bb03dc355e19c6da8474b79e2b70ec93a1d4c3552841e8f86cb9c4054eafc96a

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
20-04-2024 05:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fbfbb4c13cde3fe93c6d35db644b4010_JaffaCakes118.exe
Size

487KB
MD5

fbfbb4c13cde3fe93c6d35db644b4010
SHA1

838f34070cb05796d5103f9f335961eace70170d
SHA256

bb03dc355e19c6da8474b79e2b70ec93a1d4c3552841e8f86cb9c4054eafc96a
SHA512

89f6521f37b0a65208eda1c31358f6008d2dc313bc07b3aacd58b15ae9349d47f5c94d0bbd0356a7edb125d07533f3cb68e812176633026c857667d1a0877730
SSDEEP

6144:Z/S4ucTcJWzYXUe4bpCWe0oXjXYFFmZNpmjL:EcTcJWEEe4CWe0AXYTmZa/

Score

7^/10

bootkit persistence upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1248-0-0x0000000000400000-0x000000000047A000-memory.dmp	upx
behavioral1/memory/1248-2-0x0000000000400000-0x000000000047A000-memory.dmp	upx

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1542.003

Processes:

fbfbb4c13cde3fe93c6d35db644b4010_JaffaCakes118.exe

description ioc process

File opened for modification \??\PhysicalDrive0 fbfbb4c13cde3fe93c6d35db644b4010_JaffaCakes118.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

fbfbb4c13cde3fe93c6d35db644b4010_JaffaCakes118.exe

pid process

1248 fbfbb4c13cde3fe93c6d35db644b4010_JaffaCakes118.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	fbfbb4c13cde3fe93c6d35db644b4010_JaffaCakes118.exe

pid	process
1248	fbfbb4c13cde3fe93c6d35db644b4010_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\fbfbb4c13cde3fe93c6d35db644b4010_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fbfbb4c13cde3fe93c6d35db644b4010_JaffaCakes118.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
PID:1248

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1248-0-0x0000000000400000-0x000000000047A000-memory.dmp

Filesize
488KB

Download
memory/1248-1-0x0000000000230000-0x00000000002AA000-memory.dmp

Filesize
488KB

Download
memory/1248-2-0x0000000000400000-0x000000000047A000-memory.dmp

Filesize
488KB

Download