Overview

overview

7

Static

static

3

b4e6ac461f...18.exe

windows7-x64

7

b4e6ac461f...18.exe

windows10-2004-x64

7

Sharing

Copy URL Twitter E-mail

General

  • Target

    b4e6ac461f4ccaef315039341c6866d8_JaffaCakes118

  • Size

    567KB

  • Sample

    240821-y4246aydjc

  • MD5

    b4e6ac461f4ccaef315039341c6866d8

  • SHA1

    6b0d1c9112958ae0f0852b1d94941b40204bb0b0

  • SHA256

    d76c1c8bf0ef155dd4b561a4784f7e93826bdd762115f7e0e72159e793705868

  • SHA512

    8fa69d98fe5b764c6b978beefa3b146a74755c57c11716430adb27097b794f90576b26d6592ede434a197f5bd526839bf0fa60c5fd2dc06154972dcd362247e9

  • SSDEEP

    12288:b1dlZo5yKGfgI8cXA7g5SDUnER4PpCkYN2v0KoqyTH7V8yOBy1xYCYdT/W:b1dlZo5BcQ7ZUneYpCkhvZ7OH6oYCYs

Score
7/10
bootkitdiscoverypersistenceupx

Malware Config

Targets

    • Target

      b4e6ac461f4ccaef315039341c6866d8_JaffaCakes118

    • Size

      567KB

    • MD5

      b4e6ac461f4ccaef315039341c6866d8

    • SHA1

      6b0d1c9112958ae0f0852b1d94941b40204bb0b0

    • SHA256

      d76c1c8bf0ef155dd4b561a4784f7e93826bdd762115f7e0e72159e793705868

    • SHA512

      8fa69d98fe5b764c6b978beefa3b146a74755c57c11716430adb27097b794f90576b26d6592ede434a197f5bd526839bf0fa60c5fd2dc06154972dcd362247e9

    • SSDEEP

      12288:b1dlZo5yKGfgI8cXA7g5SDUnER4PpCkYN2v0KoqyTH7V8yOBy1xYCYdT/W:b1dlZo5BcQ7ZUneYpCkhvZ7OH6oYCYs

    Score
    7/10
    bootkitdiscoverypersistenceupx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks