Analysis

  • max time kernel
    121s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    16/10/2024, 21:06

General

  • Target

    4f07f680176fd270e11e175614d590e9_JaffaCakes118.exe

  • Size

    187KB

  • MD5

    4f07f680176fd270e11e175614d590e9

  • SHA1

    c1afef4bd8eace84c8ffca1c2c4afb8636ddf12e

  • SHA256

    f2967a77251732f2472f8063692f5c126125dd5386a62a1a130d6b35c7a3729f

  • SHA512

    5b2046b420987f6e0296687347379fab3117fe1331e72bcb551b43ea3e28c60f942ed9de233891549d3dd4479021bb768d38c396c946336449dc3058e7efa604

  • SSDEEP

    3072:XB4N5tlfILPZJUaFPmgRMNlPTGQQm6ytwZEsrYkK4cuUgW693fCHQW:R4LmLf98gWNlPTGQQm6agrdu+f

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Drops file in System32 directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4f07f680176fd270e11e175614d590e9_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\4f07f680176fd270e11e175614d590e9_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Writes to the Master Boot Record (MBR)
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2168
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\sysremove.bat" "
      2⤵
      • Deletes itself
      • System Location Discovery: System Language Discovery
      PID:2796
    • C:\Windows\SysWOW64\disvc.exe
      "C:\Windows\system32\disvc.exe"
      2⤵
      • Executes dropped EXE
      • Writes to the Master Boot Record (MBR)
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      PID:2656

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\sysremove.bat

          Filesize

          313B

          MD5

          159dfc836a06544da98ef7e74951a258

          SHA1

          647aefe97c3fea310cfa33bd098d41d54d6f1edb

          SHA256

          bec73991d0a6a300ffe77ef60ae75a182371c4e1f162d7d9b04654ceb0901779

          SHA512

          fb6a6e64587da77277b19eeef35893be51df52ef3f4ecbef7941209b05b383c8816c893e31f575fb2d32a9f89fd84a645a8b39728670447aa91ed306e1ac7002

        • C:\Windows\SysWOW64\disvc.exe

          Filesize

          187KB

          MD5

          4f07f680176fd270e11e175614d590e9

          SHA1

          c1afef4bd8eace84c8ffca1c2c4afb8636ddf12e

          SHA256

          f2967a77251732f2472f8063692f5c126125dd5386a62a1a130d6b35c7a3729f

          SHA512

          5b2046b420987f6e0296687347379fab3117fe1331e72bcb551b43ea3e28c60f942ed9de233891549d3dd4479021bb768d38c396c946336449dc3058e7efa604

        • memory/2168-5-0x0000000000620000-0x0000000000621000-memory.dmp

          Filesize

          4KB

        • memory/2168-33-0x0000000003190000-0x000000000320F000-memory.dmp

          Filesize

          508KB

        • memory/2168-9-0x0000000001F40000-0x0000000001F41000-memory.dmp

          Filesize

          4KB

        • memory/2168-8-0x0000000001F30000-0x0000000001F31000-memory.dmp

          Filesize

          4KB

        • memory/2168-7-0x0000000001EC0000-0x0000000001EC8000-memory.dmp

          Filesize

          32KB

        • memory/2168-6-0x0000000001ED0000-0x0000000001ED2000-memory.dmp

          Filesize

          8KB

        • memory/2168-0-0x0000000000400000-0x000000000047F000-memory.dmp

          Filesize

          508KB

        • memory/2168-4-0x0000000000230000-0x0000000000231000-memory.dmp

          Filesize

          4KB

        • memory/2168-35-0x0000000003190000-0x000000000320F000-memory.dmp

          Filesize

          508KB

        • memory/2168-14-0x0000000001EA0000-0x0000000001EA1000-memory.dmp

          Filesize

          4KB

        • memory/2168-15-0x0000000001EB0000-0x0000000001EB1000-memory.dmp

          Filesize

          4KB

        • memory/2168-18-0x0000000001EF0000-0x0000000001EF1000-memory.dmp

          Filesize

          4KB

        • memory/2168-17-0x0000000001F00000-0x0000000001F01000-memory.dmp

          Filesize

          4KB

        • memory/2168-16-0x0000000001F10000-0x0000000001F11000-memory.dmp

          Filesize

          4KB

        • memory/2168-3-0x0000000000240000-0x0000000000241000-memory.dmp

          Filesize

          4KB

        • memory/2168-45-0x0000000000280000-0x00000000002C3000-memory.dmp

          Filesize

          268KB

        • memory/2168-13-0x0000000001EE0000-0x0000000001EE1000-memory.dmp

          Filesize

          4KB

        • memory/2168-1-0x0000000000280000-0x00000000002C3000-memory.dmp

          Filesize

          268KB

        • memory/2168-40-0x0000000000400000-0x000000000047F000-memory.dmp

          Filesize

          508KB

        • memory/2168-2-0x00000000003F0000-0x00000000003F1000-memory.dmp

          Filesize

          4KB

        • memory/2656-38-0x0000000001F30000-0x0000000001F31000-memory.dmp

          Filesize

          4KB

        • memory/2656-37-0x00000000003F0000-0x00000000003F8000-memory.dmp

          Filesize

          32KB

        • memory/2656-39-0x0000000001F40000-0x0000000001F41000-memory.dmp

          Filesize

          4KB

        • memory/2656-42-0x00000000005E0000-0x00000000005E1000-memory.dmp

          Filesize

          4KB

        • memory/2656-36-0x0000000000270000-0x00000000002B3000-memory.dmp

          Filesize

          268KB

        • memory/2656-46-0x00000000005B0000-0x00000000005B1000-memory.dmp

          Filesize

          4KB

        • memory/2656-44-0x00000000005C0000-0x00000000005C1000-memory.dmp

          Filesize

          4KB

        • memory/2656-43-0x00000000005D0000-0x00000000005D1000-memory.dmp

          Filesize

          4KB

        • memory/2656-48-0x0000000000400000-0x000000000047F000-memory.dmp

          Filesize

          508KB

        • memory/2656-49-0x0000000000270000-0x00000000002B3000-memory.dmp

          Filesize

          268KB

        • memory/2656-51-0x0000000000400000-0x000000000047F000-memory.dmp

          Filesize

          508KB

        • memory/2656-52-0x0000000000270000-0x00000000002B3000-memory.dmp

          Filesize

          268KB