7fdaabb625a6180627b307a4f8d533c2eeceef480157c7067849cf20b09fddea | Triage

Sharing

General

Target

becbe4f5100b858411dcb51e5719529d_JaffaCakes118
Size

2.0MB
Sample

240824-rwlzmsvbpf
MD5

becbe4f5100b858411dcb51e5719529d
SHA1

553c284d440a34fda1cc3772c98639267002c7a4
SHA256

7fdaabb625a6180627b307a4f8d533c2eeceef480157c7067849cf20b09fddea
SHA512

93c6d25789b7c9d26e5a191569d88cefe5c02f868a6088c2d1ec6d8ddd0643372ab25affaecfa6dc5406addf228d858d92fccbf5f487d2e03d312284423fe679
SSDEEP

49152:LV9yIArXjY4LjAs/p98gieBhDiY6Vt9TRAia2H1:n2jDLn/p8CwXVSia2V

Score

7^/10

bootkit discovery persistence

Malware Config

Targets

- Target
  
  becbe4f5100b858411dcb51e5719529d_JaffaCakes118
- Size
  
  2.0MB
- MD5
  
  becbe4f5100b858411dcb51e5719529d
- SHA1
  
  553c284d440a34fda1cc3772c98639267002c7a4
- SHA256
  
  7fdaabb625a6180627b307a4f8d533c2eeceef480157c7067849cf20b09fddea
- SHA512
  
  93c6d25789b7c9d26e5a191569d88cefe5c02f868a6088c2d1ec6d8ddd0643372ab25affaecfa6dc5406addf228d858d92fccbf5f487d2e03d312284423fe679
- SSDEEP
  
  49152:LV9yIArXjY4LjAs/p98gieBhDiY6Vt9TRAia2H1:n2jDLn/p8CwXVSia2V
Score

7^/10

bootkit discovery persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

Bootkit

Privilege Escalation

Defense Evasion

Pre-OS Boot

Bootkit

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

bootkitdiscoverypersistence

behavioral2