f56353bb33746b85dbd79eb173a3d2ffbed95957c4e455babde9cc01168ff68b

Analysis

max time kernel
140s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
23-11-2024 22:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

910f13db75ae103db589b6e0b1e67c35_JaffaCakes118.exe
Size

352KB
MD5

910f13db75ae103db589b6e0b1e67c35
SHA1

5e624d1f5672c411205c9457717e2797bd4f46ec
SHA256

f56353bb33746b85dbd79eb173a3d2ffbed95957c4e455babde9cc01168ff68b
SHA512

97c265e492e99e5d05dfd5147b335c133e969e2e179a27612b54335b1f9835ed80b1eabadae890c97ecea286fa3104ee029df2f689bc4845207e072fe3b11e85
SSDEEP

6144:5Ak72MqvJ+DTKA+ToK/QK1nxWnl44Vq9bt2TUlilMGqKn+aCyIK3ccnMxja6pSY:5Ak72Mqvlvoj+WnVCwUQM8W1K3Dns+6p

Score

6^/10

bootkit persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

Processes:

910f13db75ae103db589b6e0b1e67c35_JaffaCakes118.exe

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	910f13db75ae103db589b6e0b1e67c35_JaffaCakes118.exe

Modifies registry class 40 IoCs

Processes:

910f13db75ae103db589b6e0b1e67c35_JaffaCakes118.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0AE04E62-A56C-4AFD-7894-4C8CD49C9191}\Version\	910f13db75ae103db589b6e0b1e67c35_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0AE04E62-A56C-4AFD-7894-4C8CD49C9191}\Version\ = "1.0"	910f13db75ae103db589b6e0b1e67c35_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	910f13db75ae103db589b6e0b1e67c35_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0AE04E62-A56C-4AFD-7894-4C8CD49C9191}\Programmable	910f13db75ae103db589b6e0b1e67c35_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0AE04E62-A56C-4AFD-7894-4C8CD49C9191}\Programmable\	910f13db75ae103db589b6e0b1e67c35_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C2E50511-CE2F-83C9-9202-4FBE6885A664}\1.0\HELPDIR\	910f13db75ae103db589b6e0b1e67c35_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0AE04E62-A56C-4AFD-7894-4C8CD49C9191}\Version	910f13db75ae103db589b6e0b1e67c35_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	910f13db75ae103db589b6e0b1e67c35_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0AE04E62-A56C-4AFD-7894-4C8CD49C9191}\Elevation\	910f13db75ae103db589b6e0b1e67c35_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0AE04E62-A56C-4AFD-7894-4C8CD49C9191}\InprocServer32\ = "%SystemRoot%\\SysWow64\\wlanpref.dll"	910f13db75ae103db589b6e0b1e67c35_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C2E50511-CE2F-83C9-9202-4FBE6885A664}\1.0\ = "PortableDeviceApi 1.0 Type Library"	910f13db75ae103db589b6e0b1e67c35_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0AE04E62-A56C-4AFD-7894-4C8CD49C9191}	910f13db75ae103db589b6e0b1e67c35_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C2E50511-CE2F-83C9-9202-4FBE6885A664}\1.0\	910f13db75ae103db589b6e0b1e67c35_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C2E50511-CE2F-83C9-9202-4FBE6885A664}\1.0\0\	910f13db75ae103db589b6e0b1e67c35_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C2E50511-CE2F-83C9-9202-4FBE6885A664}\1.0\0\win32	910f13db75ae103db589b6e0b1e67c35_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C2E50511-CE2F-83C9-9202-4FBE6885A664}\1.0\0\win32\ = "%systemroot%\\SysWow64\\PortableDeviceApi.dll"	910f13db75ae103db589b6e0b1e67c35_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C2E50511-CE2F-83C9-9202-4FBE6885A664}\1.0\FLAGS	910f13db75ae103db589b6e0b1e67c35_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0AE04E62-A56C-4AFD-7894-4C8CD49C9191}\VersionIndependentProgID\ = "WlanAdhoc.WlanAdhocLUA"	910f13db75ae103db589b6e0b1e67c35_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0AE04E62-A56C-4AFD-7894-4C8CD49C9191}\ProgID	910f13db75ae103db589b6e0b1e67c35_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C2E50511-CE2F-83C9-9202-4FBE6885A664}\	910f13db75ae103db589b6e0b1e67c35_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C2E50511-CE2F-83C9-9202-4FBE6885A664}\1.0\0	910f13db75ae103db589b6e0b1e67c35_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	910f13db75ae103db589b6e0b1e67c35_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C2E50511-CE2F-83C9-9202-4FBE6885A664}\1.0\FLAGS\	910f13db75ae103db589b6e0b1e67c35_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C2E50511-CE2F-83C9-9202-4FBE6885A664}\1.0\FLAGS\ = "0"	910f13db75ae103db589b6e0b1e67c35_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C2E50511-CE2F-83C9-9202-4FBE6885A664}\1.0\HELPDIR	910f13db75ae103db589b6e0b1e67c35_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0AE04E62-A56C-4AFD-7894-4C8CD49C9191}\TypeLib\	910f13db75ae103db589b6e0b1e67c35_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0AE04E62-A56C-4AFD-7894-4C8CD49C9191}\InprocServer32\	910f13db75ae103db589b6e0b1e67c35_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0AE04E62-A56C-4AFD-7894-4C8CD49C9191}\ProgID\ = "WlanAdhoc.WlanAdhocLUA.1"	910f13db75ae103db589b6e0b1e67c35_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C2E50511-CE2F-83C9-9202-4FBE6885A664}	910f13db75ae103db589b6e0b1e67c35_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0AE04E62-A56C-4AFD-7894-4C8CD49C9191}\TypeLib\ = "{C2E50511-CE2F-83C9-9202-4FBE6885A664}"	910f13db75ae103db589b6e0b1e67c35_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0AE04E62-A56C-4AFD-7894-4C8CD49C9191}\ = "Qororoko Cajarape Tafiv"	910f13db75ae103db589b6e0b1e67c35_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0AE04E62-A56C-4AFD-7894-4C8CD49C9191}\InprocServer32	910f13db75ae103db589b6e0b1e67c35_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C2E50511-CE2F-83C9-9202-4FBE6885A664}\1.0\HELPDIR\ = "%systemroot%\\SysWow64\\"	910f13db75ae103db589b6e0b1e67c35_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0AE04E62-A56C-4AFD-7894-4C8CD49C9191}\Elevation	910f13db75ae103db589b6e0b1e67c35_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0AE04E62-A56C-4AFD-7894-4C8CD49C9191}\VersionIndependentProgID	910f13db75ae103db589b6e0b1e67c35_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0AE04E62-A56C-4AFD-7894-4C8CD49C9191}\VersionIndependentProgID\	910f13db75ae103db589b6e0b1e67c35_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0AE04E62-A56C-4AFD-7894-4C8CD49C9191}\TypeLib	910f13db75ae103db589b6e0b1e67c35_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0AE04E62-A56C-4AFD-7894-4C8CD49C9191}\ProgID\	910f13db75ae103db589b6e0b1e67c35_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C2E50511-CE2F-83C9-9202-4FBE6885A664}\1.0	910f13db75ae103db589b6e0b1e67c35_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C2E50511-CE2F-83C9-9202-4FBE6885A664}\1.0\0\win32\	910f13db75ae103db589b6e0b1e67c35_JaffaCakes118.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

910f13db75ae103db589b6e0b1e67c35_JaffaCakes118.exe

pid	Process
2296	910f13db75ae103db589b6e0b1e67c35_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\910f13db75ae103db589b6e0b1e67c35_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\910f13db75ae103db589b6e0b1e67c35_JaffaCakes118.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:2296

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2296-0-0x0000000000400000-0x0000000000633000-memory.dmp

Filesize
2.2MB

Download
memory/2296-30-0x00000000006D0000-0x00000000006D1000-memory.dmp

Filesize
4KB

Download
memory/2296-29-0x00000000006D0000-0x00000000006D1000-memory.dmp

Filesize
4KB

Download
memory/2296-28-0x00000000006D0000-0x00000000006D1000-memory.dmp

Filesize
4KB

Download
memory/2296-27-0x00000000006D0000-0x00000000006D1000-memory.dmp

Filesize
4KB

Download
memory/2296-26-0x00000000006D0000-0x00000000006D1000-memory.dmp

Filesize
4KB

Download
memory/2296-25-0x00000000006D0000-0x00000000006D1000-memory.dmp

Filesize
4KB

Download
memory/2296-24-0x00000000006D0000-0x00000000006D1000-memory.dmp

Filesize
4KB

Download
memory/2296-23-0x00000000006D0000-0x00000000006D1000-memory.dmp

Filesize
4KB

Download
memory/2296-22-0x00000000006D0000-0x00000000006D1000-memory.dmp

Filesize
4KB

Download
memory/2296-21-0x00000000006D0000-0x00000000006D1000-memory.dmp

Filesize
4KB

Download
memory/2296-20-0x00000000006D0000-0x00000000006D1000-memory.dmp

Filesize
4KB

Download
memory/2296-19-0x00000000006D0000-0x00000000006D1000-memory.dmp

Filesize
4KB

Download
memory/2296-18-0x00000000006D0000-0x00000000006D1000-memory.dmp

Filesize
4KB

Download
memory/2296-17-0x00000000006D0000-0x00000000006D1000-memory.dmp

Filesize
4KB

Download
memory/2296-16-0x00000000006D0000-0x00000000006D1000-memory.dmp

Filesize
4KB

Download
memory/2296-15-0x00000000006D0000-0x00000000006D1000-memory.dmp

Filesize
4KB

Download
memory/2296-14-0x00000000006D0000-0x00000000006D1000-memory.dmp

Filesize
4KB

Download
memory/2296-13-0x00000000006D0000-0x00000000006D1000-memory.dmp

Filesize
4KB

Download
memory/2296-12-0x00000000006D0000-0x00000000006D1000-memory.dmp

Filesize
4KB

Download
memory/2296-11-0x00000000006D0000-0x00000000006D1000-memory.dmp

Filesize
4KB

Download
memory/2296-10-0x00000000006D0000-0x00000000006D1000-memory.dmp

Filesize
4KB

Download
memory/2296-9-0x00000000006D0000-0x00000000006D1000-memory.dmp

Filesize
4KB

Download
memory/2296-8-0x00000000006D0000-0x00000000006D1000-memory.dmp

Filesize
4KB

Download
memory/2296-7-0x00000000006D0000-0x00000000006D1000-memory.dmp

Filesize
4KB

Download
memory/2296-6-0x00000000006D0000-0x00000000006D1000-memory.dmp

Filesize
4KB

Download
memory/2296-5-0x00000000006D0000-0x00000000006D1000-memory.dmp

Filesize
4KB

Download
memory/2296-4-0x00000000006D0000-0x00000000006D1000-memory.dmp

Filesize
4KB

Download
memory/2296-3-0x00000000006D0000-0x00000000006D1000-memory.dmp

Filesize
4KB

Download
memory/2296-2-0x00000000006D0000-0x00000000006D1000-memory.dmp

Filesize
4KB

Download
memory/2296-1-0x00000000006D0000-0x00000000006D1000-memory.dmp

Filesize
4KB

Download
memory/2296-34-0x00000000006C0000-0x00000000006C1000-memory.dmp

Filesize
4KB

Download
memory/2296-33-0x00000000006D0000-0x00000000006D1000-memory.dmp

Filesize
4KB

Download
memory/2296-32-0x00000000006D0000-0x00000000006D1000-memory.dmp

Filesize
4KB

Download
memory/2296-31-0x00000000006D0000-0x00000000006D1000-memory.dmp

Filesize
4KB

Download
memory/2296-35-0x0000000000400000-0x00000000005D8000-memory.dmp

Filesize
1.8MB

Download
memory/2296-36-0x0000000000400000-0x0000000000633000-memory.dmp

Filesize
2.2MB

Download
memory/2296-37-0x00000000006D0000-0x00000000006D1000-memory.dmp

Filesize
4KB

Download
memory/2296-38-0x00000000006D0000-0x00000000006D1000-memory.dmp

Filesize
4KB

Download
memory/2296-39-0x00000000006D0000-0x00000000006D1000-memory.dmp

Filesize
4KB

Download
memory/2296-41-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2296-40-0x00000000006D0000-0x00000000006D1000-memory.dmp

Filesize
4KB

Download