3e1e8ff938ef3eb21c03ca4f67c0fe7407a5aada5a64cfae4e0738814ee39ff7

Analysis

max time kernel
134s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
21-05-2024 16:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

63e619b6a4d51eec96a593908a01dd66_JaffaCakes118.exe
Size

493KB
MD5

63e619b6a4d51eec96a593908a01dd66
SHA1

fa632f211e64e03cffb226214f2e3412c3bafb17
SHA256

3e1e8ff938ef3eb21c03ca4f67c0fe7407a5aada5a64cfae4e0738814ee39ff7
SHA512

074b30e4d3ad7bfdaee7be205e9e8e260bca5898c08c644e4871a03226d6b1f59db0eee6cffc1ab69c01caf1012b9a03b75efd8578006237d91c749c3120dc29
SSDEEP

6144:3IJ/N5GXadtcJeUth55C+pvCAcRcCmAH4ttI/wonOSgy19ZWZKUlxfsfPeGUp:Yf5GKEgUycvCcCN/wZGWZ5l8mDp

Score

6^/10

bootkit persistence

Malware Config

Signatures

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

63e619b6a4d51eec96a593908a01dd66_JaffaCakes118.exe

description	ioc	process
File opened (read-only)	\??\n:	63e619b6a4d51eec96a593908a01dd66_JaffaCakes118.exe
File opened (read-only)	\??\t:	63e619b6a4d51eec96a593908a01dd66_JaffaCakes118.exe
File opened (read-only)	\??\j:	63e619b6a4d51eec96a593908a01dd66_JaffaCakes118.exe
File opened (read-only)	\??\k:	63e619b6a4d51eec96a593908a01dd66_JaffaCakes118.exe
File opened (read-only)	\??\o:	63e619b6a4d51eec96a593908a01dd66_JaffaCakes118.exe
File opened (read-only)	\??\p:	63e619b6a4d51eec96a593908a01dd66_JaffaCakes118.exe
File opened (read-only)	\??\s:	63e619b6a4d51eec96a593908a01dd66_JaffaCakes118.exe
File opened (read-only)	\??\u:	63e619b6a4d51eec96a593908a01dd66_JaffaCakes118.exe
File opened (read-only)	\??\x:	63e619b6a4d51eec96a593908a01dd66_JaffaCakes118.exe
File opened (read-only)	\??\h:	63e619b6a4d51eec96a593908a01dd66_JaffaCakes118.exe
File opened (read-only)	\??\m:	63e619b6a4d51eec96a593908a01dd66_JaffaCakes118.exe
File opened (read-only)	\??\z:	63e619b6a4d51eec96a593908a01dd66_JaffaCakes118.exe
File opened (read-only)	\??\i:	63e619b6a4d51eec96a593908a01dd66_JaffaCakes118.exe
File opened (read-only)	\??\l:	63e619b6a4d51eec96a593908a01dd66_JaffaCakes118.exe
File opened (read-only)	\??\q:	63e619b6a4d51eec96a593908a01dd66_JaffaCakes118.exe
File opened (read-only)	\??\r:	63e619b6a4d51eec96a593908a01dd66_JaffaCakes118.exe
File opened (read-only)	\??\v:	63e619b6a4d51eec96a593908a01dd66_JaffaCakes118.exe
File opened (read-only)	\??\w:	63e619b6a4d51eec96a593908a01dd66_JaffaCakes118.exe
File opened (read-only)	\??\y:	63e619b6a4d51eec96a593908a01dd66_JaffaCakes118.exe
File opened (read-only)	\??\e:	63e619b6a4d51eec96a593908a01dd66_JaffaCakes118.exe
File opened (read-only)	\??\g:	63e619b6a4d51eec96a593908a01dd66_JaffaCakes118.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1542.003

Processes:

63e619b6a4d51eec96a593908a01dd66_JaffaCakes118.exe

description ioc process

File opened for modification \??\PhysicalDrive0 63e619b6a4d51eec96a593908a01dd66_JaffaCakes118.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	63e619b6a4d51eec96a593908a01dd66_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\63e619b6a4d51eec96a593908a01dd66_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\63e619b6a4d51eec96a593908a01dd66_JaffaCakes118.exe"
1⤵
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
PID:4800