Overview

overview

7

Static

static

7

f4bf21f642...18.exe

windows7-x64

7

f4bf21f642...18.exe

windows10-2004-x64

7

Sharing

Copy URL Twitter E-mail

General

  • Target

    f4bf21f642a7fb3ce8fe8582ccb4978a_JaffaCakes118

  • Size

    12.3MB

  • Sample

    240417-br6kgshg69

  • MD5

    f4bf21f642a7fb3ce8fe8582ccb4978a

  • SHA1

    580efbcd7f60e0536d6eb400bac666301f6ff314

  • SHA256

    b93c3049c46962950c9b91f9abfe51ab0109b89eafcd73b4f02fd25a070d4af7

  • SHA512

    c29fbb619dca2f75a0c5e1e647143c617d08f263273686ee833d71684d2b183636e849e687ebe28eeaf93764da172fce18ed63625afb7240be8a306cc86de239

  • SSDEEP

    196608:WY8nN6ZC87q5r15Rn+eWqGQosRCQ5UKBazUaCYgc54m8gei9Mrd/NNV5h:ynoMNr1aehHfo1CFs78gRsD

Score
7/10
bootkitpersistencevmprotect

Malware Config

Targets

    • Target

      f4bf21f642a7fb3ce8fe8582ccb4978a_JaffaCakes118

    • Size

      12.3MB

    • MD5

      f4bf21f642a7fb3ce8fe8582ccb4978a

    • SHA1

      580efbcd7f60e0536d6eb400bac666301f6ff314

    • SHA256

      b93c3049c46962950c9b91f9abfe51ab0109b89eafcd73b4f02fd25a070d4af7

    • SHA512

      c29fbb619dca2f75a0c5e1e647143c617d08f263273686ee833d71684d2b183636e849e687ebe28eeaf93764da172fce18ed63625afb7240be8a306cc86de239

    • SSDEEP

      196608:WY8nN6ZC87q5r15Rn+eWqGQosRCQ5UKBazUaCYgc54m8gei9Mrd/NNV5h:ynoMNr1aehHfo1CFs78gRsD

    Score
    7/10
    bootkitpersistencevmprotect

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks