1bb44069eded7296bad34edbda02b5a67d8a19f9980e4f973a28690f684a7b4b | Triage

Sharing

General

Target

5d270a303e179e8ad15fd8a62ceabdc1_JaffaCakes118
Size

144KB
Sample

240719-w6arksxgmd
MD5

5d270a303e179e8ad15fd8a62ceabdc1
SHA1

ade6eae8fd4fda7836e522d6d9c7367c5265cd4a
SHA256

1bb44069eded7296bad34edbda02b5a67d8a19f9980e4f973a28690f684a7b4b
SHA512

41e689abb54fecb019a7ab091b2a957c78d84079aa508f5ed65add1347e7feda8e9f2041da82df34dcd67f48082d18e4a90e00b1b3f3029b8486a1847a9d477e
SSDEEP

3072:5cVwWS80KnUumy0pmHCrDvIHBirxiCQFp/3M:owWS89bmy9i+Birxf

Score

7^/10

bootkit persistence

Malware Config

Targets

- Target
  
  5d270a303e179e8ad15fd8a62ceabdc1_JaffaCakes118
- Size
  
  144KB
- MD5
  
  5d270a303e179e8ad15fd8a62ceabdc1
- SHA1
  
  ade6eae8fd4fda7836e522d6d9c7367c5265cd4a
- SHA256
  
  1bb44069eded7296bad34edbda02b5a67d8a19f9980e4f973a28690f684a7b4b
- SHA512
  
  41e689abb54fecb019a7ab091b2a957c78d84079aa508f5ed65add1347e7feda8e9f2041da82df34dcd67f48082d18e4a90e00b1b3f3029b8486a1847a9d477e
- SSDEEP
  
  3072:5cVwWS80KnUumy0pmHCrDvIHBirxiCQFp/3M:owWS89bmy9i+Birxf
Score

7^/10

bootkit persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

Bootkit

Privilege Escalation

Defense Evasion

Pre-OS Boot

Bootkit

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

bootkitpersistence

behavioral2