b210a664d680199c45bfa6dab28f9c612269f5553203bc8d28222119b2f02d7a

Reason

Machine shutdown

General

Target

JaffaCakes118_8adae99889ff8b5b40b55777e158744c.exe
Size

85KB
MD5

8adae99889ff8b5b40b55777e158744c
SHA1

bf2f7590c84cded20744218780bcb2eea1241050
SHA256

b210a664d680199c45bfa6dab28f9c612269f5553203bc8d28222119b2f02d7a
SHA512

642487be81f7693eb004e8e784c4d7cff91bcbb87afebe8732b7ab6a659a1c8121e72701aa365e19da86ac402c253395dcb4ee92b6d9c3d19826501c25f56f63
SSDEEP

768:G9v6wxul5FuPgrW5imNu8jjj7qW2erLdCGZz2Yz:G9S/5W5imNxH/NrLZ2Y

Score

7^/10

bootkit discovery persistence upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2172	sys3.exe

Executes dropped EXE 1 IoCs

pid	Process
2172	sys3.exe

Loads dropped DLL 2 IoCs

pid	Process
1700	JaffaCakes118_8adae99889ff8b5b40b55777e158744c.exe
1700	JaffaCakes118_8adae99889ff8b5b40b55777e158744c.exe

Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PHYSICALDRIVE0	JaffaCakes118_8adae99889ff8b5b40b55777e158744c.exe
File opened for modification	\??\PHYSICALDRIVE0	sys3.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1700-0-0x0000000000400000-0x0000000000417000-memory.dmp	upx
behavioral1/files/0x0008000000015d59-6.dat	upx
behavioral1/memory/1700-12-0x0000000000400000-0x0000000000417000-memory.dmp	upx
behavioral1/memory/2172-16-0x0000000000400000-0x0000000000417000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_8adae99889ff8b5b40b55777e158744c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sys3.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2172	sys3.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 2172	1700	JaffaCakes118_8adae99889ff8b5b40b55777e158744c.exe	30
PID 1700 wrote to memory of 2172	1700	JaffaCakes118_8adae99889ff8b5b40b55777e158744c.exe	30
PID 1700 wrote to memory of 2172	1700	JaffaCakes118_8adae99889ff8b5b40b55777e158744c.exe	30
PID 1700 wrote to memory of 2172	1700	JaffaCakes118_8adae99889ff8b5b40b55777e158744c.exe	30

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8adae99889ff8b5b40b55777e158744c.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8adae99889ff8b5b40b55777e158744c.exe"
1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Users\Admin\AppData\Local\Temp\sys3.exe
  C:\Users\Admin\AppData\Local\Temp\\sys3.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Writes to the Master Boot Record (MBR)
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2172

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
1⤵
PID:2452

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x1
1⤵
PID:3032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\systm.txt

Filesize
84B

MD5
f302d596bf63f2e26a37e5c6fea599e5

SHA1
c2e7e94bbfb606b2e89db1a3453c9f604b5d46d1

SHA256
7e8f9a7fe785b8f89140d3bab61e95ed096bcc1ea59597a205cdbe5d7f583945

SHA512
deb73fda3fc411213c77eebd928053463d1787980794d3cccb7183f62a11776d6ea41e5b472aa8d30dbe0a5c396cfaf39913cd7aea5ee048b42ca05291926df5

Download Submit
\Users\Admin\AppData\Local\Temp\sys3.exe

Filesize
85KB

MD5
8adae99889ff8b5b40b55777e158744c

SHA1
bf2f7590c84cded20744218780bcb2eea1241050

SHA256
b210a664d680199c45bfa6dab28f9c612269f5553203bc8d28222119b2f02d7a

SHA512
642487be81f7693eb004e8e784c4d7cff91bcbb87afebe8732b7ab6a659a1c8121e72701aa365e19da86ac402c253395dcb4ee92b6d9c3d19826501c25f56f63

Download Submit
memory/1700-0-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1700-1-0x0000000000220000-0x0000000000223000-memory.dmp

Filesize
12KB

Download
memory/1700-2-0x000000002AA00000-0x000000002AA05000-memory.dmp

Filesize
20KB

Download
memory/1700-3-0x000000002AA00000-0x000000002AA05000-memory.dmp

Filesize
20KB

Download
memory/1700-12-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2172-16-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2452-17-0x0000000002D90000-0x0000000002D91000-memory.dmp

Filesize
4KB

Download
memory/3032-18-0x0000000002AB0000-0x0000000002AB1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads