831e1f9682a8c966087440470c7b10a0450f1865388ea5b3fe41910d5cd68fbe | Triage

Sharing

General

Target

dd8a762e0042e34136eb1412dad0bc77_JaffaCakes118
Size

296KB
Sample

240913-dkhwys1erg
MD5

dd8a762e0042e34136eb1412dad0bc77
SHA1

43e638244d0e195c88738e154412745baee5dd85
SHA256

831e1f9682a8c966087440470c7b10a0450f1865388ea5b3fe41910d5cd68fbe
SHA512

8fca41ac2aeef41fa077c79b511836b8dc745b3131697aff14c85fdd5ec85e37b3bbbc3e412f68aa3780202993a97f51e3e0818e0dcd53a2d4d6a0c7c0009de4
SSDEEP

6144:hEzOvTkrYI6nXo8RIuXhLNfyNiwmi0LrEHiZ27x+wJ2W8:sqGY9Xo8R7hLbi0LoCZy+gZ8

Score

7^/10

bootkit discovery persistence

Malware Config

Targets

- Target
  
  dd8a762e0042e34136eb1412dad0bc77_JaffaCakes118
- Size
  
  296KB
- MD5
  
  dd8a762e0042e34136eb1412dad0bc77
- SHA1
  
  43e638244d0e195c88738e154412745baee5dd85
- SHA256
  
  831e1f9682a8c966087440470c7b10a0450f1865388ea5b3fe41910d5cd68fbe
- SHA512
  
  8fca41ac2aeef41fa077c79b511836b8dc745b3131697aff14c85fdd5ec85e37b3bbbc3e412f68aa3780202993a97f51e3e0818e0dcd53a2d4d6a0c7c0009de4
- SSDEEP
  
  6144:hEzOvTkrYI6nXo8RIuXhLNfyNiwmi0LrEHiZ27x+wJ2W8:sqGY9Xo8R7hLbi0LoCZy+gZ8
Score

7^/10

bootkit discovery persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

Bootkit

Privilege Escalation

Defense Evasion

Pre-OS Boot

Bootkit

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

bootkitdiscoverypersistence

behavioral2