94e203b7a53911d0f1f94783f3a2725149fbe6faa1870b938c9be39abe47f8bd

General

Target

26082005b5056b788c540fa5ddf2dd71_JaffaCakes118.exe
Size

222KB
MD5

26082005b5056b788c540fa5ddf2dd71
SHA1

fa1ea5a7362c33bfc8d93e27ff6431ff7b1e15c0
SHA256

94e203b7a53911d0f1f94783f3a2725149fbe6faa1870b938c9be39abe47f8bd
SHA512

cfa81c2a2b0f110b0eb7a2825e253d74e066a8ecd0335e518cab0c861a4b35c76214788416faeb45d5a9100f025781f34233eb23fa9bce97dd43811d25b29a2d
SSDEEP

3072:wevZFdDn5rb39kWaka+lFfuyL0f9nFUQwPNRaJTI/7y0DyEya9jmB:Pvd7Rp1akrLuyLg6NRPzjy9aQB

Score

7^/10

bootkit persistence upx

Malware Config

Signatures

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2220-0-0x0000000001040000-0x00000000010CC000-memory.dmp	upx
behavioral1/memory/2220-56-0x0000000001040000-0x00000000010CC000-memory.dmp	upx
behavioral1/memory/2220-58-0x0000000001040000-0x00000000010CC000-memory.dmp	upx
behavioral1/memory/2220-62-0x0000000001040000-0x00000000010CC000-memory.dmp	upx
behavioral1/memory/2220-64-0x0000000001040000-0x00000000010CC000-memory.dmp	upx
behavioral1/memory/2220-68-0x0000000001040000-0x00000000010CC000-memory.dmp	upx

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\g:	26082005b5056b788c540fa5ddf2dd71_JaffaCakes118.exe
File opened (read-only)	\??\n:	26082005b5056b788c540fa5ddf2dd71_JaffaCakes118.exe
File opened (read-only)	\??\w:	26082005b5056b788c540fa5ddf2dd71_JaffaCakes118.exe
File opened (read-only)	\??\x:	26082005b5056b788c540fa5ddf2dd71_JaffaCakes118.exe
File opened (read-only)	\??\y:	26082005b5056b788c540fa5ddf2dd71_JaffaCakes118.exe
File opened (read-only)	\??\e:	26082005b5056b788c540fa5ddf2dd71_JaffaCakes118.exe
File opened (read-only)	\??\k:	26082005b5056b788c540fa5ddf2dd71_JaffaCakes118.exe
File opened (read-only)	\??\q:	26082005b5056b788c540fa5ddf2dd71_JaffaCakes118.exe
File opened (read-only)	\??\r:	26082005b5056b788c540fa5ddf2dd71_JaffaCakes118.exe
File opened (read-only)	\??\t:	26082005b5056b788c540fa5ddf2dd71_JaffaCakes118.exe
File opened (read-only)	\??\v:	26082005b5056b788c540fa5ddf2dd71_JaffaCakes118.exe
File opened (read-only)	\??\h:	26082005b5056b788c540fa5ddf2dd71_JaffaCakes118.exe
File opened (read-only)	\??\i:	26082005b5056b788c540fa5ddf2dd71_JaffaCakes118.exe
File opened (read-only)	\??\j:	26082005b5056b788c540fa5ddf2dd71_JaffaCakes118.exe
File opened (read-only)	\??\l:	26082005b5056b788c540fa5ddf2dd71_JaffaCakes118.exe
File opened (read-only)	\??\m:	26082005b5056b788c540fa5ddf2dd71_JaffaCakes118.exe
File opened (read-only)	\??\u:	26082005b5056b788c540fa5ddf2dd71_JaffaCakes118.exe
File opened (read-only)	\??\o:	26082005b5056b788c540fa5ddf2dd71_JaffaCakes118.exe
File opened (read-only)	\??\p:	26082005b5056b788c540fa5ddf2dd71_JaffaCakes118.exe
File opened (read-only)	\??\s:	26082005b5056b788c540fa5ddf2dd71_JaffaCakes118.exe
File opened (read-only)	\??\z:	26082005b5056b788c540fa5ddf2dd71_JaffaCakes118.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	26082005b5056b788c540fa5ddf2dd71_JaffaCakes118.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\SAItest.txt	26082005b5056b788c540fa5ddf2dd71_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\26082005b5056b788c540fa5ddf2dd71_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\26082005b5056b788c540fa5ddf2dd71_JaffaCakes118.exe"
1⤵
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
PID:2220

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Cab120C.tmp

Filesize
67KB

MD5
2d3dcf90f6c99f47e7593ea250c9e749

SHA1
51be82be4a272669983313565b4940d4b1385237

SHA256
8714e7be9f9b6de26673d9d09bd4c9f41b1b27ae10b1d56a7ad83abd7430ebd4

SHA512
9c11dd7d448ffebe2167acde37be77d42175edacf5aaf6fb31d3bdfe6bb1f63f5fdbc9a0a2125ed9d5ce0529b6b548818c8021532e1ea6b324717cc9bec0aaa5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar16B5.tmp

Filesize
160KB

MD5
7186ad693b8ad9444401bd9bcd2217c2

SHA1
5c28ca10a650f6026b0df4737078fa4197f3bac1

SHA256
9a71fa0cb44aa51412b16a0bf83a275977ba4e807d022f78364338b99b3a3eed

SHA512
135be0e6370fd057762c56149526f46bf6a62fb65ef5b3b26ae01fa07b4c4e37188e203bd3812f31e260ec5cccff5924633dd55ab17e9fa106479783c2fb212b

Download Submit
memory/2220-0-0x0000000001040000-0x00000000010CC000-memory.dmp

Filesize
560KB

Download
memory/2220-56-0x0000000001040000-0x00000000010CC000-memory.dmp

Filesize
560KB

Download
memory/2220-58-0x0000000001040000-0x00000000010CC000-memory.dmp

Filesize
560KB

Download
memory/2220-62-0x0000000001040000-0x00000000010CC000-memory.dmp

Filesize
560KB

Download
memory/2220-64-0x0000000001040000-0x00000000010CC000-memory.dmp

Filesize
560KB

Download
memory/2220-68-0x0000000001040000-0x00000000010CC000-memory.dmp

Filesize
560KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads