0f88ebf67f670464afbda03d999a221a90d6d1bed4cc8ef10a1d8666be1f64cd | Triage

Sharing

General

Target

f9f67a12723dae32541d7543068bba5b_JaffaCakes118
Size

848KB
Sample

240927-h1k4gatfjf
MD5

f9f67a12723dae32541d7543068bba5b
SHA1

239f24b2a920ed66eb186bd7a715ca944d0449b6
SHA256

0f88ebf67f670464afbda03d999a221a90d6d1bed4cc8ef10a1d8666be1f64cd
SHA512

e80757f7edcba3bd9303f917565c975c1b6af922bf9089b0ec696e033efc1b5e891efdfbcadb8d4b4202d8cf96acde71cca381a4f9a3f6eade1c60b7e7d6ea86
SSDEEP

24576:mscFZYh0AG7NR4YItvXFZ0ktNtxTo/j+4lZdh4P:mpEKAyIpXFjNTTo/j+OJ4P

Score

7^/10

bootkit discovery persistence

Malware Config

Targets

- Target
  
  f9f67a12723dae32541d7543068bba5b_JaffaCakes118
- Size
  
  848KB
- MD5
  
  f9f67a12723dae32541d7543068bba5b
- SHA1
  
  239f24b2a920ed66eb186bd7a715ca944d0449b6
- SHA256
  
  0f88ebf67f670464afbda03d999a221a90d6d1bed4cc8ef10a1d8666be1f64cd
- SHA512
  
  e80757f7edcba3bd9303f917565c975c1b6af922bf9089b0ec696e033efc1b5e891efdfbcadb8d4b4202d8cf96acde71cca381a4f9a3f6eade1c60b7e7d6ea86
- SSDEEP
  
  24576:mscFZYh0AG7NR4YItvXFZ0ktNtxTo/j+4lZdh4P:mpEKAyIpXFjNTTo/j+OJ4P
Score

7^/10

bootkit discovery persistence
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

Bootkit

Privilege Escalation

Defense Evasion

Modify Registry

Pre-OS Boot

Bootkit

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

bootkitdiscoverypersistence

behavioral2

bootkitdiscoverypersistence