Overview

overview

7

Static

static

3

6fe0062592...18.exe

windows7-x64

7

6fe0062592...18.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6fe006259294449ea5effbe6f4f472d9_JaffaCakes118

  • Size

    34KB

  • Sample

    240725-rbthzsvgne

  • MD5

    6fe006259294449ea5effbe6f4f472d9

  • SHA1

    398f3f61b77e0400ddb0f596291727ac9be7e490

  • SHA256

    96cf63e06797a19b5180b2fd6a5dae54f61141aa7279b6b05047761133c1b8c8

  • SHA512

    a5d4e299bd42c76dc64faac22cdc17682e9452582df2eb9ed441f5470ba9571ab8beb4c63e01378949506046be1df58a0945b2d617df24ffc4b8fb7eff1ce9f4

  • SSDEEP

    768:kJG9mSndWAIDEziK5su1rdABqFYz4j8ORhoob:gGwSnd3zL57fFYyRGy

Score
7/10
bootkitdefense_evasiondiscoverypersistence

Malware Config

Targets

    • Target

      6fe006259294449ea5effbe6f4f472d9_JaffaCakes118

    • Size

      34KB

    • MD5

      6fe006259294449ea5effbe6f4f472d9

    • SHA1

      398f3f61b77e0400ddb0f596291727ac9be7e490

    • SHA256

      96cf63e06797a19b5180b2fd6a5dae54f61141aa7279b6b05047761133c1b8c8

    • SHA512

      a5d4e299bd42c76dc64faac22cdc17682e9452582df2eb9ed441f5470ba9571ab8beb4c63e01378949506046be1df58a0945b2d617df24ffc4b8fb7eff1ce9f4

    • SSDEEP

      768:kJG9mSndWAIDEziK5su1rdABqFYz4j8ORhoob:gGwSnd3zL57fFYyRGy

    Score
    7/10
    bootkitdefense_evasiondiscoverypersistence

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Indicator Removal: File Deletion

      Adversaries may delete files left behind by the actions of their intrusion activity.

      defense_evasion

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks