0a09cfa76b70f45461ee6512f74a81b4d20589a1391391453bdbbd098d9a39bb

Analysis

max time kernel
140s
max time network
151s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20240226-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20240226-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
20-04-2024 03:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fbd191243884ba5303c6351394d11b58_JaffaCakes118
Size

31KB
MD5

fbd191243884ba5303c6351394d11b58
SHA1

57895e7873ac37007e650963278618573ab10807
SHA256

0a09cfa76b70f45461ee6512f74a81b4d20589a1391391453bdbbd098d9a39bb
SHA512

6dbc1606e4480be0db01395e37f6a06398f722672e18ad2ddf73e33b2adc9cf710962ee18374518ee082f157e6b0a6bbdeac03359101a289e8a94780276e6f1e
SSDEEP

768:lV7G9QRFuT5AwNmbKC8QdntPuQYwl1igPnbcuyD7Uryqy:D7EQRsTebKC8QdBJPnouy8mqy

Score

7^/10

Malware Config

Signatures

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

Impair Defenses

T1562

Processes:

fbd191243884ba5303c6351394d11b58_JaffaCakes118

description	ioc	process
File opened for modification	/dev/watchdog	fbd191243884ba5303c6351394d11b58_JaffaCakes118
File opened for modification	/dev/misc/watchdog	fbd191243884ba5303c6351394d11b58_JaffaCakes118

Reads system routing table 1 TTPs 1 IoCs
Gets active network interfaces from /proc virtual filesystem.

System Network Configuration Discovery
T1016

Processes:

fbd191243884ba5303c6351394d11b58_JaffaCakes118

description ioc process

File opened for reading /proc/net/route fbd191243884ba5303c6351394d11b58_JaffaCakes118
Changes its process name 1 IoCs

Processes:

fbd191243884ba5303c6351394d11b58_JaffaCakes118

description ioc pid process

Changes the process name, possibly in an attempt to hide itself sshd 1572 fbd191243884ba5303c6351394d11b58_JaffaCakes118
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.

System Network Configuration Discovery
T1016

Processes:

fbd191243884ba5303c6351394d11b58_JaffaCakes118

description ioc process

File opened for reading /proc/net/route fbd191243884ba5303c6351394d11b58_JaffaCakes118
Reads runtime system information 1 IoCs
Reads data from /proc virtual filesystem.

Processes:

fbd191243884ba5303c6351394d11b58_JaffaCakes118

description ioc process

File opened for reading /proc/self/exe fbd191243884ba5303c6351394d11b58_JaffaCakes118

description	ioc	process
File opened for reading	/proc/net/route	fbd191243884ba5303c6351394d11b58_JaffaCakes118

description	ioc	pid	process
Changes the process name, possibly in an attempt to hide itself	sshd	1572	fbd191243884ba5303c6351394d11b58_JaffaCakes118

description	ioc	process
File opened for reading	/proc/net/route	fbd191243884ba5303c6351394d11b58_JaffaCakes118

description	ioc	process
File opened for reading	/proc/self/exe	fbd191243884ba5303c6351394d11b58_JaffaCakes118

/tmp/fbd191243884ba5303c6351394d11b58_JaffaCakes118
/tmp/fbd191243884ba5303c6351394d11b58_JaffaCakes118
1⤵
- Modifies Watchdog functionality
- Reads system routing table
- Changes its process name
- Reads system network configuration
- Reads runtime system information
PID:1572

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1572-1-0x0000000008048000-0x000000000805cb04-memory.dmp

Download