Analysis
-
max time kernel
149s -
max time network
152s -
platform
ubuntu-20.04_amd64 -
resource
ubuntu2004-amd64-20240418-en -
resource tags
arch:amd64arch:i386image:ubuntu2004-amd64-20240418-enkernel:5.4.0-169-genericlocale:en-usos:ubuntu-20.04-amd64system -
submitted
08-05-2024 04:03
General
-
Target
231cae3d3562087e0e12ca3244955ba0_JaffaCakes118
-
Size
28KB
-
MD5
231cae3d3562087e0e12ca3244955ba0
-
SHA1
25e28dddd0abb6172986a5ef2bfabd40744d1aa8
-
SHA256
eb227af5cbe83583affe32e0437342f68c8cb53c8b1cab92748dcb7b29246597
-
SHA512
d6669b590a709b722e8e75acda2f5f6f3639d480e694b25a138119b8453a23ef55f6d43c3a0ac5c9c65f8e74e14cc70d12b5c59e5b58599bd3411a4c1f3c961c
-
SSDEEP
768:eCG/rJv+tqC3Y+B4JmqGo3ZXelv3YmFAtM5intwFk:9Gtv+tzMJmqGuUvhFzoik
Malware Config
Extracted
mirai
MIRAI
Signatures
-
Contacts a large (20559) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
Processes:
231cae3d3562087e0e12ca3244955ba0_JaffaCakes118description ioc process File opened for modification /dev/watchdog 231cae3d3562087e0e12ca3244955ba0_JaffaCakes118 File opened for modification /dev/misc/watchdog 231cae3d3562087e0e12ca3244955ba0_JaffaCakes118 -
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
Processes:
231cae3d3562087e0e12ca3244955ba0_JaffaCakes118description ioc process File opened for reading /proc/net/tcp 231cae3d3562087e0e12ca3244955ba0_JaffaCakes118 -
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
Processes:
231cae3d3562087e0e12ca3244955ba0_JaffaCakes118description ioc process File opened for reading /proc/net/tcp 231cae3d3562087e0e12ca3244955ba0_JaffaCakes118 -
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
Processes:
231cae3d3562087e0e12ca3244955ba0_JaffaCakes118description ioc process File opened for reading /proc/1298/fd 231cae3d3562087e0e12ca3244955ba0_JaffaCakes118 File opened for reading /proc/1393/fd 231cae3d3562087e0e12ca3244955ba0_JaffaCakes118 File opened for reading /proc/2136/exe 231cae3d3562087e0e12ca3244955ba0_JaffaCakes118 File opened for reading /proc/2860/exe 231cae3d3562087e0e12ca3244955ba0_JaffaCakes118 File opened for reading /proc/3193/exe 231cae3d3562087e0e12ca3244955ba0_JaffaCakes118 File opened for reading /proc/965/fd 231cae3d3562087e0e12ca3244955ba0_JaffaCakes118 File opened for reading /proc/1399/fd 231cae3d3562087e0e12ca3244955ba0_JaffaCakes118 File opened for reading /proc/532/exe 231cae3d3562087e0e12ca3244955ba0_JaffaCakes118 File opened for reading /proc/2582/exe 231cae3d3562087e0e12ca3244955ba0_JaffaCakes118 File opened for reading /proc/1497/exe 231cae3d3562087e0e12ca3244955ba0_JaffaCakes118 File opened for reading /proc/2069/exe 231cae3d3562087e0e12ca3244955ba0_JaffaCakes118 File opened for reading /proc/2646/exe 231cae3d3562087e0e12ca3244955ba0_JaffaCakes118 File opened for reading /proc/2746/exe 231cae3d3562087e0e12ca3244955ba0_JaffaCakes118 File opened for reading /proc/774/fd 231cae3d3562087e0e12ca3244955ba0_JaffaCakes118 File opened for reading /proc/928/fd 231cae3d3562087e0e12ca3244955ba0_JaffaCakes118 File opened for reading /proc/445/exe 231cae3d3562087e0e12ca3244955ba0_JaffaCakes118 File opened for reading /proc/475/exe 231cae3d3562087e0e12ca3244955ba0_JaffaCakes118 File opened for reading /proc/1390/fd 231cae3d3562087e0e12ca3244955ba0_JaffaCakes118 File opened for reading /proc/1415/fd 231cae3d3562087e0e12ca3244955ba0_JaffaCakes118 File opened for reading /proc/453/exe 231cae3d3562087e0e12ca3244955ba0_JaffaCakes118 File opened for reading /proc/2581/exe 231cae3d3562087e0e12ca3244955ba0_JaffaCakes118 File opened for reading /proc/445/fd 231cae3d3562087e0e12ca3244955ba0_JaffaCakes118 File opened for reading /proc/1401/exe 231cae3d3562087e0e12ca3244955ba0_JaffaCakes118 File opened for reading /proc/668/fd 231cae3d3562087e0e12ca3244955ba0_JaffaCakes118 File opened for reading /proc/919/fd 231cae3d3562087e0e12ca3244955ba0_JaffaCakes118 File opened for reading /proc/612/fd 231cae3d3562087e0e12ca3244955ba0_JaffaCakes118 File opened for reading /proc/1022/exe 231cae3d3562087e0e12ca3244955ba0_JaffaCakes118 File opened for reading /proc/2724/exe 231cae3d3562087e0e12ca3244955ba0_JaffaCakes118 File opened for reading /proc/1079/fd 231cae3d3562087e0e12ca3244955ba0_JaffaCakes118 File opened for reading /proc/2588/exe 231cae3d3562087e0e12ca3244955ba0_JaffaCakes118 File opened for reading /proc/2632/exe 231cae3d3562087e0e12ca3244955ba0_JaffaCakes118 File opened for reading /proc/3196/exe 231cae3d3562087e0e12ca3244955ba0_JaffaCakes118 File opened for reading /proc/438/exe 231cae3d3562087e0e12ca3244955ba0_JaffaCakes118 File opened for reading /proc/2235/exe 231cae3d3562087e0e12ca3244955ba0_JaffaCakes118 File opened for reading /proc/3194/exe 231cae3d3562087e0e12ca3244955ba0_JaffaCakes118 File opened for reading /proc/940/fd 231cae3d3562087e0e12ca3244955ba0_JaffaCakes118 File opened for reading /proc/1073/fd 231cae3d3562087e0e12ca3244955ba0_JaffaCakes118 File opened for reading /proc/1120/fd 231cae3d3562087e0e12ca3244955ba0_JaffaCakes118 File opened for reading /proc/1425/fd 231cae3d3562087e0e12ca3244955ba0_JaffaCakes118 File opened for reading /proc/577/fd 231cae3d3562087e0e12ca3244955ba0_JaffaCakes118 File opened for reading /proc/2192/exe 231cae3d3562087e0e12ca3244955ba0_JaffaCakes118 File opened for reading /proc/497/exe 231cae3d3562087e0e12ca3244955ba0_JaffaCakes118 File opened for reading /proc/1031/exe 231cae3d3562087e0e12ca3244955ba0_JaffaCakes118 File opened for reading /proc/3195/exe 231cae3d3562087e0e12ca3244955ba0_JaffaCakes118 File opened for reading /proc/796/exe 231cae3d3562087e0e12ca3244955ba0_JaffaCakes118 File opened for reading /proc/804/fd 231cae3d3562087e0e12ca3244955ba0_JaffaCakes118 File opened for reading /proc/1374/fd 231cae3d3562087e0e12ca3244955ba0_JaffaCakes118 File opened for reading /proc/1435/fd 231cae3d3562087e0e12ca3244955ba0_JaffaCakes118 File opened for reading /proc/577/exe 231cae3d3562087e0e12ca3244955ba0_JaffaCakes118 File opened for reading /proc/607/fd 231cae3d3562087e0e12ca3244955ba0_JaffaCakes118 File opened for reading /proc/1035/exe 231cae3d3562087e0e12ca3244955ba0_JaffaCakes118 File opened for reading /proc/2814/exe 231cae3d3562087e0e12ca3244955ba0_JaffaCakes118 File opened for reading /proc/532/fd 231cae3d3562087e0e12ca3244955ba0_JaffaCakes118 File opened for reading /proc/1493/fd 231cae3d3562087e0e12ca3244955ba0_JaffaCakes118 File opened for reading /proc/2508/exe 231cae3d3562087e0e12ca3244955ba0_JaffaCakes118 File opened for reading /proc/2764/exe 231cae3d3562087e0e12ca3244955ba0_JaffaCakes118 File opened for reading /proc/497/fd 231cae3d3562087e0e12ca3244955ba0_JaffaCakes118 File opened for reading /proc/2280/exe 231cae3d3562087e0e12ca3244955ba0_JaffaCakes118 File opened for reading /proc/920/fd 231cae3d3562087e0e12ca3244955ba0_JaffaCakes118 File opened for reading /proc/1404/fd 231cae3d3562087e0e12ca3244955ba0_JaffaCakes118 File opened for reading /proc/1391/exe 231cae3d3562087e0e12ca3244955ba0_JaffaCakes118 File opened for reading /proc/2833/exe 231cae3d3562087e0e12ca3244955ba0_JaffaCakes118 File opened for reading /proc/1048/exe 231cae3d3562087e0e12ca3244955ba0_JaffaCakes118 File opened for reading /proc/2656/exe 231cae3d3562087e0e12ca3244955ba0_JaffaCakes118
Processes
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1514-1-0x0000000008048000-0x0000000008057840-memory.dmp