Overview

overview

7

Static

static

3

da3b5f3b73...18.exe

windows7-x64

6

da3b5f3b73...18.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    da3b5f3b73f0db98589d19d913fe9512_JaffaCakes118

  • Size

    667KB

  • Sample

    240911-netrdaxhlg

  • MD5

    da3b5f3b73f0db98589d19d913fe9512

  • SHA1

    f46fbb39928c0794a293b44628c2c22832ecd798

  • SHA256

    eafe4349d5edda14a53ecda78bbab6ee531a832b3d5412826889047866c3186b

  • SHA512

    a56ae56ec4721887e3ce106dec14a40e6ff3f6c5227222801544c23eeb7c6be6103f0bb3662e319b9633a66cd45dc983b9dcc54293a57b7e445762733b740ef9

  • SSDEEP

    12288:4By7mG7FAZWWAACFiYqohSxdvR+J4xml8IwmMvMFpKI/3UjK44KfO9iBGh:4B54WGFi2hSx12imM0bNmKcO0s

Score
7/10
bootkitdiscoverypersistence

Malware Config

Targets

    • Target

      da3b5f3b73f0db98589d19d913fe9512_JaffaCakes118

    • Size

      667KB

    • MD5

      da3b5f3b73f0db98589d19d913fe9512

    • SHA1

      f46fbb39928c0794a293b44628c2c22832ecd798

    • SHA256

      eafe4349d5edda14a53ecda78bbab6ee531a832b3d5412826889047866c3186b

    • SHA512

      a56ae56ec4721887e3ce106dec14a40e6ff3f6c5227222801544c23eeb7c6be6103f0bb3662e319b9633a66cd45dc983b9dcc54293a57b7e445762733b740ef9

    • SSDEEP

      12288:4By7mG7FAZWWAACFiYqohSxdvR+J4xml8IwmMvMFpKI/3UjK44KfO9iBGh:4B54WGFi2hSx12imM0bNmKcO0s

    Score
    7/10
    bootkitdiscoverypersistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Adds Run key to start application

      persistence

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks