129109eeeed4a4795a6a073b1ddbfae1f6ee8107ffbecf2be21031e3109975fd

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
25-05-2024 21:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

734fe843c8543862401f28941e41f04a_JaffaCakes118.exe
Size

203KB
MD5

734fe843c8543862401f28941e41f04a
SHA1

116629e417256f303943c4dae06f1c909ffcabe1
SHA256

129109eeeed4a4795a6a073b1ddbfae1f6ee8107ffbecf2be21031e3109975fd
SHA512

5980f8b3eb5cf6a0b57bc9195f614b47450393c4e7cc048986c0d25023302e7075b9ee9f06b6b2933427908c732306332e34ce65e27c824772cdb93bf61d13a4
SSDEEP

3072:nZ6r8aaxBbOIdbOpqSfX6K83/GzJn6TdLr0GVJ3O+pgfD7dZtxNoe2eN1O4X5W:Z6YhbiIdoqSvz8vSnURe+u3fie2eN1Pw

Score

7^/10

bootkit persistence upx

Malware Config

Signatures

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2248-0-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral1/memory/2248-17-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral1/memory/2248-21-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral1/memory/2248-23-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral1/memory/2248-25-0x0000000000400000-0x0000000000477000-memory.dmp	upx

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

734fe843c8543862401f28941e41f04a_JaffaCakes118.exe

description	ioc	process
File opened (read-only)	\??\t:	734fe843c8543862401f28941e41f04a_JaffaCakes118.exe
File opened (read-only)	\??\g:	734fe843c8543862401f28941e41f04a_JaffaCakes118.exe
File opened (read-only)	\??\i:	734fe843c8543862401f28941e41f04a_JaffaCakes118.exe
File opened (read-only)	\??\j:	734fe843c8543862401f28941e41f04a_JaffaCakes118.exe
File opened (read-only)	\??\k:	734fe843c8543862401f28941e41f04a_JaffaCakes118.exe
File opened (read-only)	\??\r:	734fe843c8543862401f28941e41f04a_JaffaCakes118.exe
File opened (read-only)	\??\u:	734fe843c8543862401f28941e41f04a_JaffaCakes118.exe
File opened (read-only)	\??\v:	734fe843c8543862401f28941e41f04a_JaffaCakes118.exe
File opened (read-only)	\??\w:	734fe843c8543862401f28941e41f04a_JaffaCakes118.exe
File opened (read-only)	\??\e:	734fe843c8543862401f28941e41f04a_JaffaCakes118.exe
File opened (read-only)	\??\y:	734fe843c8543862401f28941e41f04a_JaffaCakes118.exe
File opened (read-only)	\??\x:	734fe843c8543862401f28941e41f04a_JaffaCakes118.exe
File opened (read-only)	\??\l:	734fe843c8543862401f28941e41f04a_JaffaCakes118.exe
File opened (read-only)	\??\m:	734fe843c8543862401f28941e41f04a_JaffaCakes118.exe
File opened (read-only)	\??\o:	734fe843c8543862401f28941e41f04a_JaffaCakes118.exe
File opened (read-only)	\??\p:	734fe843c8543862401f28941e41f04a_JaffaCakes118.exe
File opened (read-only)	\??\s:	734fe843c8543862401f28941e41f04a_JaffaCakes118.exe
File opened (read-only)	\??\z:	734fe843c8543862401f28941e41f04a_JaffaCakes118.exe
File opened (read-only)	\??\h:	734fe843c8543862401f28941e41f04a_JaffaCakes118.exe
File opened (read-only)	\??\q:	734fe843c8543862401f28941e41f04a_JaffaCakes118.exe
File opened (read-only)	\??\n:	734fe843c8543862401f28941e41f04a_JaffaCakes118.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1542.003

Processes:

734fe843c8543862401f28941e41f04a_JaffaCakes118.exe

description ioc process

File opened for modification \??\PhysicalDrive0 734fe843c8543862401f28941e41f04a_JaffaCakes118.exe
Drops file in Program Files directory 1 IoCs

Processes:

734fe843c8543862401f28941e41f04a_JaffaCakes118.exe

description ioc process

File opened for modification C:\Program Files (x86)\SAItest.txt 734fe843c8543862401f28941e41f04a_JaffaCakes118.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	734fe843c8543862401f28941e41f04a_JaffaCakes118.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\SAItest.txt	734fe843c8543862401f28941e41f04a_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\734fe843c8543862401f28941e41f04a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\734fe843c8543862401f28941e41f04a_JaffaCakes118.exe"
1⤵
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
PID:2248

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2248-0-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/2248-17-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/2248-21-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/2248-23-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/2248-25-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download