Overview

overview

10

Static

static

3

37042f3242...18.exe

windows7-x64

10

37042f3242...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    37042f3242accf30af6ef912e5324cff_JaffaCakes118

  • Size

    436KB

  • Sample

    240711-asyqlaydmj

  • MD5

    37042f3242accf30af6ef912e5324cff

  • SHA1

    5af9e35fd9e25f8f7e896d255445b94df0635756

  • SHA256

    1a7ff012986c6412b36cea57202f326103535091d0e40e3881a0ac60ad80911f

  • SHA512

    24955d7d14626121e045580ac6fabdc11483a79ac6260b848e3ec405c722a4567cb79a47bb5a562ec5446dbb33f2f357bfbcfcc4279eb333db58af0eae7a2215

  • SSDEEP

    12288:72Z26DTuyStRdgagQc2Z2Z2Z2heGZR3XUigVe4DyVBnuC8hXCVNIn:72Z26nK+agT2Z2Z2Z2heWOigVpAuC5Vw

Score
10/10
bootkitevasionpersistenceprivilege_escalation

Malware Config

Targets

    • Target

      37042f3242accf30af6ef912e5324cff_JaffaCakes118

    • Size

      436KB

    • MD5

      37042f3242accf30af6ef912e5324cff

    • SHA1

      5af9e35fd9e25f8f7e896d255445b94df0635756

    • SHA256

      1a7ff012986c6412b36cea57202f326103535091d0e40e3881a0ac60ad80911f

    • SHA512

      24955d7d14626121e045580ac6fabdc11483a79ac6260b848e3ec405c722a4567cb79a47bb5a562ec5446dbb33f2f357bfbcfcc4279eb333db58af0eae7a2215

    • SSDEEP

      12288:72Z26DTuyStRdgagQc2Z2Z2Z2heGZR3XUigVe4DyVBnuC8hXCVNIn:72Z26nK+agT2Z2Z2Z2heWOigVpAuC5Vw

    Score
    10/10
    bootkitevasionpersistenceprivilege_escalation

    • Modifies WinLogon for persistence

      persistence

    • Modifies Windows Firewall

      evasion

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

1
T1547.004

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

1
T1547.004

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Defense Evasion

Impair Defenses

1
T1562

Disable or Modify System Firewall

1
T1562.004

Modify Registry

3
T1112

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks