Overview

overview

10

Static

static

3

392b89e5ce...18.exe

windows7-x64

10

392b89e5ce...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    392b89e5ce05654d4b34bb690864211e_JaffaCakes118

  • Size

    248KB

  • Sample

    240711-pz6r4syhqb

  • MD5

    392b89e5ce05654d4b34bb690864211e

  • SHA1

    a25cbd43b4d00112eb9da32e2fb4d60f3454ef74

  • SHA256

    49c0d981886a33791800a13e7d0a77f92c6f98387d4692a1fd47f9811e05b180

  • SHA512

    1dd6a5b21b09c5b8f43f30ebb2c54b18504a098e59ec7312568c232d1ba4d6dcf136ffae69dbf85c8f902c6206ab4bc50042a2106f49c4640699b32b0814946a

  • SSDEEP

    6144:SzbZ1cDY/IbErO2vIHnYgYtiwpScwqI7cucC2TruOY0azYAtWQnLpN5OUXQmr++3:SzYDY/qErO2vIHngtiwp7wqIoucC2TrS

Score
10/10
bootkitevasionpersistence

Malware Config

Targets

    • Target

      392b89e5ce05654d4b34bb690864211e_JaffaCakes118

    • Size

      248KB

    • MD5

      392b89e5ce05654d4b34bb690864211e

    • SHA1

      a25cbd43b4d00112eb9da32e2fb4d60f3454ef74

    • SHA256

      49c0d981886a33791800a13e7d0a77f92c6f98387d4692a1fd47f9811e05b180

    • SHA512

      1dd6a5b21b09c5b8f43f30ebb2c54b18504a098e59ec7312568c232d1ba4d6dcf136ffae69dbf85c8f902c6206ab4bc50042a2106f49c4640699b32b0814946a

    • SSDEEP

      6144:SzbZ1cDY/IbErO2vIHnYgYtiwpScwqI7cucC2TruOY0azYAtWQnLpN5OUXQmr++3:SzYDY/qErO2vIHngtiwp7wqIoucC2TrS

    Score
    10/10
    bootkitevasionpersistence

    • Modifies firewall policy service

      evasion

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks