Overview

overview

7

Static

static

7

f9a076d14f...18.exe

windows7-x64

7

f9a076d14f...18.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f9a076d14fb5d8756436039d26227060_JaffaCakes118

  • Size

    12.3MB

  • Sample

    240419-gfyndsac56

  • MD5

    f9a076d14fb5d8756436039d26227060

  • SHA1

    e3fb1030ea228b499e69dabfd179b167c1a7ace2

  • SHA256

    156614076df8ea78e7d1db74d92520d7d80c827fe01ca765348707934adeadff

  • SHA512

    3c75190f75d47b68bc928b2ab99703a74c723486b882f58f0b258b0b95977da12b15a4b30a633e7993eb2e751409316227c3172ba2c37b840e3cfeb63d5955b1

  • SSDEEP

    393216:MT0LUxe1JhjZZG8tNfeW7Q/YL5WEcxIzEfV:MaUxIJhjBeeQ/Y9axIGV

Score
7/10
bootkitpersistencevmprotect

Malware Config

Targets

    • Target

      f9a076d14fb5d8756436039d26227060_JaffaCakes118

    • Size

      12.3MB

    • MD5

      f9a076d14fb5d8756436039d26227060

    • SHA1

      e3fb1030ea228b499e69dabfd179b167c1a7ace2

    • SHA256

      156614076df8ea78e7d1db74d92520d7d80c827fe01ca765348707934adeadff

    • SHA512

      3c75190f75d47b68bc928b2ab99703a74c723486b882f58f0b258b0b95977da12b15a4b30a633e7993eb2e751409316227c3172ba2c37b840e3cfeb63d5955b1

    • SSDEEP

      393216:MT0LUxe1JhjZZG8tNfeW7Q/YL5WEcxIzEfV:MaUxIJhjBeeQ/Y9axIGV

    Score
    7/10
    bootkitpersistencevmprotect

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks