Overview

overview

10

Static

static

3

115364abbc...18.exe

windows7-x64

10

115364abbc...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    115364abbc910e87f98ca4f3a4cd47e3_JaffaCakes118

  • Size

    407KB

  • Sample

    241004-b66tssxgmk

  • MD5

    115364abbc910e87f98ca4f3a4cd47e3

  • SHA1

    e95aae1d51b904391d33263a683609d01925f457

  • SHA256

    a31a9747fae1a12192403397ab01d71e0a71cb7bdd65b17812bbac3629f283b0

  • SHA512

    89087f84f3ceaa7b0f3bebefbe165f0cc6bb2f16622ed1758e42b7e8606ad7f1885b8a9deae7c6bf417b0bbe8bafcedbc5e84ded94b1913bb4d520feee46b182

  • SSDEEP

    12288:7K+yZqQgpbXK8IY+2CGEAN2Ah0s0/5QSSSlE:7K+ywjbJxZL9h0sY5QBSl

Score
10/10
bootkitdiscoveryevasionpersistence

Malware Config

Targets

    • Target

      115364abbc910e87f98ca4f3a4cd47e3_JaffaCakes118

    • Size

      407KB

    • MD5

      115364abbc910e87f98ca4f3a4cd47e3

    • SHA1

      e95aae1d51b904391d33263a683609d01925f457

    • SHA256

      a31a9747fae1a12192403397ab01d71e0a71cb7bdd65b17812bbac3629f283b0

    • SHA512

      89087f84f3ceaa7b0f3bebefbe165f0cc6bb2f16622ed1758e42b7e8606ad7f1885b8a9deae7c6bf417b0bbe8bafcedbc5e84ded94b1913bb4d520feee46b182

    • SSDEEP

      12288:7K+yZqQgpbXK8IY+2CGEAN2Ah0s0/5QSSSlE:7K+ywjbJxZL9h0sY5QBSl

    Score
    10/10
    bootkitdiscoveryevasionpersistence

    • Modifies firewall policy service

      evasion

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks