6c2c8950ae7513ea3bf91342b5ded8d9aed5a292c4bb6f8ffb35dfebc9b78cb7 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

06d899e2525f0264dd640e7acd192bea_JaffaCakes118
Size

145KB
Sample

241001-wqck8sxaqb
MD5

06d899e2525f0264dd640e7acd192bea
SHA1

4f8c2ebf19a1291a67380e202c7849266d3f2a5a
SHA256

6c2c8950ae7513ea3bf91342b5ded8d9aed5a292c4bb6f8ffb35dfebc9b78cb7
SHA512

8763c578370f1cad124e9a49cb6d107cc24963bfca258192d83a32a57948acb07f23281267b21d27e5c45f34aa4dacb4f2bcbe6621496fc3606d46f0911c51fb
SSDEEP

3072:l4BkxNa5Cl2V+M2Oa+vLM3ynTERkQzC93EvJ9HACb7d6d:2yvaVu+68TERhu+RxLPd6d

Score

7^/10

bootkit discovery persistence

Malware Config

Targets

- Target
  
  06d899e2525f0264dd640e7acd192bea_JaffaCakes118
- Size
  
  145KB
- MD5
  
  06d899e2525f0264dd640e7acd192bea
- SHA1
  
  4f8c2ebf19a1291a67380e202c7849266d3f2a5a
- SHA256
  
  6c2c8950ae7513ea3bf91342b5ded8d9aed5a292c4bb6f8ffb35dfebc9b78cb7
- SHA512
  
  8763c578370f1cad124e9a49cb6d107cc24963bfca258192d83a32a57948acb07f23281267b21d27e5c45f34aa4dacb4f2bcbe6621496fc3606d46f0911c51fb
- SSDEEP
  
  3072:l4BkxNa5Cl2V+M2Oa+vLM3ynTERkQzC93EvJ9HACb7d6d:2yvaVu+68TERhu+RxLPd6d
Score

7^/10

bootkit discovery persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

Bootkit

Privilege Escalation

Defense Evasion

Pre-OS Boot

Bootkit

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

bootkitdiscoverypersistence

behavioral2