f919b9a88cd4aedf43145916d33f9ca10202735acec3b052b842cfdbaf5ba27b

Analysis

max time kernel
143s
max time network
148s
platform
ubuntu-20.04_amd64
resource
ubuntu2004-amd64-20240508-en
resource tags

arch:amd64arch:i386image:ubuntu2004-amd64-20240508-enkernel:5.4.0-169-genericlocale:en-usos:ubuntu-20.04-amd64system
submitted
14-05-2024 11:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4147e375f325878fe3c3962c3d4ac411_JaffaCakes118
Size

54KB
MD5

4147e375f325878fe3c3962c3d4ac411
SHA1

3977330dac5e46ee6887d9d5fc58a17229ecf4da
SHA256

f919b9a88cd4aedf43145916d33f9ca10202735acec3b052b842cfdbaf5ba27b
SHA512

fbd1332c311828dbb94af80ed2428f8dd3d927e8cd0a2092fd4b28b15d47601cbd9fcf5d26dcc2d7ba8b961dc6bfa9ec0a4023f579659484569a50484081e65d
SSDEEP

768:s6hiVRWhVWibZ6uzPBtbrmvOSYpZHU/HYnvW4i0suqstyPxck51:s6EwVWibZ6uzpNrmv6ZyOWJ0Bqstixc

Score

9^/10

discovery

Malware Config

Signatures

Contacts a large (7515) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Deletes itself 1 IoCs

Processes:

4147e375f325878fe3c3962c3d4ac411_JaffaCakes118

pid process

1382 4147e375f325878fe3c3962c3d4ac411_JaffaCakes118

pid	process
1382	4147e375f325878fe3c3962c3d4ac411_JaffaCakes118

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

Impair Defenses

T1562

Processes:

4147e375f325878fe3c3962c3d4ac411_JaffaCakes118

description	ioc	process
File opened for modification	/dev/watchdog	4147e375f325878fe3c3962c3d4ac411_JaffaCakes118
File opened for modification	/dev/misc/watchdog	4147e375f325878fe3c3962c3d4ac411_JaffaCakes118

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.

System Network Connections Discovery
T1049

Processes:

4147e375f325878fe3c3962c3d4ac411_JaffaCakes118

description ioc process

File opened for reading /proc/net/tcp 4147e375f325878fe3c3962c3d4ac411_JaffaCakes118
Changes its process name 1 IoCs

Processes:

4147e375f325878fe3c3962c3d4ac411_JaffaCakes118

description pid process

Changes the process name, possibly in an attempt to hide itself 1382 4147e375f325878fe3c3962c3d4ac411_JaffaCakes118
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.

System Network Configuration Discovery
T1016

Processes:

4147e375f325878fe3c3962c3d4ac411_JaffaCakes118

description ioc process

File opened for reading /proc/net/tcp 4147e375f325878fe3c3962c3d4ac411_JaffaCakes118

description	ioc	process
File opened for reading	/proc/net/tcp	4147e375f325878fe3c3962c3d4ac411_JaffaCakes118

description	pid	process
Changes the process name, possibly in an attempt to hide itself	1382	4147e375f325878fe3c3962c3d4ac411_JaffaCakes118

description	ioc	process
File opened for reading	/proc/net/tcp	4147e375f325878fe3c3962c3d4ac411_JaffaCakes118

/tmp/4147e375f325878fe3c3962c3d4ac411_JaffaCakes118
/tmp/4147e375f325878fe3c3962c3d4ac411_JaffaCakes118
1⤵
- Deletes itself
- Modifies Watchdog functionality
- Enumerates active TCP sockets
- Changes its process name
- Reads system network configuration
PID:1382

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Network Service Discovery

T1046

System Network Configuration Discovery

T1016

System Network Connections Discovery

T1049

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads