6c70f92fdb178b35319d1584b7c98084436cdae2ccb821968b0b8788d1c10361

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
13-07-2024 21:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

435464184d514ed5a7e94f319a17ca97_JaffaCakes118.exe
Size

466KB
MD5

435464184d514ed5a7e94f319a17ca97
SHA1

ef079bc792911458a1382ec2a8ec88b151297361
SHA256

6c70f92fdb178b35319d1584b7c98084436cdae2ccb821968b0b8788d1c10361
SHA512

4ddbbc6ac88dbe7c9a38c938bbf071508af2bdc00bff8c11919f9ae1c98094a3093db63986f2391e0d501bf334ba2139cdd140da6b74cdfe584018ea4de3341b
SSDEEP

6144:cOLQC+kV/jJt64aHs0WbXvyN6Rt37oonMJI4hAPZZmoGn18z:cOcC+krI43vK6fXnEXhkZmhnU

Score

7^/10

bootkit persistence upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3836-0-0x0000000000400000-0x0000000000475000-memory.dmp	upx
behavioral2/memory/3836-1-0x0000000000400000-0x0000000000475000-memory.dmp	upx

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\m:	435464184d514ed5a7e94f319a17ca97_JaffaCakes118.exe
File opened (read-only)	\??\n:	435464184d514ed5a7e94f319a17ca97_JaffaCakes118.exe
File opened (read-only)	\??\o:	435464184d514ed5a7e94f319a17ca97_JaffaCakes118.exe
File opened (read-only)	\??\v:	435464184d514ed5a7e94f319a17ca97_JaffaCakes118.exe
File opened (read-only)	\??\w:	435464184d514ed5a7e94f319a17ca97_JaffaCakes118.exe
File opened (read-only)	\??\x:	435464184d514ed5a7e94f319a17ca97_JaffaCakes118.exe
File opened (read-only)	\??\y:	435464184d514ed5a7e94f319a17ca97_JaffaCakes118.exe
File opened (read-only)	\??\g:	435464184d514ed5a7e94f319a17ca97_JaffaCakes118.exe
File opened (read-only)	\??\t:	435464184d514ed5a7e94f319a17ca97_JaffaCakes118.exe
File opened (read-only)	\??\j:	435464184d514ed5a7e94f319a17ca97_JaffaCakes118.exe
File opened (read-only)	\??\k:	435464184d514ed5a7e94f319a17ca97_JaffaCakes118.exe
File opened (read-only)	\??\l:	435464184d514ed5a7e94f319a17ca97_JaffaCakes118.exe
File opened (read-only)	\??\p:	435464184d514ed5a7e94f319a17ca97_JaffaCakes118.exe
File opened (read-only)	\??\q:	435464184d514ed5a7e94f319a17ca97_JaffaCakes118.exe
File opened (read-only)	\??\r:	435464184d514ed5a7e94f319a17ca97_JaffaCakes118.exe
File opened (read-only)	\??\s:	435464184d514ed5a7e94f319a17ca97_JaffaCakes118.exe
File opened (read-only)	\??\i:	435464184d514ed5a7e94f319a17ca97_JaffaCakes118.exe
File opened (read-only)	\??\h:	435464184d514ed5a7e94f319a17ca97_JaffaCakes118.exe
File opened (read-only)	\??\u:	435464184d514ed5a7e94f319a17ca97_JaffaCakes118.exe
File opened (read-only)	\??\z:	435464184d514ed5a7e94f319a17ca97_JaffaCakes118.exe
File opened (read-only)	\??\e:	435464184d514ed5a7e94f319a17ca97_JaffaCakes118.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	435464184d514ed5a7e94f319a17ca97_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\435464184d514ed5a7e94f319a17ca97_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\435464184d514ed5a7e94f319a17ca97_JaffaCakes118.exe"
1⤵
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
PID:3836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3836-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3836-1-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads