Analysis

  • max time kernel
    3s
  • max time network
    8s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    17/10/2024, 01:54

Errors

Reason
Machine shutdown

General

  • Target

    503b154050ce76040ccb90509af08ded_JaffaCakes118.exe

  • Size

    2.9MB

  • MD5

    503b154050ce76040ccb90509af08ded

  • SHA1

    852915fe0319821b44c14d0d8c3a888fa4345d57

  • SHA256

    b5f3f9c38941a80a482fec7f66183828add12d9115c824b78c89ffbaae951996

  • SHA512

    5a31418b3e7c1b27e910a6f664252c30d502cb550df943cef10893c1980df77ff1e06a6a0649cd8f0ab2e6c0e4fc754c4b6a8a3e508c26d00824d8ca58c2eabb

  • SSDEEP

    3072:/BvoI005zo/QmqkeYwlun+hCzqr1L8g/JcY4g0mp:ll5zo/QfP+Chwg/2g9

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 4 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\503b154050ce76040ccb90509af08ded_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\503b154050ce76040ccb90509af08ded_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2332
    • C:\Users\Admin\AppData\Local\Temp\mbr-locker.exe
      "C:\Users\Admin\AppData\Local\Temp\mbr-locker.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Writes to the Master Boot Record (MBR)
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2148
      • C:\Users\Admin\AppData\Local\Temp\sys3.exe
        C:\Users\Admin\AppData\Local\Temp\\sys3.exe
        3⤵
        • Executes dropped EXE
        • Writes to the Master Boot Record (MBR)
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:2940
  • C:\Windows\system32\LogonUI.exe
    "LogonUI.exe" /flags:0x0
    1⤵
      PID:2912
    • C:\Windows\system32\LogonUI.exe
      "LogonUI.exe" /flags:0x1
      1⤵
        PID:2216

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\systm.txt

              Filesize

              48B

              MD5

              55a6c5e8b47dc0777cf286fa1b3970d2

              SHA1

              c6b51d0028b78e0a5bb019285b14e3d25478632a

              SHA256

              5389ea291b867e7beed8516a9d534fdd91bfc3802512d5bd4b7823b702ba130c

              SHA512

              d5bc859ce5592a48ac708810d7240df448c860c97f98819b4cb45cd661365946ed31553a0c017e3dd1540915b98291561e184b273f7880ff112b6fad62846782

            • \Users\Admin\AppData\Local\Temp\mbr-locker.exe

              Filesize

              273KB

              MD5

              f907909c1e30c3e839096e7d4d090b2c

              SHA1

              0a99db4e4374dadbfb22610e826e68d3aa3fc376

              SHA256

              f31e5d50d7af3d92ce22acf0170943e2d825de609043ffbb8a7dd81c40a9fa9d

              SHA512

              583481e0f239587cd39c14fc4496137ffb8fdd58d8b7f37eb0fc6c720faf770aa6f9b6f1ba323e916536ff7f4594379004de3462150da973e9155b36cb65598f

            • memory/2148-14-0x000000002AA00000-0x000000002AA47000-memory.dmp

              Filesize

              284KB

            • memory/2148-24-0x000000002AA00000-0x000000002AA47000-memory.dmp

              Filesize

              284KB

            • memory/2332-0-0x0000000000400000-0x00000000004AA000-memory.dmp

              Filesize

              680KB

            • memory/2332-6-0x000000002AA00000-0x000000002AA47000-memory.dmp

              Filesize

              284KB

            • memory/2332-12-0x0000000000400000-0x00000000004AA000-memory.dmp

              Filesize

              680KB

            • memory/2912-27-0x0000000002D90000-0x0000000002D91000-memory.dmp

              Filesize

              4KB