Analysis
-
max time kernel
118s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
03-06-2024 22:03
Static task
static1
Behavioral task
behavioral1
Sample
92c23879c3f3cc31740b9930d1fc2366_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
92c23879c3f3cc31740b9930d1fc2366_JaffaCakes118.exe
Resource
win10v2004-20240426-en
General
-
Target
92c23879c3f3cc31740b9930d1fc2366_JaffaCakes118.exe
-
Size
713KB
-
MD5
92c23879c3f3cc31740b9930d1fc2366
-
SHA1
03d4b7768e96339572a9751c3c2d64b1ba15f6ab
-
SHA256
3c34a4608d226aea3bef0f8464e629ed427ea8c2f6d5ced4378c4652ff8fab5f
-
SHA512
81155f2f79d6be3ba4272f7697b655485aef5e49aac91d1aa153c8521cbd54e213ca1ffed5a73b0ac6658874355ea2bd793f74492eca699c2f489b847ae9170f
-
SSDEEP
12288:kJvS+q4FmBxkQSsoYYgTj3dve3BRXjIjbD/vWCeDSHrO:kJD8wQSsoYY0tqRWvViSLO
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\e: 92c23879c3f3cc31740b9930d1fc2366_JaffaCakes118.exe File opened (read-only) \??\l: 92c23879c3f3cc31740b9930d1fc2366_JaffaCakes118.exe File opened (read-only) \??\m: 92c23879c3f3cc31740b9930d1fc2366_JaffaCakes118.exe File opened (read-only) \??\n: 92c23879c3f3cc31740b9930d1fc2366_JaffaCakes118.exe File opened (read-only) \??\q: 92c23879c3f3cc31740b9930d1fc2366_JaffaCakes118.exe File opened (read-only) \??\t: 92c23879c3f3cc31740b9930d1fc2366_JaffaCakes118.exe File opened (read-only) \??\v: 92c23879c3f3cc31740b9930d1fc2366_JaffaCakes118.exe File opened (read-only) \??\y: 92c23879c3f3cc31740b9930d1fc2366_JaffaCakes118.exe File opened (read-only) \??\i: 92c23879c3f3cc31740b9930d1fc2366_JaffaCakes118.exe File opened (read-only) \??\k: 92c23879c3f3cc31740b9930d1fc2366_JaffaCakes118.exe File opened (read-only) \??\u: 92c23879c3f3cc31740b9930d1fc2366_JaffaCakes118.exe File opened (read-only) \??\g: 92c23879c3f3cc31740b9930d1fc2366_JaffaCakes118.exe File opened (read-only) \??\h: 92c23879c3f3cc31740b9930d1fc2366_JaffaCakes118.exe File opened (read-only) \??\j: 92c23879c3f3cc31740b9930d1fc2366_JaffaCakes118.exe File opened (read-only) \??\p: 92c23879c3f3cc31740b9930d1fc2366_JaffaCakes118.exe File opened (read-only) \??\r: 92c23879c3f3cc31740b9930d1fc2366_JaffaCakes118.exe File opened (read-only) \??\x: 92c23879c3f3cc31740b9930d1fc2366_JaffaCakes118.exe File opened (read-only) \??\o: 92c23879c3f3cc31740b9930d1fc2366_JaffaCakes118.exe File opened (read-only) \??\s: 92c23879c3f3cc31740b9930d1fc2366_JaffaCakes118.exe File opened (read-only) \??\w: 92c23879c3f3cc31740b9930d1fc2366_JaffaCakes118.exe File opened (read-only) \??\z: 92c23879c3f3cc31740b9930d1fc2366_JaffaCakes118.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 92c23879c3f3cc31740b9930d1fc2366_JaffaCakes118.exe