Overview

overview

9

Static

static

3

3b7f16e17f...18.exe

windows7-x64

9

3b7f16e17f...18.exe

windows10-2004-x64

9

Sharing

Copy URL Twitter E-mail

General

  • Target

    3b7f16e17fc624d9bfd9194cf2666730_JaffaCakes118

  • Size

    6.0MB

  • Sample

    240712-bv6pnashqp

  • MD5

    3b7f16e17fc624d9bfd9194cf2666730

  • SHA1

    d1ee26c306906982059d7298e791c0d358c7ded9

  • SHA256

    fb8ca0afdc3c4cd3e7db80da9ffb3799f00b358bf82700c2756f22a659917ae2

  • SHA512

    2b6feec422ca2e8bf004975414ee3b374fbdf84e8c7343e3921785e6b75c89682b3da7d9c160b316ca9c4ae9d981a860a161c498fb99872fe6e8a776ad87c124

  • SSDEEP

    98304:8wZcFwv3U9ApP+AJGqYuiUWIYFEU/4zg0Oa3mrJYp+An7dV:8wZcFw/NWAJGqVJYKU/4z5OaeWo87

Score
9/10
bootkitevasionpersistencetrojan

Malware Config

Targets

    • Target

      3b7f16e17fc624d9bfd9194cf2666730_JaffaCakes118

    • Size

      6.0MB

    • MD5

      3b7f16e17fc624d9bfd9194cf2666730

    • SHA1

      d1ee26c306906982059d7298e791c0d358c7ded9

    • SHA256

      fb8ca0afdc3c4cd3e7db80da9ffb3799f00b358bf82700c2756f22a659917ae2

    • SHA512

      2b6feec422ca2e8bf004975414ee3b374fbdf84e8c7343e3921785e6b75c89682b3da7d9c160b316ca9c4ae9d981a860a161c498fb99872fe6e8a776ad87c124

    • SSDEEP

      98304:8wZcFwv3U9ApP+AJGqYuiUWIYFEU/4zg0Oa3mrJYp+An7dV:8wZcFw/NWAJGqVJYKU/4z5OaeWo87

    Score
    9/10
    bootkitevasionpersistencetrojan

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Checks whether UAC is enabled

      evasiontrojan

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks