Overview

overview

10

Static

static

3

f25897326b...18.exe

windows7-x64

8

f25897326b...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f25897326beee04afba384bc50e0c35b_JaffaCakes118

  • Size

    36KB

  • Sample

    240416-bkkdnsdd78

  • MD5

    f25897326beee04afba384bc50e0c35b

  • SHA1

    5085a4d48444be7f4a7ec1dd4f4810d3ce5869cb

  • SHA256

    95c3212ceba92fcd3603232f23b6748bd24bc2575ee1047170ac0d1ca44fcd13

  • SHA512

    85def6bc6209971cf42efac5f62112a086e9f85b15a49142d335eb6093ded27962a952bf03801ee09a210bad45d7a008202031b135ff02770ee715708a7d56e0

  • SSDEEP

    768:Qi/8POyOVXow3UVnnK9Fi9k13ebvMSPIl1C3T:QNPlOVXow3UVnKKOMb0PU3T

Score
10/10
r77evasionpersistencerootkit

Malware Config

Targets

    • Target

      f25897326beee04afba384bc50e0c35b_JaffaCakes118

    • Size

      36KB

    • MD5

      f25897326beee04afba384bc50e0c35b

    • SHA1

      5085a4d48444be7f4a7ec1dd4f4810d3ce5869cb

    • SHA256

      95c3212ceba92fcd3603232f23b6748bd24bc2575ee1047170ac0d1ca44fcd13

    • SHA512

      85def6bc6209971cf42efac5f62112a086e9f85b15a49142d335eb6093ded27962a952bf03801ee09a210bad45d7a008202031b135ff02770ee715708a7d56e0

    • SSDEEP

      768:Qi/8POyOVXow3UVnnK9Fi9k13ebvMSPIl1C3T:QNPlOVXow3UVnKKOMb0PU3T

    Score
    10/10
    evasionpersistencer77rootkit

    • r77

      r77 is an open-source, userland rootkit.

      rootkitr77

    • r77 rootkit payload

      Detects the payload of the r77 rootkit.

    • Downloads MZ/PE file

    • Modifies AppInit DLL entries

      persistence

    • Modifies Windows Firewall

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Defense Evasion

Modify Registry

3
T1112

Impair Defenses

1
T1562

Disable or Modify System Firewall

1
T1562.004

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Hide Artifacts

1
T1564

Hidden Files and Directories

1
T1564.001

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Resource Development

Reconnaissance

Tasks