Overview

overview

7

Static

static

7

009146e68b...18.exe

windows7-x64

7

009146e68b...18.exe

windows10-2004-x64

7

Sharing

Copy URL Twitter E-mail

General

  • Target

    009146e68b3ccb693ae32361226b9bec_JaffaCakes118

  • Size

    88KB

  • Sample

    240930-k9hqtasajb

  • MD5

    009146e68b3ccb693ae32361226b9bec

  • SHA1

    b59a7a3f92d15562d9ab4c9a6505cf7c8405e564

  • SHA256

    aeabdc682987605e049f07ea85c62d3fcbbc1e5d2b56e1baaedbbd0efceddeca

  • SHA512

    a15841bb47b7ea3f6cb4e57391a52ac36720705879c7232e571dcb82b50ff933f88ab624b3d5f64d8de99684d2be331de9a81e7c6f77071a6975821ab9549ef8

  • SSDEEP

    1536:dXNXdlRH+Dwk4cSGesvhC8plnQ85+HwClgfTQqPTFTCtOQ8CcfiA:ddtlRH+UxGzh3HQ85+QqoTBfiA

Score
7/10
bootkitdiscoverypersistencevmprotect

Malware Config

Targets

    • Target

      009146e68b3ccb693ae32361226b9bec_JaffaCakes118

    • Size

      88KB

    • MD5

      009146e68b3ccb693ae32361226b9bec

    • SHA1

      b59a7a3f92d15562d9ab4c9a6505cf7c8405e564

    • SHA256

      aeabdc682987605e049f07ea85c62d3fcbbc1e5d2b56e1baaedbbd0efceddeca

    • SHA512

      a15841bb47b7ea3f6cb4e57391a52ac36720705879c7232e571dcb82b50ff933f88ab624b3d5f64d8de99684d2be331de9a81e7c6f77071a6975821ab9549ef8

    • SSDEEP

      1536:dXNXdlRH+Dwk4cSGesvhC8plnQ85+HwClgfTQqPTFTCtOQ8CcfiA:ddtlRH+UxGzh3HQ85+QqoTBfiA

    Score
    7/10
    bootkitdiscoverypersistencevmprotect

    • Executes dropped EXE

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks