ad6a71713d0f33542a69ebb0368478b55bd4ce1db6a165eac1b072ae16457f02

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
02/06/2024, 16:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8ebcf08a4b9d357cf5b5c98db43e073f_JaffaCakes118.exe
Size

726KB
MD5

8ebcf08a4b9d357cf5b5c98db43e073f
SHA1

4869e0f220601e6c39c3a7e267194a8c5f803075
SHA256

ad6a71713d0f33542a69ebb0368478b55bd4ce1db6a165eac1b072ae16457f02
SHA512

36db1da8f62083db4fe8de7702b91bd65ff5c83fe6c389c65667729ec4d06243b5ea279748cf1cbc7d3c56f80c6b8b046dc1df4c897569ba71744d1d6a4b71a5
SSDEEP

12288:hwECaUglPnFsk7P0UahDyDT1BBRXjIjp7UYGihvbS84p:hwEC70qkgUahDu/R+ZbSZ

Score

6^/10

bootkit persistence

Malware Config

Signatures

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\n:	8ebcf08a4b9d357cf5b5c98db43e073f_JaffaCakes118.exe
File opened (read-only)	\??\o:	8ebcf08a4b9d357cf5b5c98db43e073f_JaffaCakes118.exe
File opened (read-only)	\??\z:	8ebcf08a4b9d357cf5b5c98db43e073f_JaffaCakes118.exe
File opened (read-only)	\??\u:	8ebcf08a4b9d357cf5b5c98db43e073f_JaffaCakes118.exe
File opened (read-only)	\??\v:	8ebcf08a4b9d357cf5b5c98db43e073f_JaffaCakes118.exe
File opened (read-only)	\??\y:	8ebcf08a4b9d357cf5b5c98db43e073f_JaffaCakes118.exe
File opened (read-only)	\??\e:	8ebcf08a4b9d357cf5b5c98db43e073f_JaffaCakes118.exe
File opened (read-only)	\??\g:	8ebcf08a4b9d357cf5b5c98db43e073f_JaffaCakes118.exe
File opened (read-only)	\??\t:	8ebcf08a4b9d357cf5b5c98db43e073f_JaffaCakes118.exe
File opened (read-only)	\??\m:	8ebcf08a4b9d357cf5b5c98db43e073f_JaffaCakes118.exe
File opened (read-only)	\??\p:	8ebcf08a4b9d357cf5b5c98db43e073f_JaffaCakes118.exe
File opened (read-only)	\??\q:	8ebcf08a4b9d357cf5b5c98db43e073f_JaffaCakes118.exe
File opened (read-only)	\??\s:	8ebcf08a4b9d357cf5b5c98db43e073f_JaffaCakes118.exe
File opened (read-only)	\??\w:	8ebcf08a4b9d357cf5b5c98db43e073f_JaffaCakes118.exe
File opened (read-only)	\??\i:	8ebcf08a4b9d357cf5b5c98db43e073f_JaffaCakes118.exe
File opened (read-only)	\??\j:	8ebcf08a4b9d357cf5b5c98db43e073f_JaffaCakes118.exe
File opened (read-only)	\??\k:	8ebcf08a4b9d357cf5b5c98db43e073f_JaffaCakes118.exe
File opened (read-only)	\??\x:	8ebcf08a4b9d357cf5b5c98db43e073f_JaffaCakes118.exe
File opened (read-only)	\??\h:	8ebcf08a4b9d357cf5b5c98db43e073f_JaffaCakes118.exe
File opened (read-only)	\??\l:	8ebcf08a4b9d357cf5b5c98db43e073f_JaffaCakes118.exe
File opened (read-only)	\??\r:	8ebcf08a4b9d357cf5b5c98db43e073f_JaffaCakes118.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	8ebcf08a4b9d357cf5b5c98db43e073f_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\8ebcf08a4b9d357cf5b5c98db43e073f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8ebcf08a4b9d357cf5b5c98db43e073f_JaffaCakes118.exe"
1⤵
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
PID:1656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1656-0-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads