Overview

overview

7

Static

static

3

a4367fd080...18.exe

windows7-x64

7

a4367fd080...18.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a4367fd0803208674ccf2663ebfae60a_JaffaCakes118

  • Size

    674KB

  • Sample

    240817-1dmb5axhne

  • MD5

    a4367fd0803208674ccf2663ebfae60a

  • SHA1

    92f077d009e4d8ffdf3f05d63de818ce252aefb2

  • SHA256

    5d1394a6898e0e33ec9c566549a2e9f2f8a46b17a320fd399d9bcd9c82d065cd

  • SHA512

    f0c0a512e2e0469a92b180422319854b952a73c04681c07425cd9b454532542c214a1195d0c2bd6301e8027f214507ca05f4321e967ea16d0f594d6eb08c81e9

  • SSDEEP

    12288:kGxaPkDsihoNlb+Fg9to8v+hEXFst9TQqn6v/w5Nf5UQ84VcXkmQW06WpjIy+StE:kYaPkDssoNlwUt5+hL9TVvzGaVpJW0Fy

Score
7/10
bootkitdiscoverypersistence

Malware Config

Targets

    • Target

      a4367fd0803208674ccf2663ebfae60a_JaffaCakes118

    • Size

      674KB

    • MD5

      a4367fd0803208674ccf2663ebfae60a

    • SHA1

      92f077d009e4d8ffdf3f05d63de818ce252aefb2

    • SHA256

      5d1394a6898e0e33ec9c566549a2e9f2f8a46b17a320fd399d9bcd9c82d065cd

    • SHA512

      f0c0a512e2e0469a92b180422319854b952a73c04681c07425cd9b454532542c214a1195d0c2bd6301e8027f214507ca05f4321e967ea16d0f594d6eb08c81e9

    • SSDEEP

      12288:kGxaPkDsihoNlb+Fg9to8v+hEXFst9TQqn6v/w5Nf5UQ84VcXkmQW06WpjIy+StE:kYaPkDssoNlwUt5+hL9TVvzGaVpJW0Fy

    Score
    7/10
    bootkitdiscoverypersistence

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Loads dropped DLL

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks