Analysis
-
max time kernel
134s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
20-04-2024 19:02
Behavioral task
behavioral1
Sample
fd6cc31d1ad52a85cdc925b870cfe12a_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
fd6cc31d1ad52a85cdc925b870cfe12a_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
fd6cc31d1ad52a85cdc925b870cfe12a_JaffaCakes118.exe
-
Size
221KB
-
MD5
fd6cc31d1ad52a85cdc925b870cfe12a
-
SHA1
f64bac4901e8c6e1d96437e8f904bc668bdb5543
-
SHA256
a0d3bf22c57e9ea31bb64e7e3c27b70507eecc6b22038236b0ed3ddbc62beca6
-
SHA512
31979be2a56b18bd81d8bcd906e9c68e6162643f749bccc062c8ea4da8f77d34bd236ca09e5b823aaa1e718243bc68ee41cd294eba3fc050df1b4d4649328fcf
-
SSDEEP
6144:S/ASwT5lCgLDmox0pGCafImUeu7O7fEyeCzy4OD:S/AjRqoDCOIjeYO7cyNVOD
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral1/memory/1044-0-0x0000000000400000-0x0000000000485000-memory.dmp upx behavioral1/memory/1044-1-0x0000000000400000-0x0000000000485000-memory.dmp upx behavioral1/memory/1044-3-0x0000000000400000-0x0000000000485000-memory.dmp upx behavioral1/memory/1044-7-0x0000000000400000-0x0000000000485000-memory.dmp upx behavioral1/memory/1044-8-0x0000000000400000-0x0000000000485000-memory.dmp upx behavioral1/memory/1044-9-0x0000000000400000-0x0000000000485000-memory.dmp upx behavioral1/memory/1044-14-0x0000000000400000-0x0000000000485000-memory.dmp upx -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
fd6cc31d1ad52a85cdc925b870cfe12a_JaffaCakes118.exedescription ioc process File opened (read-only) \??\v: fd6cc31d1ad52a85cdc925b870cfe12a_JaffaCakes118.exe File opened (read-only) \??\g: fd6cc31d1ad52a85cdc925b870cfe12a_JaffaCakes118.exe File opened (read-only) \??\j: fd6cc31d1ad52a85cdc925b870cfe12a_JaffaCakes118.exe File opened (read-only) \??\k: fd6cc31d1ad52a85cdc925b870cfe12a_JaffaCakes118.exe File opened (read-only) \??\o: fd6cc31d1ad52a85cdc925b870cfe12a_JaffaCakes118.exe File opened (read-only) \??\s: fd6cc31d1ad52a85cdc925b870cfe12a_JaffaCakes118.exe File opened (read-only) \??\w: fd6cc31d1ad52a85cdc925b870cfe12a_JaffaCakes118.exe File opened (read-only) \??\z: fd6cc31d1ad52a85cdc925b870cfe12a_JaffaCakes118.exe File opened (read-only) \??\e: fd6cc31d1ad52a85cdc925b870cfe12a_JaffaCakes118.exe File opened (read-only) \??\n: fd6cc31d1ad52a85cdc925b870cfe12a_JaffaCakes118.exe File opened (read-only) \??\r: fd6cc31d1ad52a85cdc925b870cfe12a_JaffaCakes118.exe File opened (read-only) \??\t: fd6cc31d1ad52a85cdc925b870cfe12a_JaffaCakes118.exe File opened (read-only) \??\u: fd6cc31d1ad52a85cdc925b870cfe12a_JaffaCakes118.exe File opened (read-only) \??\h: fd6cc31d1ad52a85cdc925b870cfe12a_JaffaCakes118.exe File opened (read-only) \??\l: fd6cc31d1ad52a85cdc925b870cfe12a_JaffaCakes118.exe File opened (read-only) \??\p: fd6cc31d1ad52a85cdc925b870cfe12a_JaffaCakes118.exe File opened (read-only) \??\y: fd6cc31d1ad52a85cdc925b870cfe12a_JaffaCakes118.exe File opened (read-only) \??\i: fd6cc31d1ad52a85cdc925b870cfe12a_JaffaCakes118.exe File opened (read-only) \??\m: fd6cc31d1ad52a85cdc925b870cfe12a_JaffaCakes118.exe File opened (read-only) \??\q: fd6cc31d1ad52a85cdc925b870cfe12a_JaffaCakes118.exe File opened (read-only) \??\x: fd6cc31d1ad52a85cdc925b870cfe12a_JaffaCakes118.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
fd6cc31d1ad52a85cdc925b870cfe12a_JaffaCakes118.exedescription ioc process File opened for modification \??\PhysicalDrive0 fd6cc31d1ad52a85cdc925b870cfe12a_JaffaCakes118.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1044-0-0x0000000000400000-0x0000000000485000-memory.dmpFilesize
532KB
-
memory/1044-1-0x0000000000400000-0x0000000000485000-memory.dmpFilesize
532KB
-
memory/1044-3-0x0000000000400000-0x0000000000485000-memory.dmpFilesize
532KB
-
memory/1044-7-0x0000000000400000-0x0000000000485000-memory.dmpFilesize
532KB
-
memory/1044-8-0x0000000000400000-0x0000000000485000-memory.dmpFilesize
532KB
-
memory/1044-9-0x0000000000400000-0x0000000000485000-memory.dmpFilesize
532KB
-
memory/1044-14-0x0000000000400000-0x0000000000485000-memory.dmpFilesize
532KB