e6cb9521bd4e1f2ab53c03bfef1e00b3b0c8ec71b44682c44b79a67b34493446 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

65070b7b458c5439b68e5e555a5d8ab5_JaffaCakes118
Size

596KB
Sample

240722-199sassckr
MD5

65070b7b458c5439b68e5e555a5d8ab5
SHA1

3ea4546031c961d3cf6b9b6a9179d3ddfff8df52
SHA256

e6cb9521bd4e1f2ab53c03bfef1e00b3b0c8ec71b44682c44b79a67b34493446
SHA512

da49c82e086c8f798db90d2b643ad59de67625b1efab57f8f42d9768cdf3e23d2c2160c44526467001baf93445c3d1e058d4f13394f21c44315d026c7950ef26
SSDEEP

12288:97bE3pZIUhMtk2Borsi0cXLd5c8weuKAFV7zoO+DEavGVv:db8MU+MX0cbY8NXAFV7UO+4OGVv

Score

10^/10

bootkit evasion persistence

Malware Config

Targets

- Target
  
  65070b7b458c5439b68e5e555a5d8ab5_JaffaCakes118
- Size
  
  596KB
- MD5
  
  65070b7b458c5439b68e5e555a5d8ab5
- SHA1
  
  3ea4546031c961d3cf6b9b6a9179d3ddfff8df52
- SHA256
  
  e6cb9521bd4e1f2ab53c03bfef1e00b3b0c8ec71b44682c44b79a67b34493446
- SHA512
  
  da49c82e086c8f798db90d2b643ad59de67625b1efab57f8f42d9768cdf3e23d2c2160c44526467001baf93445c3d1e058d4f13394f21c44315d026c7950ef26
- SSDEEP
  
  12288:97bE3pZIUhMtk2Borsi0cXLd5c8weuKAFV7zoO+DEavGVv:db8MU+MX0cbY8NXAFV7UO+4OGVv
Score

10^/10

bootkit evasion persistence
- Modifies firewall policy service
  evasion
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Pre-OS Boot

Bootkit

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Pre-OS Boot

Bootkit

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

bootkitevasionpersistence

behavioral2

bootkitevasionpersistence