Overview

overview

7

Static

static

7

ffed6e90c1...18.exe

windows7-x64

7

ffed6e90c1...18.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ffed6e90c1a15fb306037576cf2d131f_JaffaCakes118

  • Size

    88KB

  • Sample

    240421-xeasyahc43

  • MD5

    ffed6e90c1a15fb306037576cf2d131f

  • SHA1

    6964c72a9570714c59b145d78c499b4c58790c6e

  • SHA256

    60306c4fb38fecd844fad4ec3a67cb2080e6240dbbe539d23cdc76f5473a3661

  • SHA512

    cdd406d2a6c4094589d01f40c6978a49b8461561b00f4d6fb49bbe8ce3d71652c640e8268663ea4722e5fdc6554c77173c7d0e3661e7a352f605eea454c8a3ed

  • SSDEEP

    1536:dXNXdlRH+Dwk4cSGesvhC8plnQ85+HwClgfTQqPTFTCtOQ8Ccfig:ddtlRH+UxGzh3HQ85+QqoTBfig

Score
7/10
bootkitpersistencevmprotect

Malware Config

Targets

    • Target

      ffed6e90c1a15fb306037576cf2d131f_JaffaCakes118

    • Size

      88KB

    • MD5

      ffed6e90c1a15fb306037576cf2d131f

    • SHA1

      6964c72a9570714c59b145d78c499b4c58790c6e

    • SHA256

      60306c4fb38fecd844fad4ec3a67cb2080e6240dbbe539d23cdc76f5473a3661

    • SHA512

      cdd406d2a6c4094589d01f40c6978a49b8461561b00f4d6fb49bbe8ce3d71652c640e8268663ea4722e5fdc6554c77173c7d0e3661e7a352f605eea454c8a3ed

    • SSDEEP

      1536:dXNXdlRH+Dwk4cSGesvhC8plnQ85+HwClgfTQqPTFTCtOQ8Ccfig:ddtlRH+UxGzh3HQ85+QqoTBfig

    Score
    7/10
    bootkitpersistencevmprotect

    • Executes dropped EXE

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks