Overview

overview

10

Static

static

3

2e3883c691...18.exe

windows7-x64

10

2e3883c691...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2e3883c6913458524489f5d462646256_JaffaCakes118

  • Size

    194KB

  • Sample

    240708-3hetysxbnf

  • MD5

    2e3883c6913458524489f5d462646256

  • SHA1

    ffbec2986e76fbb9ff7fac9f60f55f6da34e125f

  • SHA256

    5ac8eca2ae52ce97e83646f5b3e612dda8d3ba00cc3173f6e9740695ad0b21cc

  • SHA512

    b9b824eb107ceace5111d1a8c14dd4ea71f8853aab3ae2e6153b212785c3c72d480739110faabed865bcc5a79a092f650d646f23761a54d30f14961f923d492a

  • SSDEEP

    6144:e9lA189qNR9701KY76ewvP6bQ7yMP+DE827SH6:il4kmRyp7I6b7MP+Dd2J

Score
10/10
bootkitevasionpersistence

Malware Config

Targets

    • Target

      2e3883c6913458524489f5d462646256_JaffaCakes118

    • Size

      194KB

    • MD5

      2e3883c6913458524489f5d462646256

    • SHA1

      ffbec2986e76fbb9ff7fac9f60f55f6da34e125f

    • SHA256

      5ac8eca2ae52ce97e83646f5b3e612dda8d3ba00cc3173f6e9740695ad0b21cc

    • SHA512

      b9b824eb107ceace5111d1a8c14dd4ea71f8853aab3ae2e6153b212785c3c72d480739110faabed865bcc5a79a092f650d646f23761a54d30f14961f923d492a

    • SSDEEP

      6144:e9lA189qNR9701KY76ewvP6bQ7yMP+DE827SH6:il4kmRyp7I6b7MP+Dd2J

    Score
    10/10
    bootkitevasionpersistence

    • Modifies security service

      evasion

    • Executes dropped EXE

    • Loads dropped DLL

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks