Overview

overview

7

Static

static

3

0c78ea76b7...18.exe

windows7-x64

7

0c78ea76b7...18.exe

windows10-2004-x64

7

Sharing

Copy URL Twitter E-mail

General

  • Target

    0c78ea76b704c540ce6d6712abc81b56_JaffaCakes118

  • Size

    972KB

  • Sample

    241002-z2b1maxbjk

  • MD5

    0c78ea76b704c540ce6d6712abc81b56

  • SHA1

    aa75efcaacd179bc92d1d8dbe6e8c85afe9b603b

  • SHA256

    73d8ef42b59d63173aa01344826cddaa051486171b9a221b6edd832f20866992

  • SHA512

    2a966903f48d0fa2cc1e2f1ac59ce9e79538fdf2a1aaf3da14e2a55a2170aa29d319d8d56e096b58cf5df46f7a4acce07117f58f9602ce95d40230eb9d6f41f7

  • SSDEEP

    24576:0RA0d6iY4SZ+zXWnacY2vyTt6ms4kssocJlp7n:0RA0d6iYJZEXv214ilx

Score
7/10
bootkitdiscoveryevasionpersistencetrojan

Malware Config

Targets

    • Target

      0c78ea76b704c540ce6d6712abc81b56_JaffaCakes118

    • Size

      972KB

    • MD5

      0c78ea76b704c540ce6d6712abc81b56

    • SHA1

      aa75efcaacd179bc92d1d8dbe6e8c85afe9b603b

    • SHA256

      73d8ef42b59d63173aa01344826cddaa051486171b9a221b6edd832f20866992

    • SHA512

      2a966903f48d0fa2cc1e2f1ac59ce9e79538fdf2a1aaf3da14e2a55a2170aa29d319d8d56e096b58cf5df46f7a4acce07117f58f9602ce95d40230eb9d6f41f7

    • SSDEEP

      24576:0RA0d6iY4SZ+zXWnacY2vyTt6ms4kssocJlp7n:0RA0d6iYJZEXv214ilx

    Score
    7/10
    bootkitdiscoveryevasionpersistencetrojan

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Checks whether UAC is enabled

      evasiontrojan

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks