1c67f5138d63713588636494107fc16b555b1822c5e3fc8da0604ce129176bb5 | Triage

Sharing

General

Target

db7e99f259af09575a22fc5e73ac702d_JaffaCakes118
Size

261KB
Sample

240912-asww1a1gkm
MD5

db7e99f259af09575a22fc5e73ac702d
SHA1

f0b34b66005b0f546c2be09076ffe70fb310c6fe
SHA256

1c67f5138d63713588636494107fc16b555b1822c5e3fc8da0604ce129176bb5
SHA512

d46f7d52eee2f1157d4a98f5ef8623c387fd17c7356699a34f7a9884ef103e1f28adb311b25b6ad4c0db736afa15a0979fd493765911b2e6c82d841197b8d0da
SSDEEP

6144:zJQaKEpCZhDoawvP6bQ7yMP+DE827i0uryf9u:uhECpg6b7MP+Dd2Pzfc

Score

7^/10

bootkit discovery persistence

Malware Config

Targets

- Target
  
  db7e99f259af09575a22fc5e73ac702d_JaffaCakes118
- Size
  
  261KB
- MD5
  
  db7e99f259af09575a22fc5e73ac702d
- SHA1
  
  f0b34b66005b0f546c2be09076ffe70fb310c6fe
- SHA256
  
  1c67f5138d63713588636494107fc16b555b1822c5e3fc8da0604ce129176bb5
- SHA512
  
  d46f7d52eee2f1157d4a98f5ef8623c387fd17c7356699a34f7a9884ef103e1f28adb311b25b6ad4c0db736afa15a0979fd493765911b2e6c82d841197b8d0da
- SSDEEP
  
  6144:zJQaKEpCZhDoawvP6bQ7yMP+DE827i0uryf9u:uhECpg6b7MP+Dd2Pzfc
Score

7^/10

bootkit discovery persistence
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

Bootkit

Privilege Escalation

Defense Evasion

Pre-OS Boot

Bootkit

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

bootkitdiscoverypersistence

behavioral2