alTYh5EI.dll	f5f9c8087b84746c9ddce270a11286be_JaffaCakes118.exe
File opened for modification	C:\Windows\system32\drivers\etc\alTYh5EI.dll	f5f9c8087b84746c9ddce270a11286be_JaffaCakes118.exe

Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Indexing Servicer\Parameters\ServiceDLL = "%SystemRoot%\\system32\\drivers\\etc\\alTYh5EI.dll"	f5f9c8087b84746c9ddce270a11286be_JaffaCakes118.exe

Deletes itself 1 IoCs

pid	Process
4740	svchost.exe

Loads dropped DLL 1 IoCs

pid	Process
4740	svchost.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	svchost.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Mo8fBgJaL5.ini	f5f9c8087b84746c9ddce270a11286be_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Mo8fBgJaL5.del	f5f9c8087b84746c9ddce270a11286be_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f5f9c8087b84746c9ddce270a11286be_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4108	f5f9c8087b84746c9ddce270a11286be_JaffaCakes118.exe
4108	f5f9c8087b84746c9ddce270a11286be_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4108	f5f9c8087b84746c9ddce270a11286be_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4740	svchost.exe
4740	svchost.exe

C:\Users\Admin\AppData\Local\Temp\f5f9c8087b84746c9ddce270a11286be_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f5f9c8087b84746c9ddce270a11286be_JaffaCakes118.exe"
1⤵
- Drops file in Drivers directory
- Server Software Component: Terminal Services DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4108

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Deletes itself
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Server Software Component

T1505

Terminal Services DLL

T1505.005

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Mo8fBgJaL5.del

Filesize
86B

MD5
05aa6c687b5093aa697fd32cdca2f465

SHA1
a55eab7b48818628c71f71c176d1c096a9fe5588

SHA256
e178818a80af88134e968588d508289f05476c2f04595d8ce4dc17c1ec0641dc

SHA512
fafec4f2fd22462a578c7951a7f0c7b147c3c0622bbf3166b4b746419629ea948fba4bf02e0aa9a7a34994037e2c541360b5f437a24a9d28b8b2a83e27d69c25

Download Submit
\??\c:\windows\system32\drivers\etc\altyh5ei.dll

Filesize
124KB

MD5
48cf3e65526fe6174c26d4860fecef3a

SHA1
3bc6a4df48a9448a7fb07b3c24bd5deea4ef862d

SHA256
5179cf037ed7e7c63f7921aea76f8510023b6509fa05fef4f62926d0423880b8

SHA512
9a0d1ee16832e22f9081d94023cde5f6b2dc09ec061746b8ceba446906d2f26f5b817aed48f074cf4a06481ecdba50641f1e72d85571251fabbce3b4afddc4c9

Download Submit
memory/4108-4-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4108-8-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4740-9-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4740-10-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download