Overview

overview

10

Static

static

3

8ede069e61...18.exe

windows7-x64

10

8ede069e61...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    8ede069e61d69fc5e53c69073586f036_JaffaCakes118

  • Size

    914KB

  • Sample

    240812-qhn2easenn

  • MD5

    8ede069e61d69fc5e53c69073586f036

  • SHA1

    2527902e0abc0ed3340b337a6020f36f508f5b9f

  • SHA256

    6f08e62df07425b4cc68a8f517ad47855b6d59ad9a2e71a75cbc3d1f47e4ba07

  • SHA512

    b1e1235d331dadaccc9c9c3b807d93e0890e4145a75455f64100b1ed41edd6257d2dea48656df275bb4a771dde11331d4e9dc09076e0ab62381ec587a3f0d22c

  • SSDEEP

    12288:6DhJLDWNkoorZiePNnAN0y2YFlycFtroiMjXPLh3z7qLjq+5:6Dh4+r4ePNe2WljLroiMzjKV

Score
10/10
bootkitdiscoverypersistence

Malware Config

Targets

    • Target

      8ede069e61d69fc5e53c69073586f036_JaffaCakes118

    • Size

      914KB

    • MD5

      8ede069e61d69fc5e53c69073586f036

    • SHA1

      2527902e0abc0ed3340b337a6020f36f508f5b9f

    • SHA256

      6f08e62df07425b4cc68a8f517ad47855b6d59ad9a2e71a75cbc3d1f47e4ba07

    • SHA512

      b1e1235d331dadaccc9c9c3b807d93e0890e4145a75455f64100b1ed41edd6257d2dea48656df275bb4a771dde11331d4e9dc09076e0ab62381ec587a3f0d22c

    • SSDEEP

      12288:6DhJLDWNkoorZiePNnAN0y2YFlycFtroiMjXPLh3z7qLjq+5:6Dh4+r4ePNe2WljLroiMzjKV

    Score
    10/10
    bootkitdiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks