Overview

overview

7

Static

static

7

fcd5f0b5a9...18.exe

windows7-x64

7

fcd5f0b5a9...18.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fcd5f0b5a9306fcb7f7e30a91582738c_JaffaCakes118

  • Size

    242KB

  • Sample

    240420-qe1wssab4y

  • MD5

    fcd5f0b5a9306fcb7f7e30a91582738c

  • SHA1

    60bdb47d3b5fc9925d6a843223cacf55edc6e42c

  • SHA256

    504f1808209da9c5298c37742f4ae93974ffcaf0440b160082a1e57ecc91ac84

  • SHA512

    82d337f8e5b27bbbe33dc9a288930f1d5cf491154aa7d6af58e364ccce2cc26ac5496b2d6dc48c06b738585d07d9caa5903029991d9f4c65bf368f62ca5caaa3

  • SSDEEP

    6144:DkeENDvTSn2SV/GuhYdViC7X57+nMjee3JQ5H0j4fP:DNEND/k/GLPX57+nE9Q5UjyP

Score
7/10
bootkitpersistenceupx

Malware Config

Targets

    • Target

      fcd5f0b5a9306fcb7f7e30a91582738c_JaffaCakes118

    • Size

      242KB

    • MD5

      fcd5f0b5a9306fcb7f7e30a91582738c

    • SHA1

      60bdb47d3b5fc9925d6a843223cacf55edc6e42c

    • SHA256

      504f1808209da9c5298c37742f4ae93974ffcaf0440b160082a1e57ecc91ac84

    • SHA512

      82d337f8e5b27bbbe33dc9a288930f1d5cf491154aa7d6af58e364ccce2cc26ac5496b2d6dc48c06b738585d07d9caa5903029991d9f4c65bf368f62ca5caaa3

    • SSDEEP

      6144:DkeENDvTSn2SV/GuhYdViC7X57+nMjee3JQ5H0j4fP:DNEND/k/GLPX57+nE9Q5UjyP

    Score
    7/10
    bootkitpersistenceupx

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks