Overview

overview

7

Static

static

3

8ac4a3ca96...18.exe

windows7-x64

7

8ac4a3ca96...18.exe

windows10-2004-x64

7

Sharing

Copy URL Twitter E-mail

General

  • Target

    8ac4a3ca963846be94c6718305c6fc89_JaffaCakes118

  • Size

    582KB

  • Sample

    240811-r4lc3sybla

  • MD5

    8ac4a3ca963846be94c6718305c6fc89

  • SHA1

    29b31a0ca4afe01e2ef2465131fdc62c4b40fcff

  • SHA256

    b4a557e8296aa176bc483680ac1621cd6e0d4faf6ab20e58c3b67057345fd2e5

  • SHA512

    82105a818ebee969f52a6cf9ccd9a88b5c761c9489e796a1ce4915e564c3ec524de15dce92a1fb81d6f2a484d1c32f7e0082276faa751bbee6a2d8a403e563ba

  • SSDEEP

    12288:DEuLIT88KEFhMD1erMOmycAfsQ+3JFL6b7MP+Dd2v:DEuwXDF2erMjyc6RGI7MP+h2v

Score
7/10
bootkitdiscoveryevasionpersistence

Malware Config

Targets

    • Target

      8ac4a3ca963846be94c6718305c6fc89_JaffaCakes118

    • Size

      582KB

    • MD5

      8ac4a3ca963846be94c6718305c6fc89

    • SHA1

      29b31a0ca4afe01e2ef2465131fdc62c4b40fcff

    • SHA256

      b4a557e8296aa176bc483680ac1621cd6e0d4faf6ab20e58c3b67057345fd2e5

    • SHA512

      82105a818ebee969f52a6cf9ccd9a88b5c761c9489e796a1ce4915e564c3ec524de15dce92a1fb81d6f2a484d1c32f7e0082276faa751bbee6a2d8a403e563ba

    • SSDEEP

      12288:DEuLIT88KEFhMD1erMOmycAfsQ+3JFL6b7MP+Dd2v:DEuwXDF2erMjyc6RGI7MP+h2v

    Score
    7/10
    bootkitdiscoveryevasionpersistence

    • Executes dropped EXE

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Loads dropped DLL

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks