Overview

overview

10

Static

static

3

148327a59b...18.exe

windows7-x64

10

148327a59b...18.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    148327a59b3f1020a2f2cccc47d19dfb_JaffaCakes118

  • Size

    2.3MB

  • Sample

    241004-xbrmaazdmj

  • MD5

    148327a59b3f1020a2f2cccc47d19dfb

  • SHA1

    4bf8542cf745ab80bb8e08ad7c9effd8a918b59f

  • SHA256

    9c2c0be7f6fc2a252852d108251c01f65ccc53ad81e75235608a33db5d44a677

  • SHA512

    b6a097a5b5971cc7fedac0d9104e3a359652766bdf8df9d7d772c480cb9a595d78e0003bcca357696cf97e714056c36782e4319d859b3628ce22982aca320af0

  • SSDEEP

    49152:Y8ev4j/fTa2Nj0YRJ+tqb+U/f6pN4yhW8Chlsu4I:Bev4jX7IYRJ+C+UfShWdh/j

Score
10/10
bootkitdiscoveryevasionpersistencetrojanupx

Malware Config

Targets

    • Target

      148327a59b3f1020a2f2cccc47d19dfb_JaffaCakes118

    • Size

      2.3MB

    • MD5

      148327a59b3f1020a2f2cccc47d19dfb

    • SHA1

      4bf8542cf745ab80bb8e08ad7c9effd8a918b59f

    • SHA256

      9c2c0be7f6fc2a252852d108251c01f65ccc53ad81e75235608a33db5d44a677

    • SHA512

      b6a097a5b5971cc7fedac0d9104e3a359652766bdf8df9d7d772c480cb9a595d78e0003bcca357696cf97e714056c36782e4319d859b3628ce22982aca320af0

    • SSDEEP

      49152:Y8ev4j/fTa2Nj0YRJ+tqb+U/f6pN4yhW8Chlsu4I:Bev4jX7IYRJ+C+UfShWdh/j

    Score
    10/10
    bootkitdiscoveryevasionpersistencetrojanupx

    • UAC bypass

      evasiontrojan

    • Checks for common network interception software

      Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.

      evasion

    • Enumerates VirtualBox registry keys

      evasion

    • Drops file in Drivers directory

    • Event Triggered Execution: Image File Execution Options Injection

      persistence

    • Adds Run key to start application

      persistence

    • Checks for any installed AV software in registry

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Checks whether UAC is enabled

      evasiontrojan

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Event Triggered Execution

1
T1546

Image File Execution Options Injection

1
T1546.012

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Privilege Escalation

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Event Triggered Execution

1
T1546

Image File Execution Options Injection

1
T1546.012

Defense Evasion

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Impair Defenses

1
T1562

Disable or Modify Tools

1
T1562.001

Modify Registry

4
T1112

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Virtualization/Sandbox Evasion

1
T1497

Credential Access

Discovery

Peripheral Device Discovery

1
T1120

Query Registry

3
T1012

Software Discovery

2
T1518

Security Software Discovery

1
T1518.001

System Information Discovery

3
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Virtualization/Sandbox Evasion

1
T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks