Overview

overview

7

Static

static

7

49250ef084...18.exe

windows7-x64

7

49250ef084...18.exe

windows10-2004-x64

7

Sharing

Copy URL Twitter E-mail

General

  • Target
    49250ef0849fb91e9c13a63bec4f2a23_JaffaCakes118
  • Size 12.4MB
  • Sample241015-v79rmaxeqe
  • SHA256 6256b8aa6381fd807255210e825402c898fceac6d7dbbe94006458b362edd989
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
bootkitdiscoverypersistencevmprotect

Malware Config

Targets

    • Target
      49250ef0849fb91e9c13a63bec4f2a23_JaffaCakes118
    • Size 12.4MB
    • SHA256 6256b8aa6381fd807255210e825402c898fceac6d7dbbe94006458b362edd989
    • MD5 SHA1 SHA512 SSDEEP
    Score
    7/10
    bootkitdiscoverypersistencevmprotect

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks