Overview

overview

7

Static

static

7

fc027c1b80...18.exe

windows7-x64

7

fc027c1b80...18.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fc027c1b800de22e06f630c83ef618f4_JaffaCakes118

  • Size

    241KB

  • Sample

    240420-fyc9qsab7v

  • MD5

    fc027c1b800de22e06f630c83ef618f4

  • SHA1

    74de735446d1528da4e3d7c7b3b8ee28e0b588c7

  • SHA256

    3ba27e6b507d68014a98cd7cb0c47a9f69908e666f5901dc96c6078c07c13784

  • SHA512

    191c645c211af3f15be9b0898e82f66eb6ff67233046418f18a4b802a2e09425a2578d6820ba4359b166f48c51ad3f1d7e872de0ed36e6f045e2ce08d0b1ffe3

  • SSDEEP

    6144:gkeENDvTSn2SV/GuhYdViC7X57+nMscN5kno1YLcIZj:gNEND/k/GLPX57+nGN91wcAj

Score
7/10
bootkitpersistenceupx

Malware Config

Targets

    • Target

      fc027c1b800de22e06f630c83ef618f4_JaffaCakes118

    • Size

      241KB

    • MD5

      fc027c1b800de22e06f630c83ef618f4

    • SHA1

      74de735446d1528da4e3d7c7b3b8ee28e0b588c7

    • SHA256

      3ba27e6b507d68014a98cd7cb0c47a9f69908e666f5901dc96c6078c07c13784

    • SHA512

      191c645c211af3f15be9b0898e82f66eb6ff67233046418f18a4b802a2e09425a2578d6820ba4359b166f48c51ad3f1d7e872de0ed36e6f045e2ce08d0b1ffe3

    • SSDEEP

      6144:gkeENDvTSn2SV/GuhYdViC7X57+nMscN5kno1YLcIZj:gNEND/k/GLPX57+nGN91wcAj

    Score
    7/10
    bootkitpersistenceupx

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks