496e0dcb004cb18cf6943df0d15061098cefd02db201a5e99126131d73f91856 | Triage

Sharing

General

Target

95d2ed79649aa99c376506b023cf87b8_JaffaCakes118
Size

84KB
Sample

240814-m4pchstbll
MD5

95d2ed79649aa99c376506b023cf87b8
SHA1

53ba29bc911f8c008ec0404a7a12eb375a239b62
SHA256

496e0dcb004cb18cf6943df0d15061098cefd02db201a5e99126131d73f91856
SHA512

64057f51efccdf84e71bf6fec277f096e0b8ce85c46c34aec0b0133574f1d94259076e7a51f5010103f01797642fb0548a8599c534cad6df54ea2f3d3c2d2a18
SSDEEP

768:DAt8DlVQu+I+UWHQOLzNq+A1WuptrknoFuhTtdOLi7JKFHjP+Gh8d4Wp2NzI1U2x:4CR+LzNDkW4t1ATtdOLieHq88d4WpBN

Score

10^/10

bootkit discovery evasion persistence

Malware Config

Targets

- Target
  
  95d2ed79649aa99c376506b023cf87b8_JaffaCakes118
- Size
  
  84KB
- MD5
  
  95d2ed79649aa99c376506b023cf87b8
- SHA1
  
  53ba29bc911f8c008ec0404a7a12eb375a239b62
- SHA256
  
  496e0dcb004cb18cf6943df0d15061098cefd02db201a5e99126131d73f91856
- SHA512
  
  64057f51efccdf84e71bf6fec277f096e0b8ce85c46c34aec0b0133574f1d94259076e7a51f5010103f01797642fb0548a8599c534cad6df54ea2f3d3c2d2a18
- SSDEEP
  
  768:DAt8DlVQu+I+UWHQOLzNq+A1WuptrknoFuhTtdOLi7JKFHjP+Gh8d4Wp2NzI1U2x:4CR+LzNDkW4t1ATtdOLieHq88d4WpBN
Score

10^/10

discovery bootkit evasion persistence
- Modifies visibility of file extensions in Explorer
  evasion
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Active Setup

Registry Run Keys / Startup Folder

Pre-OS Boot

Bootkit

Privilege Escalation

Boot or Logon Autostart Execution

Active Setup

Registry Run Keys / Startup Folder

Defense Evasion

Hide Artifacts

Hidden Files and Directories

Modify Registry

Pre-OS Boot

Bootkit

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

bootkitdiscoveryevasionpersistence