Overview

overview

8

Static

static

3

f72e9a81cc...18.exe

windows7-x64

8

f72e9a81cc...18.exe

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    f72e9a81cc6707eaf95212169a317ea9_JaffaCakes118

  • Size

    238KB

  • Sample

    240418-d75z1aaa23

  • MD5

    f72e9a81cc6707eaf95212169a317ea9

  • SHA1

    8b609e64273f6d8399856c28b1ddc743df2c6b1d

  • SHA256

    2b8704a02f347e94681a291449ad32552706e4c3c16ac127236f16dac1a14d4d

  • SHA512

    554de4aabbf4aabf55c72602107c2f045a5c31cd746bbe98cd3dcb324c54f6d6b8d33676882110d47241f851852c3962eb2e3bfce1c9227fcc15c863f7904e30

  • SSDEEP

    6144:t9Q2nTMNJFipgHMl898gWNlPTGQQm6agrdtG61h7:ti2YjF2NtTirdtGsh7

Score
8/10
bootkitevasionpersistence

Malware Config

Targets

    • Target

      f72e9a81cc6707eaf95212169a317ea9_JaffaCakes118

    • Size

      238KB

    • MD5

      f72e9a81cc6707eaf95212169a317ea9

    • SHA1

      8b609e64273f6d8399856c28b1ddc743df2c6b1d

    • SHA256

      2b8704a02f347e94681a291449ad32552706e4c3c16ac127236f16dac1a14d4d

    • SHA512

      554de4aabbf4aabf55c72602107c2f045a5c31cd746bbe98cd3dcb324c54f6d6b8d33676882110d47241f851852c3962eb2e3bfce1c9227fcc15c863f7904e30

    • SSDEEP

      6144:t9Q2nTMNJFipgHMl898gWNlPTGQQm6agrdtG61h7:ti2YjF2NtTirdtGsh7

    Score
    8/10
    bootkitevasionpersistence

    • Looks for VMWare Tools registry key

      evasion

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks