7aa8d2b61b8bb11770a17b8c08070ada5abaf966be962d41fca207939def00b2 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

45ca3bd12c3496c4b2736ff9d72099b1_JaffaCakes118
Size

364KB
Sample

240714-ph86xazejj
MD5

45ca3bd12c3496c4b2736ff9d72099b1
SHA1

4b397a7a3b854b7c8978a351b91754477ec5db19
SHA256

7aa8d2b61b8bb11770a17b8c08070ada5abaf966be962d41fca207939def00b2
SHA512

b8e577d79d847a71b37bf0b5ab1bae5d7ba879d44056568c6847f57e378f40eb80aa42bfda0192a82d91afd64081d434ab98280597504d4a1e460e4c23d0dfdf
SSDEEP

6144:Jl+lJLgdW/3LDPIrdYzniDO/VMFT7TF7tOvKS0Hg3:JMwYzn6QVMFd7WUHQ

Score

6^/10

bootkit persistence

Malware Config

Targets

- Target
  
  45ca3bd12c3496c4b2736ff9d72099b1_JaffaCakes118
- Size
  
  364KB
- MD5
  
  45ca3bd12c3496c4b2736ff9d72099b1
- SHA1
  
  4b397a7a3b854b7c8978a351b91754477ec5db19
- SHA256
  
  7aa8d2b61b8bb11770a17b8c08070ada5abaf966be962d41fca207939def00b2
- SHA512
  
  b8e577d79d847a71b37bf0b5ab1bae5d7ba879d44056568c6847f57e378f40eb80aa42bfda0192a82d91afd64081d434ab98280597504d4a1e460e4c23d0dfdf
- SSDEEP
  
  6144:Jl+lJLgdW/3LDPIrdYzniDO/VMFT7TF7tOvKS0Hg3:JMwYzn6QVMFd7WUHQ
Score

6^/10

bootkit persistence
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

Bootkit

Privilege Escalation

Defense Evasion

Pre-OS Boot

Bootkit

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

bootkitpersistence

behavioral2

bootkitpersistence