Overview

overview

7

Static

static

3

fabc4a14cb...18.exe

windows7-x64

7

fabc4a14cb...18.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fabc4a14cb4441e5316e96da463747e6_JaffaCakes118

  • Size

    1.4MB

  • Sample

    240419-va1gpaae6x

  • MD5

    fabc4a14cb4441e5316e96da463747e6

  • SHA1

    6560a97f014075aca1ea47294aa93d774ae5ff7d

  • SHA256

    b230dfb57b1761b83e50cfcce53d8897b75f5cc120a6ea940038c06fbd10e0da

  • SHA512

    1a508f82dd76bbb5692d2ece5aaee1f09ac636abe5882a8910d0b5d4d88d2eed1099007945c0112bb3c711489e9cd91a0b9fcd4cbaebcd695c969ee69bbd9523

  • SSDEEP

    24576:UmHzjYWMzy6qsgQa9grC6ZRv7ss8QwyXMdGw1vknMSdZST58HCFnae1kb:bzjQzqDH6PNww8p18dZSuHCEeGb

Score
7/10
bootkitevasionpersistencetrojan

Malware Config

Targets

    • Target

      fabc4a14cb4441e5316e96da463747e6_JaffaCakes118

    • Size

      1.4MB

    • MD5

      fabc4a14cb4441e5316e96da463747e6

    • SHA1

      6560a97f014075aca1ea47294aa93d774ae5ff7d

    • SHA256

      b230dfb57b1761b83e50cfcce53d8897b75f5cc120a6ea940038c06fbd10e0da

    • SHA512

      1a508f82dd76bbb5692d2ece5aaee1f09ac636abe5882a8910d0b5d4d88d2eed1099007945c0112bb3c711489e9cd91a0b9fcd4cbaebcd695c969ee69bbd9523

    • SSDEEP

      24576:UmHzjYWMzy6qsgQa9grC6ZRv7ss8QwyXMdGw1vknMSdZST58HCFnae1kb:bzjQzqDH6PNww8p18dZSuHCEeGb

    Score
    7/10
    bootkitevasionpersistencetrojan

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Checks whether UAC is enabled

      evasiontrojan

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Credential Access

Discovery

Query Registry

1
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks