Overview

overview

7

Static

static

3

42d285c9e2...18.exe

windows7-x64

7

42d285c9e2...18.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    42d285c9e294f2cb37992ba6215eb32c_JaffaCakes118

  • Size

    770KB

  • Sample

    241014-spe37avgmp

  • MD5

    42d285c9e294f2cb37992ba6215eb32c

  • SHA1

    d0767eb12dca80caa853f9cb32d86464f87da1e6

  • SHA256

    378e3e72bec55fbecb436fb79fe54526ce6cf53422eea608fe9d76688ea4cb1a

  • SHA512

    04302dce3a1d3eaf2bc61d6b2c16ffa008399fb1e84a59ede5eaff5360174fa2f4652663d0e0aa498777ac7b5e7348debbf9277813e21ff2902f0a28af505f13

  • SSDEEP

    24576:vNBIZBwai4b220RuJQGFP8BVYTF0sabBp:YEmSaFP8BVsFQNp

Score
7/10
bootkitdiscoveryevasionpersistencetrojan

Malware Config

Targets

    • Target

      42d285c9e294f2cb37992ba6215eb32c_JaffaCakes118

    • Size

      770KB

    • MD5

      42d285c9e294f2cb37992ba6215eb32c

    • SHA1

      d0767eb12dca80caa853f9cb32d86464f87da1e6

    • SHA256

      378e3e72bec55fbecb436fb79fe54526ce6cf53422eea608fe9d76688ea4cb1a

    • SHA512

      04302dce3a1d3eaf2bc61d6b2c16ffa008399fb1e84a59ede5eaff5360174fa2f4652663d0e0aa498777ac7b5e7348debbf9277813e21ff2902f0a28af505f13

    • SSDEEP

      24576:vNBIZBwai4b220RuJQGFP8BVYTF0sabBp:YEmSaFP8BVsFQNp

    Score
    7/10
    bootkitdiscoveryevasionpersistencetrojan

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks whether UAC is enabled

      evasiontrojan

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks