General

  • Target

    JaffaCakes118_15e3d3f5e77dc308b70f039d5e8c0f3af33d7bdcbd236f50614e4c0a4beed8fd

  • Size

    4.1MB

  • Sample

    241224-w17t5atlfv

  • MD5

    394446b9d82e2aa966185cc889e6c8a8

  • SHA1

    b144d17b17150a2f66edb5ab45daa0854363582a

  • SHA256

    15e3d3f5e77dc308b70f039d5e8c0f3af33d7bdcbd236f50614e4c0a4beed8fd

  • SHA512

    842f713bd31801d7329e1a3a5999097cd2082fcfe385f57472f0935325e88d6e0fc3084e9f3035b7b6c8907011d10e1b0d9cbb787077bdb50042336330459238

  • SSDEEP

    98304:r6DiGPFSULoAjVqV+5gauphlABX9l9BPNeCovEEgaamR/N0Q5G7kSyT:e14U8+I6uUXnTna2aae/+Q5G7k3

Malware Config

Targets

    • Target

      JaffaCakes118_15e3d3f5e77dc308b70f039d5e8c0f3af33d7bdcbd236f50614e4c0a4beed8fd

    • Size

      4.1MB

    • MD5

      394446b9d82e2aa966185cc889e6c8a8

    • SHA1

      b144d17b17150a2f66edb5ab45daa0854363582a

    • SHA256

      15e3d3f5e77dc308b70f039d5e8c0f3af33d7bdcbd236f50614e4c0a4beed8fd

    • SHA512

      842f713bd31801d7329e1a3a5999097cd2082fcfe385f57472f0935325e88d6e0fc3084e9f3035b7b6c8907011d10e1b0d9cbb787077bdb50042336330459238

    • SSDEEP

      98304:r6DiGPFSULoAjVqV+5gauphlABX9l9BPNeCovEEgaamR/N0Q5G7kSyT:e14U8+I6uUXnTna2aae/+Q5G7k3

    • Glupteba

      Glupteba is a modular loader written in Golang with various components.

    • Glupteba family

    • Glupteba payload

    • Windows security bypass

    • Modifies boot configuration data using bcdedit

    • Drops file in Drivers directory

    • Modifies Windows Firewall

    • Possible attempt to disable PatchGuard

      Rootkits can use kernel patching to embed themselves in an operating system.

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Manipulates WinMon driver.

      Roottkits write to WinMon to hide PIDs from being detected.

    • Manipulates WinMonFS driver.

      Roottkits write to WinMonFS to hide directories/files from being detected.

MITRE ATT&CK Enterprise v15

Tasks