Overview

overview

9

Static

static

7

fbc208d4a5...18.exe

windows7-x64

9

fbc208d4a5...18.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fbc208d4a525f449c25074b21a1784b6_JaffaCakes118

  • Size

    3.2MB

  • Sample

    240420-c87pjsfc8x

  • MD5

    fbc208d4a525f449c25074b21a1784b6

  • SHA1

    128dfd563f281370b3f34ac15de96875bf47c148

  • SHA256

    6f8978e9e9dfbabd48136fa088d5d4aec70365714a023f600469a8019dd99c2d

  • SHA512

    ebbc3ba7a4d5297f92ef3452259dde760dce6092dd2183af5a4c8f78a0e1f99334d61bcbb9957914aaa41daac8a0af775300fcb56073fb6eac9ee81cc0286738

  • SSDEEP

    49152:taj0As03hf/c40nIFkR9hv5ZDLg45V9gVfW7dvdryINFQY/kxrJEIpEHmkeY:20URJ0nIFkD/ZZ32AvELukxN/EG

Score
9/10
bootkitdiscoveryevasionpersistenceupx

Malware Config

Targets

    • Target

      fbc208d4a525f449c25074b21a1784b6_JaffaCakes118

    • Size

      3.2MB

    • MD5

      fbc208d4a525f449c25074b21a1784b6

    • SHA1

      128dfd563f281370b3f34ac15de96875bf47c148

    • SHA256

      6f8978e9e9dfbabd48136fa088d5d4aec70365714a023f600469a8019dd99c2d

    • SHA512

      ebbc3ba7a4d5297f92ef3452259dde760dce6092dd2183af5a4c8f78a0e1f99334d61bcbb9957914aaa41daac8a0af775300fcb56073fb6eac9ee81cc0286738

    • SSDEEP

      49152:taj0As03hf/c40nIFkR9hv5ZDLg45V9gVfW7dvdryINFQY/kxrJEIpEHmkeY:20URJ0nIFkD/ZZ32AvELukxN/EG

    Score
    9/10
    bootkitdiscoveryevasionpersistenceupx

    • Checks for common network interception software

      Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.

      evasion

    • Enumerates VirtualBox registry keys

      evasion

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Credential Access

Discovery

Software Discovery

1
T1518

Query Registry

3
T1012

Virtualization/Sandbox Evasion

1
T1497

Peripheral Device Discovery

1
T1120

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks