Overview

overview

7

Static

static

7

6965f089f3...18.exe

windows7-x64

7

6965f089f3...18.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6965f089f342e220665617a5111345dd_JaffaCakes118

  • Size

    208KB

  • Sample

    240523-ckbbfaab55

  • MD5

    6965f089f342e220665617a5111345dd

  • SHA1

    571d989e1efea06046aff1b468e4f3071bc121b6

  • SHA256

    1245417494902c218944b630100962ea58a1ed946e6ba5631b6a1164c99bc99d

  • SHA512

    07e7329fddaa66c83e3e5c982bbb7bd120832016f3d21e9669931b0b82b59425db2a2ca682732edca86024569a9855701325c2a1cbf9babe4e9f40f327b18566

  • SSDEEP

    6144:uUwozUuzZNdNvJkbk1UEDy3pSS8F4qWw+hSw8tOz:/JtZNdVJkY1zDyZSS8FnWwI8tOz

Score
7/10
bootkitpersistenceupx

Malware Config

Targets

    • Target

      6965f089f342e220665617a5111345dd_JaffaCakes118

    • Size

      208KB

    • MD5

      6965f089f342e220665617a5111345dd

    • SHA1

      571d989e1efea06046aff1b468e4f3071bc121b6

    • SHA256

      1245417494902c218944b630100962ea58a1ed946e6ba5631b6a1164c99bc99d

    • SHA512

      07e7329fddaa66c83e3e5c982bbb7bd120832016f3d21e9669931b0b82b59425db2a2ca682732edca86024569a9855701325c2a1cbf9babe4e9f40f327b18566

    • SSDEEP

      6144:uUwozUuzZNdNvJkbk1UEDy3pSS8F4qWw+hSw8tOz:/JtZNdVJkY1zDyZSS8FnWwI8tOz

    Score
    7/10
    bootkitpersistenceupx

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks