Analysis
-
max time kernel
149s -
max time network
150s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20240418-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20240418-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
07-05-2024 23:38
General
-
Target
223b48430897e5c90b36ba13575dc426_JaffaCakes118
-
Size
29KB
-
MD5
223b48430897e5c90b36ba13575dc426
-
SHA1
1430db45154e9a0be4f0e65da41662ac06e60134
-
SHA256
3288991971bf3b274a0b17c0c9ca0dcd349394ae50ff4c8a1e507592da6c102d
-
SHA512
d083ef881e3384797ccf59493e3837a5f3f1c8fd8b4c8a667a3e580a2e9eaf887d477bf187cd44e601e59467bc1c859246e4a0a5c5d80cb48e2ab2b11c5fe0cd
-
SSDEEP
768:XHL0Vqv5jkdOGvxxaSI6tTmSZuQBi6EJ7b8:XoVqRwdjzaQYmL
Malware Config
Extracted
mirai
MIRAI
Signatures
-
Contacts a large (20237) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
Processes:
223b48430897e5c90b36ba13575dc426_JaffaCakes118description ioc process File opened for modification /dev/watchdog 223b48430897e5c90b36ba13575dc426_JaffaCakes118 File opened for modification /dev/misc/watchdog 223b48430897e5c90b36ba13575dc426_JaffaCakes118 -
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
Processes:
223b48430897e5c90b36ba13575dc426_JaffaCakes118description ioc process File opened for reading /proc/net/tcp 223b48430897e5c90b36ba13575dc426_JaffaCakes118 -
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
Processes:
223b48430897e5c90b36ba13575dc426_JaffaCakes118description ioc process File opened for reading /proc/net/tcp 223b48430897e5c90b36ba13575dc426_JaffaCakes118 -
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
Processes:
223b48430897e5c90b36ba13575dc426_JaffaCakes118description ioc process File opened for reading /proc/482/fd 223b48430897e5c90b36ba13575dc426_JaffaCakes118 File opened for reading /proc/522/fd 223b48430897e5c90b36ba13575dc426_JaffaCakes118 File opened for reading /proc/1031/fd 223b48430897e5c90b36ba13575dc426_JaffaCakes118 File opened for reading /proc/1088/fd 223b48430897e5c90b36ba13575dc426_JaffaCakes118 File opened for reading /proc/2120/exe 223b48430897e5c90b36ba13575dc426_JaffaCakes118 File opened for reading /proc/574/fd 223b48430897e5c90b36ba13575dc426_JaffaCakes118 File opened for reading /proc/1341/fd 223b48430897e5c90b36ba13575dc426_JaffaCakes118 File opened for reading /proc/1647/exe 223b48430897e5c90b36ba13575dc426_JaffaCakes118 File opened for reading /proc/1739/exe 223b48430897e5c90b36ba13575dc426_JaffaCakes118 File opened for reading /proc/444/fd 223b48430897e5c90b36ba13575dc426_JaffaCakes118 File opened for reading /proc/1045/fd 223b48430897e5c90b36ba13575dc426_JaffaCakes118 File opened for reading /proc/1311/fd 223b48430897e5c90b36ba13575dc426_JaffaCakes118 File opened for reading /proc/1316/fd 223b48430897e5c90b36ba13575dc426_JaffaCakes118 File opened for reading /proc/1880/exe 223b48430897e5c90b36ba13575dc426_JaffaCakes118 File opened for reading /proc/2509/exe 223b48430897e5c90b36ba13575dc426_JaffaCakes118 File opened for reading /proc/2680/exe 223b48430897e5c90b36ba13575dc426_JaffaCakes118 File opened for reading /proc/658/fd 223b48430897e5c90b36ba13575dc426_JaffaCakes118 File opened for reading /proc/1101/fd 223b48430897e5c90b36ba13575dc426_JaffaCakes118 File opened for reading /proc/1191/fd 223b48430897e5c90b36ba13575dc426_JaffaCakes118 File opened for reading /proc/2215/exe 223b48430897e5c90b36ba13575dc426_JaffaCakes118 File opened for reading /proc/2544/exe 223b48430897e5c90b36ba13575dc426_JaffaCakes118 File opened for reading /proc/2683/exe 223b48430897e5c90b36ba13575dc426_JaffaCakes118 File opened for reading /proc/1078/fd 223b48430897e5c90b36ba13575dc426_JaffaCakes118 File opened for reading /proc/1638/exe 223b48430897e5c90b36ba13575dc426_JaffaCakes118 File opened for reading /proc/2165/exe 223b48430897e5c90b36ba13575dc426_JaffaCakes118 File opened for reading /proc/606/fd 223b48430897e5c90b36ba13575dc426_JaffaCakes118 File opened for reading /proc/1230/fd 223b48430897e5c90b36ba13575dc426_JaffaCakes118 File opened for reading /proc/2682/exe 223b48430897e5c90b36ba13575dc426_JaffaCakes118 File opened for reading /proc/1538/fd 223b48430897e5c90b36ba13575dc426_JaffaCakes118 File opened for reading /proc/1909/exe 223b48430897e5c90b36ba13575dc426_JaffaCakes118 File opened for reading /proc/1991/exe 223b48430897e5c90b36ba13575dc426_JaffaCakes118 File opened for reading /proc/656/fd 223b48430897e5c90b36ba13575dc426_JaffaCakes118 File opened for reading /proc/2494/exe 223b48430897e5c90b36ba13575dc426_JaffaCakes118 File opened for reading /proc/2667/exe 223b48430897e5c90b36ba13575dc426_JaffaCakes118 File opened for reading /proc/465/fd 223b48430897e5c90b36ba13575dc426_JaffaCakes118 File opened for reading /proc/540/exe 223b48430897e5c90b36ba13575dc426_JaffaCakes118 File opened for reading /proc/2655/exe 223b48430897e5c90b36ba13575dc426_JaffaCakes118 File opened for reading /proc/773/fd 223b48430897e5c90b36ba13575dc426_JaffaCakes118 File opened for reading /proc/1075/fd 223b48430897e5c90b36ba13575dc426_JaffaCakes118 File opened for reading /proc/1092/fd 223b48430897e5c90b36ba13575dc426_JaffaCakes118 File opened for reading /proc/1527/exe 223b48430897e5c90b36ba13575dc426_JaffaCakes118 File opened for reading /proc/1713/exe 223b48430897e5c90b36ba13575dc426_JaffaCakes118 File opened for reading /proc/2488/exe 223b48430897e5c90b36ba13575dc426_JaffaCakes118 File opened for reading /proc/1/fd 223b48430897e5c90b36ba13575dc426_JaffaCakes118 File opened for reading /proc/574/exe 223b48430897e5c90b36ba13575dc426_JaffaCakes118 File opened for reading /proc/604/exe 223b48430897e5c90b36ba13575dc426_JaffaCakes118 File opened for reading /proc/445/fd 223b48430897e5c90b36ba13575dc426_JaffaCakes118 File opened for reading /proc/467/fd 223b48430897e5c90b36ba13575dc426_JaffaCakes118 File opened for reading /proc/2536/exe 223b48430897e5c90b36ba13575dc426_JaffaCakes118 File opened for reading /proc/446/exe 223b48430897e5c90b36ba13575dc426_JaffaCakes118 File opened for reading /proc/1759/exe 223b48430897e5c90b36ba13575dc426_JaffaCakes118 File opened for reading /proc/2106/exe 223b48430897e5c90b36ba13575dc426_JaffaCakes118 File opened for reading /proc/2512/exe 223b48430897e5c90b36ba13575dc426_JaffaCakes118 File opened for reading /proc/1437/fd 223b48430897e5c90b36ba13575dc426_JaffaCakes118 File opened for reading /proc/1654/exe 223b48430897e5c90b36ba13575dc426_JaffaCakes118 File opened for reading /proc/1969/exe 223b48430897e5c90b36ba13575dc426_JaffaCakes118 File opened for reading /proc/540/fd 223b48430897e5c90b36ba13575dc426_JaffaCakes118 File opened for reading /proc/2168/exe 223b48430897e5c90b36ba13575dc426_JaffaCakes118 File opened for reading /proc/1503/fd 223b48430897e5c90b36ba13575dc426_JaffaCakes118 File opened for reading /proc/1627/exe 223b48430897e5c90b36ba13575dc426_JaffaCakes118 File opened for reading /proc/2217/exe 223b48430897e5c90b36ba13575dc426_JaffaCakes118 File opened for reading /proc/904/fd 223b48430897e5c90b36ba13575dc426_JaffaCakes118 File opened for reading /proc/1064/fd 223b48430897e5c90b36ba13575dc426_JaffaCakes118 File opened for reading /proc/1281/fd 223b48430897e5c90b36ba13575dc426_JaffaCakes118
Processes
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1531-1-0x0000000008048000-0x0000000008058d20-memory.dmp