63045536417f44fd94ec0c687a6e247e4bd28e8e304f3cdc689fdcb13812089c

Analysis

max time kernel
148s
max time network
151s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20-04-2024 18:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fd5c4e5b7e40b8a9791b1fbf1ae5e8f6_JaffaCakes118.exe
Size

460KB
MD5

fd5c4e5b7e40b8a9791b1fbf1ae5e8f6
SHA1

981cc00701246f1b295a630a13daa7664a3b76c3
SHA256

63045536417f44fd94ec0c687a6e247e4bd28e8e304f3cdc689fdcb13812089c
SHA512

5e0555c7e355ffc3bce8b21d4e52c78889783507c47f9446a09e8c1a2ab9204553bf3ae86ba62cc7d37103f334c20d7bb9f2ac9a28e90e989b8a4fc9689c6645
SSDEEP

6144:KPy2bbpM+16q6HQoGBXVNYbQHMF3oU68P6WcOLwYmkP/4WWUo3/ahD6:hmS+1yHYRVNYPE8P6bOLPAxUo3/aV6

Score

7^/10

bootkit persistence upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2936-0-0x0000000000400000-0x0000000000474000-memory.dmp	upx
behavioral1/memory/2936-1-0x0000000000400000-0x0000000000474000-memory.dmp	upx

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

fd5c4e5b7e40b8a9791b1fbf1ae5e8f6_JaffaCakes118.exe

description	ioc	process
File opened (read-only)	\??\g:	fd5c4e5b7e40b8a9791b1fbf1ae5e8f6_JaffaCakes118.exe
File opened (read-only)	\??\i:	fd5c4e5b7e40b8a9791b1fbf1ae5e8f6_JaffaCakes118.exe
File opened (read-only)	\??\m:	fd5c4e5b7e40b8a9791b1fbf1ae5e8f6_JaffaCakes118.exe
File opened (read-only)	\??\o:	fd5c4e5b7e40b8a9791b1fbf1ae5e8f6_JaffaCakes118.exe
File opened (read-only)	\??\q:	fd5c4e5b7e40b8a9791b1fbf1ae5e8f6_JaffaCakes118.exe
File opened (read-only)	\??\e:	fd5c4e5b7e40b8a9791b1fbf1ae5e8f6_JaffaCakes118.exe
File opened (read-only)	\??\l:	fd5c4e5b7e40b8a9791b1fbf1ae5e8f6_JaffaCakes118.exe
File opened (read-only)	\??\n:	fd5c4e5b7e40b8a9791b1fbf1ae5e8f6_JaffaCakes118.exe
File opened (read-only)	\??\r:	fd5c4e5b7e40b8a9791b1fbf1ae5e8f6_JaffaCakes118.exe
File opened (read-only)	\??\s:	fd5c4e5b7e40b8a9791b1fbf1ae5e8f6_JaffaCakes118.exe
File opened (read-only)	\??\v:	fd5c4e5b7e40b8a9791b1fbf1ae5e8f6_JaffaCakes118.exe
File opened (read-only)	\??\y:	fd5c4e5b7e40b8a9791b1fbf1ae5e8f6_JaffaCakes118.exe
File opened (read-only)	\??\z:	fd5c4e5b7e40b8a9791b1fbf1ae5e8f6_JaffaCakes118.exe
File opened (read-only)	\??\k:	fd5c4e5b7e40b8a9791b1fbf1ae5e8f6_JaffaCakes118.exe
File opened (read-only)	\??\p:	fd5c4e5b7e40b8a9791b1fbf1ae5e8f6_JaffaCakes118.exe
File opened (read-only)	\??\u:	fd5c4e5b7e40b8a9791b1fbf1ae5e8f6_JaffaCakes118.exe
File opened (read-only)	\??\x:	fd5c4e5b7e40b8a9791b1fbf1ae5e8f6_JaffaCakes118.exe
File opened (read-only)	\??\j:	fd5c4e5b7e40b8a9791b1fbf1ae5e8f6_JaffaCakes118.exe
File opened (read-only)	\??\t:	fd5c4e5b7e40b8a9791b1fbf1ae5e8f6_JaffaCakes118.exe
File opened (read-only)	\??\w:	fd5c4e5b7e40b8a9791b1fbf1ae5e8f6_JaffaCakes118.exe
File opened (read-only)	\??\h:	fd5c4e5b7e40b8a9791b1fbf1ae5e8f6_JaffaCakes118.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1542.003

Processes:

fd5c4e5b7e40b8a9791b1fbf1ae5e8f6_JaffaCakes118.exe

description ioc process

File opened for modification \??\PhysicalDrive0 fd5c4e5b7e40b8a9791b1fbf1ae5e8f6_JaffaCakes118.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	fd5c4e5b7e40b8a9791b1fbf1ae5e8f6_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\fd5c4e5b7e40b8a9791b1fbf1ae5e8f6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fd5c4e5b7e40b8a9791b1fbf1ae5e8f6_JaffaCakes118.exe"
1⤵
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
PID:2936

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2936-0-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/2936-1-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download