General

  • Target

    a108f8dc9b87caae3477711e6fabf60a_JaffaCakes118

  • Size

    4.3MB

  • Sample

    240612-r5f5rasfjr

  • MD5

    a108f8dc9b87caae3477711e6fabf60a

  • SHA1

    2b9ef57338ee1893a9d6421a6fa8d1e237146f74

  • SHA256

    00dc34993eb771ea60faf05a84a75b2aa7169137f120be5fb6d9a1819512b76d

  • SHA512

    234617c93e5820b3f409970b36780c109fc95991d5c07a47f2fe2f85d5b4ec0a5a0cab72684e6f46fdc7d4afb3f21a6e3cb5aeb8e5dc21c985f02992613dcf9e

  • SSDEEP

    98304:aqSh5zRZwYeMMIV3PsU6Z8y6TaOphYLYSHinQpUt/YV5DyzFf:ajHYOpCm/s9y

Malware Config

Targets

    • Target

      a108f8dc9b87caae3477711e6fabf60a_JaffaCakes118

    • Size

      4.3MB

    • MD5

      a108f8dc9b87caae3477711e6fabf60a

    • SHA1

      2b9ef57338ee1893a9d6421a6fa8d1e237146f74

    • SHA256

      00dc34993eb771ea60faf05a84a75b2aa7169137f120be5fb6d9a1819512b76d

    • SHA512

      234617c93e5820b3f409970b36780c109fc95991d5c07a47f2fe2f85d5b4ec0a5a0cab72684e6f46fdc7d4afb3f21a6e3cb5aeb8e5dc21c985f02992613dcf9e

    • SSDEEP

      98304:aqSh5zRZwYeMMIV3PsU6Z8y6TaOphYLYSHinQpUt/YV5DyzFf:ajHYOpCm/s9y

    • Enumerates VirtualBox registry keys

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Looks for VirtualBox Guest Additions in registry

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

    • Checks system information in the registry

      System information is often read in order to detect sandboxing environments.

MITRE ATT&CK Matrix ATT&CK v13

Persistence

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Defense Evasion

Virtualization/Sandbox Evasion

3
T1497

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Modify Registry

1
T1112

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Query Registry

6
T1012

Virtualization/Sandbox Evasion

3
T1497

System Information Discovery

4
T1082

Collection

Data from Local System

1
T1005

Tasks