Overview

overview

6

Static

static

3

748ccae997...18.exe

windows7-x64

6

748ccae997...18.exe

windows10-2004-x64

5

Sharing

Copy URL
Twitter E-mail

General

  • Target

    748ccae997e411b6cb7986b0c435233f_JaffaCakes118

  • Size

    265KB

  • Sample

    240726-sgdv6aydrf

  • MD5

    748ccae997e411b6cb7986b0c435233f

  • SHA1

    ddd06b24cd1416f7f7898a07d913a5d4cfdc43f0

  • SHA256

    08f256c6e701a5fa65b6713d494c29263abc88cacb01ffa3a263b8e2666780e6

  • SHA512

    2c81f183376ea4d13e3890bf2fc9bc92df6063d76edaf2e767bdbc17df949e68ae245b3b3cb5a99a79e7dc048ab08e4f0fd4765dc24a69a89d2c72fe263174db

  • SSDEEP

    6144:gACs80oCRlhjZ+f4bTpD+4TyQOI5JgpcvqNplc42LcUTeD:gnsHlPhjZ+fIDnT0Iw5pd2LhSD

Score
6/10
bootkitdiscoverypersistence

Malware Config

Targets

    • Target

      748ccae997e411b6cb7986b0c435233f_JaffaCakes118

    • Size

      265KB

    • MD5

      748ccae997e411b6cb7986b0c435233f

    • SHA1

      ddd06b24cd1416f7f7898a07d913a5d4cfdc43f0

    • SHA256

      08f256c6e701a5fa65b6713d494c29263abc88cacb01ffa3a263b8e2666780e6

    • SHA512

      2c81f183376ea4d13e3890bf2fc9bc92df6063d76edaf2e767bdbc17df949e68ae245b3b3cb5a99a79e7dc048ab08e4f0fd4765dc24a69a89d2c72fe263174db

    • SSDEEP

      6144:gACs80oCRlhjZ+f4bTpD+4TyQOI5JgpcvqNplc42LcUTeD:gnsHlPhjZ+fIDnT0Iw5pd2LhSD

    Score
    6/10
    bootkitdiscoverypersistence

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Credential Access

Discovery

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks