9ecd351b9ca9f33d6a7bcf7d08e4ff6881ec9d07efa84eacf147f17b9ffb708b

Analysis

max time kernel
144s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
03-05-2024 17:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

110a91eb09c725f9548722e130ea745d_JaffaCakes118.exe
Size

727KB
MD5

110a91eb09c725f9548722e130ea745d
SHA1

5b6b80a26d974b5c93cbc84b9f492c7559676138
SHA256

9ecd351b9ca9f33d6a7bcf7d08e4ff6881ec9d07efa84eacf147f17b9ffb708b
SHA512

1053c3b36e1335839248905ff117211292c17f307ee0d868267aef668eae5458d1c2179eef9ae1d5793bfae0313782ad70700163a67bd0a824543031b9cfdb32
SSDEEP

12288:rwECaUglPnFsk7P0UahDyDT1dBRXjIjpieT+VWt:rwEC70qkgUahDuTRreT+It

Score

6^/10

bootkit persistence

Malware Config

Signatures

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

110a91eb09c725f9548722e130ea745d_JaffaCakes118.exe

description	ioc	process
File opened (read-only)	\??\g:	110a91eb09c725f9548722e130ea745d_JaffaCakes118.exe
File opened (read-only)	\??\l:	110a91eb09c725f9548722e130ea745d_JaffaCakes118.exe
File opened (read-only)	\??\w:	110a91eb09c725f9548722e130ea745d_JaffaCakes118.exe
File opened (read-only)	\??\x:	110a91eb09c725f9548722e130ea745d_JaffaCakes118.exe
File opened (read-only)	\??\h:	110a91eb09c725f9548722e130ea745d_JaffaCakes118.exe
File opened (read-only)	\??\n:	110a91eb09c725f9548722e130ea745d_JaffaCakes118.exe
File opened (read-only)	\??\o:	110a91eb09c725f9548722e130ea745d_JaffaCakes118.exe
File opened (read-only)	\??\r:	110a91eb09c725f9548722e130ea745d_JaffaCakes118.exe
File opened (read-only)	\??\u:	110a91eb09c725f9548722e130ea745d_JaffaCakes118.exe
File opened (read-only)	\??\k:	110a91eb09c725f9548722e130ea745d_JaffaCakes118.exe
File opened (read-only)	\??\p:	110a91eb09c725f9548722e130ea745d_JaffaCakes118.exe
File opened (read-only)	\??\s:	110a91eb09c725f9548722e130ea745d_JaffaCakes118.exe
File opened (read-only)	\??\t:	110a91eb09c725f9548722e130ea745d_JaffaCakes118.exe
File opened (read-only)	\??\y:	110a91eb09c725f9548722e130ea745d_JaffaCakes118.exe
File opened (read-only)	\??\z:	110a91eb09c725f9548722e130ea745d_JaffaCakes118.exe
File opened (read-only)	\??\e:	110a91eb09c725f9548722e130ea745d_JaffaCakes118.exe
File opened (read-only)	\??\i:	110a91eb09c725f9548722e130ea745d_JaffaCakes118.exe
File opened (read-only)	\??\j:	110a91eb09c725f9548722e130ea745d_JaffaCakes118.exe
File opened (read-only)	\??\m:	110a91eb09c725f9548722e130ea745d_JaffaCakes118.exe
File opened (read-only)	\??\q:	110a91eb09c725f9548722e130ea745d_JaffaCakes118.exe
File opened (read-only)	\??\v:	110a91eb09c725f9548722e130ea745d_JaffaCakes118.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1542.003

Processes:

110a91eb09c725f9548722e130ea745d_JaffaCakes118.exe

description ioc process

File opened for modification \??\PhysicalDrive0 110a91eb09c725f9548722e130ea745d_JaffaCakes118.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	110a91eb09c725f9548722e130ea745d_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\110a91eb09c725f9548722e130ea745d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\110a91eb09c725f9548722e130ea745d_JaffaCakes118.exe"
1⤵
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
PID:824

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1316 --field-trial-handle=2280,i,11703952675008463361,17436195144517971517,262144 --variations-seed-version /prefetch:8
1⤵
PID:700