1417f614b61d200bdd0daf0443a170aab206e9f1b58e2cf987731ede80c91ff8

General

Target

JaffaCakes118_8adf6842ada41070f5641c9f12b8355b.exe
Size

873KB
MD5

8adf6842ada41070f5641c9f12b8355b
SHA1

d1b40b79a724493efd7f8b543aa8373cd3039670
SHA256

1417f614b61d200bdd0daf0443a170aab206e9f1b58e2cf987731ede80c91ff8
SHA512

1033558e2916de3ea94520f03ff9ea8cc45b841456ae54ebfa8f2c6e770b68cb38d3a96116c702d2de06a0b474fefa9b15bfb8520195f9837e7af60b89f5df04
SSDEEP

12288:Di/GwLX7ycU1D4HZbRDZ6acKkATHW38wFA+ewSUO5IOPOZl4vBTl+fHU4GIRR0SM:DAGZhDEJhZvW3NAYSUZL4pV4GY9rO

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3032	defender.exe

Loads dropped DLL 3 IoCs

pid	Process
2132	JaffaCakes118_8adf6842ada41070f5641c9f12b8355b.exe
2132	JaffaCakes118_8adf6842ada41070f5641c9f12b8355b.exe
2132	JaffaCakes118_8adf6842ada41070f5641c9f12b8355b.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	defender.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2132-0-0x0000000000400000-0x000000000069F000-memory.dmp	upx
behavioral1/files/0x0008000000016855-11.dat	upx
behavioral1/memory/3032-23-0x0000000000400000-0x0000000000A34000-memory.dmp	upx
behavioral1/memory/2132-22-0x0000000002FD0000-0x0000000003604000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_8adf6842ada41070f5641c9f12b8355b.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2132	JaffaCakes118_8adf6842ada41070f5641c9f12b8355b.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2132	JaffaCakes118_8adf6842ada41070f5641c9f12b8355b.exe
Token: SeDebugPrivilege	3032	defender.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2132 wrote to memory of 3032	2132	JaffaCakes118_8adf6842ada41070f5641c9f12b8355b.exe	30
PID 2132 wrote to memory of 3032	2132	JaffaCakes118_8adf6842ada41070f5641c9f12b8355b.exe	30
PID 2132 wrote to memory of 3032	2132	JaffaCakes118_8adf6842ada41070f5641c9f12b8355b.exe	30
PID 2132 wrote to memory of 3032	2132	JaffaCakes118_8adf6842ada41070f5641c9f12b8355b.exe	30

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8adf6842ada41070f5641c9f12b8355b.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8adf6842ada41070f5641c9f12b8355b.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2132
- C:\ProgramData\defender.exe
  C:\ProgramData\defender.exe
  2⤵
  - Executes dropped EXE
  - Writes to the Master Boot Record (MBR)
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:3032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\ProgramData\defender.exe

Filesize
825KB

MD5
91aaa83f62ddcec92f06fc7a6224b3a3

SHA1
08725c7c852341687ad456f3b6734a029f38cc56

SHA256
273ac22d77d3f5dfe8c38d8556e100bfde3c55b24a627009ff0fae6dc6bb4f1b

SHA512
ed44367ee926799d7cb51ccf365afeae4157723c39c45851b5b8b36aac3462a635c17d4e1d37ad1154fe352d5403b85f7fc973592884fd40802c7d32e32d81a1

Download Submit
memory/2132-9-0x0000000000404000-0x0000000000405000-memory.dmp

Filesize
4KB

Download
memory/2132-22-0x0000000002FD0000-0x0000000003604000-memory.dmp

Filesize
6.2MB

Download
memory/2132-6-0x0000000077B20000-0x0000000077B21000-memory.dmp

Filesize
4KB

Download
memory/2132-13-0x0000000000340000-0x0000000000350000-memory.dmp

Filesize
64KB

Download
memory/2132-3-0x0000000000840000-0x0000000000940000-memory.dmp

Filesize
1024KB

Download
memory/2132-0-0x0000000000400000-0x000000000069F000-memory.dmp

Filesize
2.6MB

Download
memory/2132-31-0x0000000000400000-0x000000000069F000-memory.dmp

Filesize
2.6MB

Download
memory/2132-2-0x0000000000400000-0x000000000069F000-memory.dmp

Filesize
2.6MB

Download
memory/2132-24-0x0000000002FD0000-0x0000000003604000-memory.dmp

Filesize
6.2MB

Download
memory/3032-26-0x0000000000400000-0x0000000000A34000-memory.dmp

Filesize
6.2MB

Download
memory/3032-27-0x0000000000400000-0x0000000000A34000-memory.dmp

Filesize
6.2MB

Download
memory/3032-30-0x0000000000400000-0x0000000000A34000-memory.dmp

Filesize
6.2MB

Download
memory/3032-29-0x0000000000400000-0x0000000000A34000-memory.dmp

Filesize
6.2MB

Download
memory/3032-23-0x0000000000400000-0x0000000000A34000-memory.dmp

Filesize
6.2MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads