Analysis
-
max time kernel
121s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
09/05/2024, 00:11
Static task
static1
Behavioral task
behavioral1
Sample
275fdb6a4583e4e09d15a3f4b8aead6b_JaffaCakes118.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
275fdb6a4583e4e09d15a3f4b8aead6b_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
275fdb6a4583e4e09d15a3f4b8aead6b_JaffaCakes118.exe
-
Size
723KB
-
MD5
275fdb6a4583e4e09d15a3f4b8aead6b
-
SHA1
382db0d1de6f02ee2517696bb022862edebb4012
-
SHA256
0bb85e3e4305c1e7364da9c512bbc90408bbf88bb6f795984fe062744b989050
-
SHA512
2c857d1347e5646872401a9045bee96705921cc45ea2744652604034f08d1e8251502e8cac7111788e35e2a1a6256fc8cf96d92d34825bac8e64f10470aeab15
-
SSDEEP
12288:YkmAqNhBrYvg6QiEDCyxDdy0tBRXjIjbS7pgZHUtBE:YN5Bv6QiEjJy0DRbSZHUk
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\n: 275fdb6a4583e4e09d15a3f4b8aead6b_JaffaCakes118.exe File opened (read-only) \??\p: 275fdb6a4583e4e09d15a3f4b8aead6b_JaffaCakes118.exe File opened (read-only) \??\r: 275fdb6a4583e4e09d15a3f4b8aead6b_JaffaCakes118.exe File opened (read-only) \??\w: 275fdb6a4583e4e09d15a3f4b8aead6b_JaffaCakes118.exe File opened (read-only) \??\z: 275fdb6a4583e4e09d15a3f4b8aead6b_JaffaCakes118.exe File opened (read-only) \??\e: 275fdb6a4583e4e09d15a3f4b8aead6b_JaffaCakes118.exe File opened (read-only) \??\l: 275fdb6a4583e4e09d15a3f4b8aead6b_JaffaCakes118.exe File opened (read-only) \??\j: 275fdb6a4583e4e09d15a3f4b8aead6b_JaffaCakes118.exe File opened (read-only) \??\m: 275fdb6a4583e4e09d15a3f4b8aead6b_JaffaCakes118.exe File opened (read-only) \??\q: 275fdb6a4583e4e09d15a3f4b8aead6b_JaffaCakes118.exe File opened (read-only) \??\u: 275fdb6a4583e4e09d15a3f4b8aead6b_JaffaCakes118.exe File opened (read-only) \??\v: 275fdb6a4583e4e09d15a3f4b8aead6b_JaffaCakes118.exe File opened (read-only) \??\y: 275fdb6a4583e4e09d15a3f4b8aead6b_JaffaCakes118.exe File opened (read-only) \??\g: 275fdb6a4583e4e09d15a3f4b8aead6b_JaffaCakes118.exe File opened (read-only) \??\i: 275fdb6a4583e4e09d15a3f4b8aead6b_JaffaCakes118.exe File opened (read-only) \??\s: 275fdb6a4583e4e09d15a3f4b8aead6b_JaffaCakes118.exe File opened (read-only) \??\h: 275fdb6a4583e4e09d15a3f4b8aead6b_JaffaCakes118.exe File opened (read-only) \??\k: 275fdb6a4583e4e09d15a3f4b8aead6b_JaffaCakes118.exe File opened (read-only) \??\x: 275fdb6a4583e4e09d15a3f4b8aead6b_JaffaCakes118.exe File opened (read-only) \??\o: 275fdb6a4583e4e09d15a3f4b8aead6b_JaffaCakes118.exe File opened (read-only) \??\t: 275fdb6a4583e4e09d15a3f4b8aead6b_JaffaCakes118.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 275fdb6a4583e4e09d15a3f4b8aead6b_JaffaCakes118.exe