Overview

overview

7

Static

static

3

40e18a4f0c...18.exe

windows7-x64

7

40e18a4f0c...18.exe

windows10-2004-x64

7

Sharing

Copy URL Twitter E-mail

General

  • Target

    40e18a4f0cdf91736ae74047318146cb_JaffaCakes118

  • Size

    244KB

  • Sample

    240713-j4dn8staqr

  • MD5

    40e18a4f0cdf91736ae74047318146cb

  • SHA1

    c94a4ec1a76dbb6155c8e488f79ae26441bcce32

  • SHA256

    e5698e6d037db7f1c0190a7c2861a1d6774d1d651d285b2866b469c701abb629

  • SHA512

    60745f974531ae29cda5d27929b7e0191c1e8368d1859150b67cbfc72efc57e826519739161583716fe0a996761427ea97356731c2dc0c4a698eb3b63a74276f

  • SSDEEP

    3072:e9E83GvJFgmldk35/RIxQwPntqdaCJzrUQy/sGz3/gTEzo1G4hUzIzajbFvEWtwt:e9YhFgmldk3hRyQWtqdFJLyk51Y+u/4

Score
7/10
bootkitpersistencespywarestealer

Malware Config

Targets

    • Target

      40e18a4f0cdf91736ae74047318146cb_JaffaCakes118

    • Size

      244KB

    • MD5

      40e18a4f0cdf91736ae74047318146cb

    • SHA1

      c94a4ec1a76dbb6155c8e488f79ae26441bcce32

    • SHA256

      e5698e6d037db7f1c0190a7c2861a1d6774d1d651d285b2866b469c701abb629

    • SHA512

      60745f974531ae29cda5d27929b7e0191c1e8368d1859150b67cbfc72efc57e826519739161583716fe0a996761427ea97356731c2dc0c4a698eb3b63a74276f

    • SSDEEP

      3072:e9E83GvJFgmldk35/RIxQwPntqdaCJzrUQy/sGz3/gTEzo1G4hUzIzajbFvEWtwt:e9YhFgmldk3hRyQWtqdFJLyk51Y+u/4

    Score
    7/10
    bootkitpersistencespywarestealer

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks