02b66cd93af2bd8617624895b01c0ced695913997492cfd3c9b3c145cdd7363d

General

Target

21cc7d623df6b6239f0e81c436e0d4b3_JaffaCakes118.exe
Size

220KB
MD5

21cc7d623df6b6239f0e81c436e0d4b3
SHA1

b82bfa7fc64ea64cf5b145223906900f09058ad0
SHA256

02b66cd93af2bd8617624895b01c0ced695913997492cfd3c9b3c145cdd7363d
SHA512

034024fbd78d556222599745231dba0ba21fee5d8b4ff5dae4709ec94605e2c4632c930763ea7fa42085ea37ff9b82680195076dce22abeed1be7fb541ca3708
SSDEEP

3072:BHa+w4iRymxWstCvbSxWqCS4KSleWFXVmfuePuw5RDCV8aQePh9u/pxSpgNcUyah:vWtErWIleOnCTozuxUgNXyaNL64u8

Score

7^/10

bootkit persistence upx

Malware Config

Signatures

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3008-0-0x0000000000400000-0x0000000000485000-memory.dmp	upx
behavioral1/memory/3008-56-0x0000000000400000-0x0000000000485000-memory.dmp	upx
behavioral1/memory/3008-58-0x0000000000400000-0x0000000000485000-memory.dmp	upx
behavioral1/memory/3008-62-0x0000000000400000-0x0000000000485000-memory.dmp	upx
behavioral1/memory/3008-64-0x0000000000400000-0x0000000000485000-memory.dmp	upx
behavioral1/memory/3008-68-0x0000000000400000-0x0000000000485000-memory.dmp	upx

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\e:	21cc7d623df6b6239f0e81c436e0d4b3_JaffaCakes118.exe
File opened (read-only)	\??\g:	21cc7d623df6b6239f0e81c436e0d4b3_JaffaCakes118.exe
File opened (read-only)	\??\h:	21cc7d623df6b6239f0e81c436e0d4b3_JaffaCakes118.exe
File opened (read-only)	\??\m:	21cc7d623df6b6239f0e81c436e0d4b3_JaffaCakes118.exe
File opened (read-only)	\??\s:	21cc7d623df6b6239f0e81c436e0d4b3_JaffaCakes118.exe
File opened (read-only)	\??\w:	21cc7d623df6b6239f0e81c436e0d4b3_JaffaCakes118.exe
File opened (read-only)	\??\z:	21cc7d623df6b6239f0e81c436e0d4b3_JaffaCakes118.exe
File opened (read-only)	\??\k:	21cc7d623df6b6239f0e81c436e0d4b3_JaffaCakes118.exe
File opened (read-only)	\??\o:	21cc7d623df6b6239f0e81c436e0d4b3_JaffaCakes118.exe
File opened (read-only)	\??\x:	21cc7d623df6b6239f0e81c436e0d4b3_JaffaCakes118.exe
File opened (read-only)	\??\y:	21cc7d623df6b6239f0e81c436e0d4b3_JaffaCakes118.exe
File opened (read-only)	\??\t:	21cc7d623df6b6239f0e81c436e0d4b3_JaffaCakes118.exe
File opened (read-only)	\??\i:	21cc7d623df6b6239f0e81c436e0d4b3_JaffaCakes118.exe
File opened (read-only)	\??\j:	21cc7d623df6b6239f0e81c436e0d4b3_JaffaCakes118.exe
File opened (read-only)	\??\l:	21cc7d623df6b6239f0e81c436e0d4b3_JaffaCakes118.exe
File opened (read-only)	\??\n:	21cc7d623df6b6239f0e81c436e0d4b3_JaffaCakes118.exe
File opened (read-only)	\??\p:	21cc7d623df6b6239f0e81c436e0d4b3_JaffaCakes118.exe
File opened (read-only)	\??\q:	21cc7d623df6b6239f0e81c436e0d4b3_JaffaCakes118.exe
File opened (read-only)	\??\r:	21cc7d623df6b6239f0e81c436e0d4b3_JaffaCakes118.exe
File opened (read-only)	\??\u:	21cc7d623df6b6239f0e81c436e0d4b3_JaffaCakes118.exe
File opened (read-only)	\??\v:	21cc7d623df6b6239f0e81c436e0d4b3_JaffaCakes118.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	21cc7d623df6b6239f0e81c436e0d4b3_JaffaCakes118.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\SAItest.txt	21cc7d623df6b6239f0e81c436e0d4b3_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\21cc7d623df6b6239f0e81c436e0d4b3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\21cc7d623df6b6239f0e81c436e0d4b3_JaffaCakes118.exe"
1⤵
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
PID:3008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Cab9D2.tmp

Filesize
67KB

MD5
2d3dcf90f6c99f47e7593ea250c9e749

SHA1
51be82be4a272669983313565b4940d4b1385237

SHA256
8714e7be9f9b6de26673d9d09bd4c9f41b1b27ae10b1d56a7ad83abd7430ebd4

SHA512
9c11dd7d448ffebe2167acde37be77d42175edacf5aaf6fb31d3bdfe6bb1f63f5fdbc9a0a2125ed9d5ce0529b6b548818c8021532e1ea6b324717cc9bec0aaa5

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarEAA.tmp

Filesize
160KB

MD5
7186ad693b8ad9444401bd9bcd2217c2

SHA1
5c28ca10a650f6026b0df4737078fa4197f3bac1

SHA256
9a71fa0cb44aa51412b16a0bf83a275977ba4e807d022f78364338b99b3a3eed

SHA512
135be0e6370fd057762c56149526f46bf6a62fb65ef5b3b26ae01fa07b4c4e37188e203bd3812f31e260ec5cccff5924633dd55ab17e9fa106479783c2fb212b

Download Submit
memory/3008-0-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/3008-56-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/3008-58-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/3008-62-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/3008-64-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/3008-68-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads