Overview

overview

7

Static

static

7

fcc27955bb...18.exe

windows7-x64

7

fcc27955bb...18.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fcc27955bb603de0382fc5cea6e9b114_JaffaCakes118

  • Size

    328KB

  • Sample

    240420-ph9gnshc4w

  • MD5

    fcc27955bb603de0382fc5cea6e9b114

  • SHA1

    c9ab1bf7bdec4e61f4c10455d115dcb02b06dc65

  • SHA256

    19cebbdb8708606e0d789d04bd0e15843a7c188355382455c5ea35480825cb15

  • SHA512

    e9b832d8bef78c89d1670fc804ca9482862df55ae608c165e3ecdf846b56a658b6f50b4ad94d65dd8b99199d80f3456de3ae43e148cdf7572f73d36d80900fd6

  • SSDEEP

    6144:KeXA47CURW+eirtnIwE0XzBTjrBLt4smgZAhHo7zR0UK6wMQc28iMAl/E8:KeXv7tRWwnIKBTjx6smgYH0BjQc28JAf

Score
7/10
bootkitpersistenceupx

Malware Config

Targets

    • Target

      fcc27955bb603de0382fc5cea6e9b114_JaffaCakes118

    • Size

      328KB

    • MD5

      fcc27955bb603de0382fc5cea6e9b114

    • SHA1

      c9ab1bf7bdec4e61f4c10455d115dcb02b06dc65

    • SHA256

      19cebbdb8708606e0d789d04bd0e15843a7c188355382455c5ea35480825cb15

    • SHA512

      e9b832d8bef78c89d1670fc804ca9482862df55ae608c165e3ecdf846b56a658b6f50b4ad94d65dd8b99199d80f3456de3ae43e148cdf7572f73d36d80900fd6

    • SSDEEP

      6144:KeXA47CURW+eirtnIwE0XzBTjrBLt4smgZAhHo7zR0UK6wMQc28iMAl/E8:KeXv7tRWwnIKBTjx6smgYH0BjQc28JAf

    Score
    7/10
    bootkitpersistenceupx

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks