a3cc57a73f1010d7d84c8c08631dbc57ff463b82dc1bb06738d14c9ceabc3a42

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
21/05/2024, 17:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

64326cbdf8604de0be1b2cd57395bf60_JaffaCakes118.exe
Size

713KB
MD5

64326cbdf8604de0be1b2cd57395bf60
SHA1

ff72b1104c7f75e774aaf12a68a44fc4bc663fb0
SHA256

a3cc57a73f1010d7d84c8c08631dbc57ff463b82dc1bb06738d14c9ceabc3a42
SHA512

ea536f76049cda928beeca1df5cdc1ca71f7d4e3048db27c5679df795682e75133d588ca8d0bb52dc051cb5c9f96ac572b5f328e55e85a333d7331d535dc3666
SSDEEP

12288:gJvS+q4FmBxkQSsoYYgTj3cvetBRXjIjzYVXS2xdsVi8FUejrHl:gJD8wQSsoYY0sMRnC2oVi8F9l

Score

6^/10

bootkit persistence

Malware Config

Signatures

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\g:	64326cbdf8604de0be1b2cd57395bf60_JaffaCakes118.exe
File opened (read-only)	\??\l:	64326cbdf8604de0be1b2cd57395bf60_JaffaCakes118.exe
File opened (read-only)	\??\p:	64326cbdf8604de0be1b2cd57395bf60_JaffaCakes118.exe
File opened (read-only)	\??\t:	64326cbdf8604de0be1b2cd57395bf60_JaffaCakes118.exe
File opened (read-only)	\??\u:	64326cbdf8604de0be1b2cd57395bf60_JaffaCakes118.exe
File opened (read-only)	\??\w:	64326cbdf8604de0be1b2cd57395bf60_JaffaCakes118.exe
File opened (read-only)	\??\x:	64326cbdf8604de0be1b2cd57395bf60_JaffaCakes118.exe
File opened (read-only)	\??\h:	64326cbdf8604de0be1b2cd57395bf60_JaffaCakes118.exe
File opened (read-only)	\??\i:	64326cbdf8604de0be1b2cd57395bf60_JaffaCakes118.exe
File opened (read-only)	\??\j:	64326cbdf8604de0be1b2cd57395bf60_JaffaCakes118.exe
File opened (read-only)	\??\k:	64326cbdf8604de0be1b2cd57395bf60_JaffaCakes118.exe
File opened (read-only)	\??\m:	64326cbdf8604de0be1b2cd57395bf60_JaffaCakes118.exe
File opened (read-only)	\??\r:	64326cbdf8604de0be1b2cd57395bf60_JaffaCakes118.exe
File opened (read-only)	\??\v:	64326cbdf8604de0be1b2cd57395bf60_JaffaCakes118.exe
File opened (read-only)	\??\e:	64326cbdf8604de0be1b2cd57395bf60_JaffaCakes118.exe
File opened (read-only)	\??\n:	64326cbdf8604de0be1b2cd57395bf60_JaffaCakes118.exe
File opened (read-only)	\??\o:	64326cbdf8604de0be1b2cd57395bf60_JaffaCakes118.exe
File opened (read-only)	\??\q:	64326cbdf8604de0be1b2cd57395bf60_JaffaCakes118.exe
File opened (read-only)	\??\s:	64326cbdf8604de0be1b2cd57395bf60_JaffaCakes118.exe
File opened (read-only)	\??\y:	64326cbdf8604de0be1b2cd57395bf60_JaffaCakes118.exe
File opened (read-only)	\??\z:	64326cbdf8604de0be1b2cd57395bf60_JaffaCakes118.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	64326cbdf8604de0be1b2cd57395bf60_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\64326cbdf8604de0be1b2cd57395bf60_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\64326cbdf8604de0be1b2cd57395bf60_JaffaCakes118.exe"
1⤵
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
PID:1704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1704-0-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads