Overview

overview

7

Static

static

3

fc66b7875a...18.exe

windows7-x64

7

fc66b7875a...18.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fc66b7875add3e5507b88048937fa4af_JaffaCakes118

  • Size

    136KB

  • Sample

    240420-k1q1tsdf8x

  • MD5

    fc66b7875add3e5507b88048937fa4af

  • SHA1

    02e30b09c3dbbce94939b3bf97a45f1b1f460a88

  • SHA256

    e230003597e8a3942e9358b9642e1229f01d566383b202153927fc4bd806715f

  • SHA512

    6c98f5170c7ca87c105065d94234305d64192799266929cc57af2212677af22ed16e6f44b6990cb925f2ab4c8c07131d0511ea4aac0f7b3cab0cec6b3d2902a4

  • SSDEEP

    3072:hOstg+b+nn8MNr+2/DAWjlO2H2y4UerhcXVEhojKmDH89MkXa4OoyWNu:hOn+b+n8M5+gxOTyTq2XVEhojp81XaDl

Score
7/10
bootkitpersistence

Malware Config

Targets

    • Target

      fc66b7875add3e5507b88048937fa4af_JaffaCakes118

    • Size

      136KB

    • MD5

      fc66b7875add3e5507b88048937fa4af

    • SHA1

      02e30b09c3dbbce94939b3bf97a45f1b1f460a88

    • SHA256

      e230003597e8a3942e9358b9642e1229f01d566383b202153927fc4bd806715f

    • SHA512

      6c98f5170c7ca87c105065d94234305d64192799266929cc57af2212677af22ed16e6f44b6990cb925f2ab4c8c07131d0511ea4aac0f7b3cab0cec6b3d2902a4

    • SSDEEP

      3072:hOstg+b+nn8MNr+2/DAWjlO2H2y4UerhcXVEhojKmDH89MkXa4OoyWNu:hOn+b+n8M5+gxOTyTq2XVEhojp81XaDl

    Score
    7/10
    bootkitpersistence

    • Deletes itself

    • Loads dropped DLL

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks