14ec6d9eb96ca4ad53e29096669cdc7592e80a1d537ea515ededd193aeabda4b | Triage

Sharing

General

Target

fb184e6c17e6ec8ab76c7a3f4049dbc8_JaffaCakes118
Size

399KB
Sample

240419-y4ry7aee62
MD5

fb184e6c17e6ec8ab76c7a3f4049dbc8
SHA1

c18d586a09af3e3d0b2a9abe862a1fd1ae489b99
SHA256

14ec6d9eb96ca4ad53e29096669cdc7592e80a1d537ea515ededd193aeabda4b
SHA512

fe752dc4d29319113575607b70a9e8b69f1ef3f313d5e92d074301858c3f104ad0f464ed9d860ac38cd1993733a65e2f6c3ea183b04545e996e86f1d3cdf47fe
SSDEEP

12288:h4qYOZvkWzR1z5onsTgz8e7BpL+HXBT0Iw5p+4diJ580N:WahXzxy8e/WKl5U7b

Score

7^/10

aspackv2 bootkit persistence

Malware Config

Targets

- Target
  
  fb184e6c17e6ec8ab76c7a3f4049dbc8_JaffaCakes118
- Size
  
  399KB
- MD5
  
  fb184e6c17e6ec8ab76c7a3f4049dbc8
- SHA1
  
  c18d586a09af3e3d0b2a9abe862a1fd1ae489b99
- SHA256
  
  14ec6d9eb96ca4ad53e29096669cdc7592e80a1d537ea515ededd193aeabda4b
- SHA512
  
  fe752dc4d29319113575607b70a9e8b69f1ef3f313d5e92d074301858c3f104ad0f464ed9d860ac38cd1993733a65e2f6c3ea183b04545e996e86f1d3cdf47fe
- SSDEEP
  
  12288:h4qYOZvkWzR1z5onsTgz8e7BpL+HXBT0Iw5p+4diJ580N:WahXzxy8e/WKl5U7b
Score

7^/10

bootkit persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Pre-OS Boot

Bootkit

Privilege Escalation

Defense Evasion

Pre-OS Boot

Bootkit

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1

bootkitpersistence

behavioral2