Overview

overview

8

Static

static

3

045167745c...18.dll

windows7-x64

8

045167745c...18.dll

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    045167745cbd3e967d1166db909bad23_JaffaCakes118

  • Size

    213KB

  • Sample

    241001-erd21stgkd

  • MD5

    045167745cbd3e967d1166db909bad23

  • SHA1

    9a31a83c689e165da8c1e8f58e3d0dfbaf665b4d

  • SHA256

    c50f8c637eb3b9f442f9bb69a71f4b951ce49b61379001455500074675d2a417

  • SHA512

    7c158d1efecb8b0c7b67066f0ae128bbaa2adc560787224a3e7cb293a9f58a14516e2c551a1aa64ea5bd45e35ec11dfa64660c33c4739a63b70bed4118397c33

  • SSDEEP

    6144:TTzJbd3sQ36hYc42ZCtuJPYny37HO/kClRwv5k50ZR:fzJRcujc4mCIZD37HW3lRW5rR

Score
8/10
bootkitdiscoverypersistence

Malware Config

Targets

    • Target

      045167745cbd3e967d1166db909bad23_JaffaCakes118

    • Size

      213KB

    • MD5

      045167745cbd3e967d1166db909bad23

    • SHA1

      9a31a83c689e165da8c1e8f58e3d0dfbaf665b4d

    • SHA256

      c50f8c637eb3b9f442f9bb69a71f4b951ce49b61379001455500074675d2a417

    • SHA512

      7c158d1efecb8b0c7b67066f0ae128bbaa2adc560787224a3e7cb293a9f58a14516e2c551a1aa64ea5bd45e35ec11dfa64660c33c4739a63b70bed4118397c33

    • SSDEEP

      6144:TTzJbd3sQ36hYc42ZCtuJPYny37HO/kClRwv5k50ZR:fzJRcujc4mCIZD37HW3lRW5rR

    Score
    8/10
    bootkitdiscoverypersistence

    • Blocklisted process makes network request

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks