Overview

overview

10

Static

static

3

pedido2012.exe

windows7-x64

10

pedido2012.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    63accd7a99e8aa6da046a96390c22a22_JaffaCakes118

  • Size

    335KB

  • Sample

    240722-sj6c7atepe

  • MD5

    63accd7a99e8aa6da046a96390c22a22

  • SHA1

    c785fa097f21ef56a8ac3922bd52db003d28362c

  • SHA256

    2a2a58d384c471f028fd03675b6841e441f23b5b45420f32f48f50a014a03db7

  • SHA512

    acf77ba11e2472de54e3e8661549335a4886f56ecc1f8e489f075afd6c56a486d7c6c856c6c42e1fea2966e9fbea201c4ef1752248df1e116de0d0062dd8bca3

  • SSDEEP

    6144:AHSj1jNoaeGG/Qomwxto1OXUnuw1V3m2ragg1zgEwmLbigL60ztxa0tefZ+Ve+3w:AkjZeGg9DkvHbugg1zgEwmLuj0hw0PHw

Score
10/10
bootkitevasionpersistencetrojan

Malware Config

Targets

    • Target

      pedido2012.com

    • Size

      353KB

    • MD5

      7689a14fe417e8a108141e9a6ab67c79

    • SHA1

      bbee049426873984c6611009fb508d57b4ddac29

    • SHA256

      770e387e029654b9b72a45da23c33b86a7558b12a7e01c32ead9c37808418400

    • SHA512

      1f96823619c5d245104b3d558a522e658b2797d82175d1c18cef9661b31b230c49f0c6100cad38c42fd5bff13c1ea9ae750a4cd1f3a384f7f98f5705d545fcd8

    • SSDEEP

      6144:vRSBD9uG/Qomwxtq1OXUnuwbV3k2raggr1lF4ljn+aC1meyUGimMt+3oupn0y:vRSBEg9RkvhNuggrhOLW1meyUGpzoumy

    Score
    10/10
    bootkitevasionpersistencetrojan

    • UAC bypass

      evasiontrojan

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Adds Run key to start application

      persistence

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks