Overview

overview

7

Static

static

7

fb2b9a6e3c...18.exe

windows7-x64

7

fb2b9a6e3c...18.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fb2b9a6e3c634cec2e311e2905171b55_JaffaCakes118

  • Size

    543KB

  • Sample

    240419-zzf7kagd4v

  • MD5

    fb2b9a6e3c634cec2e311e2905171b55

  • SHA1

    b751d43b8fc6d090a23543e552cfaf3240577227

  • SHA256

    9efe445bfc92125274b1911a96c7623d25991954fac9fc39deb0a5595392a4f5

  • SHA512

    e1c9c96a612fb89d029269d6db61453c7b8f9bf0a6a64bbd87d2baeb5bcbf362fc66413a47d2356988d08ecd69c4fce37830a125dfa80d669341d149da0f072a

  • SSDEEP

    6144:sm8tSjMcCFgjGFF2OpG1pmyi1jHetjJDIu8ubn7ZXi1vSnCUCmMg6MOgBf8NCh:smBegjGFrg1mqZXQqCUSgYgJh

Score
7/10
bootkitpersistenceupx

Malware Config

Targets

    • Target

      fb2b9a6e3c634cec2e311e2905171b55_JaffaCakes118

    • Size

      543KB

    • MD5

      fb2b9a6e3c634cec2e311e2905171b55

    • SHA1

      b751d43b8fc6d090a23543e552cfaf3240577227

    • SHA256

      9efe445bfc92125274b1911a96c7623d25991954fac9fc39deb0a5595392a4f5

    • SHA512

      e1c9c96a612fb89d029269d6db61453c7b8f9bf0a6a64bbd87d2baeb5bcbf362fc66413a47d2356988d08ecd69c4fce37830a125dfa80d669341d149da0f072a

    • SSDEEP

      6144:sm8tSjMcCFgjGFF2OpG1pmyi1jHetjJDIu8ubn7ZXi1vSnCUCmMg6MOgBf8NCh:smBegjGFrg1mqZXQqCUSgYgJh

    Score
    7/10
    bootkitpersistenceupx

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Credential Access

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks