bee6f4de2ad7f87f9120fbf22d2ada4553e2c421749a7ad3d68593883a0f205d | Triage

Sharing

General

Target

f903862cb794063803f3eb7de14092ea_JaffaCakes118
Size

809KB
Sample

240418-3q686sac79
MD5

f903862cb794063803f3eb7de14092ea
SHA1

6cd24b399139922035baaef70bbfa346234310c0
SHA256

bee6f4de2ad7f87f9120fbf22d2ada4553e2c421749a7ad3d68593883a0f205d
SHA512

05bc9e52a3f77412bc60700e48b13be05f6a1386cf86b7ffa8bed64668251102ed08fb54959dc21e6b4532cf914bb7720283d95887e1e399df6082f62d9cafbd
SSDEEP

12288:xkY3E01LCj/Eq3C//o8ddQteFzi5vrGc9RUTJbFSUuUcOMphMnuxRno7ZigCTgxx:jEOGCldQpVV9RsTM7MnWo7Uhb

Score

8^/10

bootkit persistence spyware stealer

Malware Config

Targets

- Target
  
  f903862cb794063803f3eb7de14092ea_JaffaCakes118
- Size
  
  809KB
- MD5
  
  f903862cb794063803f3eb7de14092ea
- SHA1
  
  6cd24b399139922035baaef70bbfa346234310c0
- SHA256
  
  bee6f4de2ad7f87f9120fbf22d2ada4553e2c421749a7ad3d68593883a0f205d
- SHA512
  
  05bc9e52a3f77412bc60700e48b13be05f6a1386cf86b7ffa8bed64668251102ed08fb54959dc21e6b4532cf914bb7720283d95887e1e399df6082f62d9cafbd
- SSDEEP
  
  12288:xkY3E01LCj/Eq3C//o8ddQteFzi5vrGc9RUTJbFSUuUcOMphMnuxRno7ZigCTgxx:jEOGCldQpVV9RsTM7MnWo7Uhb
Score

8^/10

bootkit persistence spyware stealer
- Modifies Installed Components in the registry
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Pre-OS Boot

Bootkit

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Pre-OS Boot

Bootkit

Subvert Trust Controls

Install Root Certificate

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

bootkitpersistencespywarestealer

behavioral2

bootkitpersistence