General

  • Target

    04cbfbfc87c718f4830bfa02b508449b_JaffaCakes118

  • Size

    15.3MB

  • Sample

    240428-kkqecscb2z

  • MD5

    04cbfbfc87c718f4830bfa02b508449b

  • SHA1

    01d885dfdfe5747598bf1857e6a67cf811833b0d

  • SHA256

    d5755c6e46ced7e665a1d759123fd67144ce7ddb03a1629e97e9f3e12850dcfe

  • SHA512

    bcbe14b29832b739d45316422eea9b5130a830437519be699c7b5d00dfa585b70a9ae4a6f38c98ddfe38713a7d5cf58f236a6794565c282bc08e2a580e5203ae

  • SSDEEP

    393216:UnNwp1jG94UpZ1Go+fP9dt2IZ9mOsDq/BQi:UNW1y7px6P9d0q9QDq/B

Malware Config

Targets

    • Target

      04cbfbfc87c718f4830bfa02b508449b_JaffaCakes118

    • Size

      15.3MB

    • MD5

      04cbfbfc87c718f4830bfa02b508449b

    • SHA1

      01d885dfdfe5747598bf1857e6a67cf811833b0d

    • SHA256

      d5755c6e46ced7e665a1d759123fd67144ce7ddb03a1629e97e9f3e12850dcfe

    • SHA512

      bcbe14b29832b739d45316422eea9b5130a830437519be699c7b5d00dfa585b70a9ae4a6f38c98ddfe38713a7d5cf58f236a6794565c282bc08e2a580e5203ae

    • SSDEEP

      393216:UnNwp1jG94UpZ1Go+fP9dt2IZ9mOsDq/BQi:UNW1y7px6P9d0q9QDq/B

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    • Loads dropped DLL

    • Checks whether UAC is enabled

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Matrix ATT&CK v13

Persistence

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Defense Evasion

Virtualization/Sandbox Evasion

2
T1497

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Discovery

Query Registry

4
T1012

Virtualization/Sandbox Evasion

2
T1497

System Information Discovery

4
T1082

Tasks