Overview

overview

7

Static

static

3

df17a4f4dc...18.exe

windows7-x64

7

df17a4f4dc...18.exe

windows10-2004-x64

7

Sharing

Copy URL Twitter E-mail

General

  • Target

    df17a4f4dcf052ffa5eaeed0c0fc7953_JaffaCakes118

  • Size

    208KB

  • Sample

    240913-3g7tcavelq

  • MD5

    df17a4f4dcf052ffa5eaeed0c0fc7953

  • SHA1

    5e8ee98d568490dbc1e0ada71c9e506b9c7cd829

  • SHA256

    2bd314af81ffdcd875ba791d1eeb57b4c62d32dcf58ba833af121f50642a4ead

  • SHA512

    b420c03b47905cb56f074538a2470c27862a46a6e184d8851594f143595dcce7490d1c870f8676bb1047302fc92ab8165544cf14e6e25063146bc1db0e5b8366

  • SSDEEP

    6144:PWmwmDlC0uKZ413rRKl8kEcxFEjmtg3e:plEc4R3

Score
7/10
bootkitdiscoverypersistence

Malware Config

Targets

    • Target

      df17a4f4dcf052ffa5eaeed0c0fc7953_JaffaCakes118

    • Size

      208KB

    • MD5

      df17a4f4dcf052ffa5eaeed0c0fc7953

    • SHA1

      5e8ee98d568490dbc1e0ada71c9e506b9c7cd829

    • SHA256

      2bd314af81ffdcd875ba791d1eeb57b4c62d32dcf58ba833af121f50642a4ead

    • SHA512

      b420c03b47905cb56f074538a2470c27862a46a6e184d8851594f143595dcce7490d1c870f8676bb1047302fc92ab8165544cf14e6e25063146bc1db0e5b8366

    • SSDEEP

      6144:PWmwmDlC0uKZ413rRKl8kEcxFEjmtg3e:plEc4R3

    Score
    7/10
    bootkitdiscoverypersistence

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks