General

  • Target

    9f2babcc005a15da00619764523de2b5_JaffaCakes118

  • Size

    4.4MB

  • Sample

    240611-xap23axbpm

  • MD5

    9f2babcc005a15da00619764523de2b5

  • SHA1

    e46c0e2e521db56e84168135d2f73ba434523170

  • SHA256

    97e31f22e93086116fad829d7cdcf60fb805cd7ee773bf8534b4cf9163d1f083

  • SHA512

    68ff6108cb82950d62aa9d57ec0d74aab18c731e5489dfa986bb51830e397f75e87d66157ec859ab8f0ff1dabd46dc749038bca31127937fba6f7982a50b9b89

  • SSDEEP

    98304:W+cWrJBYu5XPysh/ccWvC3douwm/3lIgux1tk/o0Okd:ncWrs+nh/gvC3SO3lDux1tr0OY

Malware Config

Targets

    • Target

      9f2babcc005a15da00619764523de2b5_JaffaCakes118

    • Size

      4.4MB

    • MD5

      9f2babcc005a15da00619764523de2b5

    • SHA1

      e46c0e2e521db56e84168135d2f73ba434523170

    • SHA256

      97e31f22e93086116fad829d7cdcf60fb805cd7ee773bf8534b4cf9163d1f083

    • SHA512

      68ff6108cb82950d62aa9d57ec0d74aab18c731e5489dfa986bb51830e397f75e87d66157ec859ab8f0ff1dabd46dc749038bca31127937fba6f7982a50b9b89

    • SSDEEP

      98304:W+cWrJBYu5XPysh/ccWvC3douwm/3lIgux1tk/o0Okd:ncWrs+nh/gvC3SO3lDux1tr0OY

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks