420dbbe077eeeaf33ccaca1cc8c97cdede28c3d27a546de8e7f18556da8e2365

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
30-09-2024 03:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ffdc25521c7380877f0de2f253088df2_JaffaCakes118.exe
Size

724KB
MD5

ffdc25521c7380877f0de2f253088df2
SHA1

55847ce52b40396db60f4e9c030e95b690b77ccb
SHA256

420dbbe077eeeaf33ccaca1cc8c97cdede28c3d27a546de8e7f18556da8e2365
SHA512

798e7f7fb45bdbafda5bdb9ea38956ada13ecdaf14c386e920cccf0e81edcc069e42efd420c4a09d68e9df4011b6860dcc92447949ed0864ce99f028fcb4f298
SSDEEP

12288:3t9v5UZIvX41qVb0xxOSDjld10BRXjIjbyS2nRDU:3t9O4wm0xxOOriRBSn

Score

6^/10

bootkit discovery persistence

Malware Config

Signatures

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\p:	ffdc25521c7380877f0de2f253088df2_JaffaCakes118.exe
File opened (read-only)	\??\w:	ffdc25521c7380877f0de2f253088df2_JaffaCakes118.exe
File opened (read-only)	\??\x:	ffdc25521c7380877f0de2f253088df2_JaffaCakes118.exe
File opened (read-only)	\??\y:	ffdc25521c7380877f0de2f253088df2_JaffaCakes118.exe
File opened (read-only)	\??\h:	ffdc25521c7380877f0de2f253088df2_JaffaCakes118.exe
File opened (read-only)	\??\o:	ffdc25521c7380877f0de2f253088df2_JaffaCakes118.exe
File opened (read-only)	\??\q:	ffdc25521c7380877f0de2f253088df2_JaffaCakes118.exe
File opened (read-only)	\??\r:	ffdc25521c7380877f0de2f253088df2_JaffaCakes118.exe
File opened (read-only)	\??\s:	ffdc25521c7380877f0de2f253088df2_JaffaCakes118.exe
File opened (read-only)	\??\v:	ffdc25521c7380877f0de2f253088df2_JaffaCakes118.exe
File opened (read-only)	\??\j:	ffdc25521c7380877f0de2f253088df2_JaffaCakes118.exe
File opened (read-only)	\??\g:	ffdc25521c7380877f0de2f253088df2_JaffaCakes118.exe
File opened (read-only)	\??\k:	ffdc25521c7380877f0de2f253088df2_JaffaCakes118.exe
File opened (read-only)	\??\l:	ffdc25521c7380877f0de2f253088df2_JaffaCakes118.exe
File opened (read-only)	\??\m:	ffdc25521c7380877f0de2f253088df2_JaffaCakes118.exe
File opened (read-only)	\??\u:	ffdc25521c7380877f0de2f253088df2_JaffaCakes118.exe
File opened (read-only)	\??\e:	ffdc25521c7380877f0de2f253088df2_JaffaCakes118.exe
File opened (read-only)	\??\n:	ffdc25521c7380877f0de2f253088df2_JaffaCakes118.exe
File opened (read-only)	\??\t:	ffdc25521c7380877f0de2f253088df2_JaffaCakes118.exe
File opened (read-only)	\??\z:	ffdc25521c7380877f0de2f253088df2_JaffaCakes118.exe
File opened (read-only)	\??\i:	ffdc25521c7380877f0de2f253088df2_JaffaCakes118.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	ffdc25521c7380877f0de2f253088df2_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ffdc25521c7380877f0de2f253088df2_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\ffdc25521c7380877f0de2f253088df2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ffdc25521c7380877f0de2f253088df2_JaffaCakes118.exe"
1⤵
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
PID:2336