53fc1bbf0dbcb61f30ec7873f2a06eff5c2012b9571039f59ea6f030e10c1495 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

5e919669b5c10051c44d6c616bebc9d9_JaffaCakes118
Size

424KB
Sample

240720-b8mhya1crk
MD5

5e919669b5c10051c44d6c616bebc9d9
SHA1

2145c18503bee06d76467a5b38b83f3b7f9a4f6e
SHA256

53fc1bbf0dbcb61f30ec7873f2a06eff5c2012b9571039f59ea6f030e10c1495
SHA512

9adfa16da7217c1026754ef11726e77943b2b9c41b75cfe88e07df7e683c6fa17379dea48370295fa8c9992e1dafd199b743a616e46d300fdfd43f771e1297d2
SSDEEP

6144:wiryibmJGc715gyUsrgVhuMrKV4jF9GZZMtGOkq84BVMT:wirdbaG8CyUsr+0h4jFAZNhq84BVMT

Score

10^/10

bootkit evasion persistence

Malware Config

Targets

- Target
  
  5e919669b5c10051c44d6c616bebc9d9_JaffaCakes118
- Size
  
  424KB
- MD5
  
  5e919669b5c10051c44d6c616bebc9d9
- SHA1
  
  2145c18503bee06d76467a5b38b83f3b7f9a4f6e
- SHA256
  
  53fc1bbf0dbcb61f30ec7873f2a06eff5c2012b9571039f59ea6f030e10c1495
- SHA512
  
  9adfa16da7217c1026754ef11726e77943b2b9c41b75cfe88e07df7e683c6fa17379dea48370295fa8c9992e1dafd199b743a616e46d300fdfd43f771e1297d2
- SSDEEP
  
  6144:wiryibmJGc715gyUsrgVhuMrKV4jF9GZZMtGOkq84BVMT:wirdbaG8CyUsr+0h4jFAZNhq84BVMT
Score

10^/10

bootkit evasion persistence
- Modifies firewall policy service
  evasion
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Pre-OS Boot

Bootkit

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Pre-OS Boot

Bootkit

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

bootkitevasionpersistence

behavioral2

bootkitevasionpersistence