Overview

overview

8

Static

static

3

4abfb20a73...18.exe

windows7-x64

8

4abfb20a73...18.exe

windows10-2004-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target
    4abfb20a73e1d996a939448a3cb7452b_JaffaCakes118
  • Size 178KB
  • Sample241016-bdke4avbrb
  • SHA256 4b0dff2b9e815c7a4ffacfaac103564af2e8b38235823b08344c56033b6d4dff
  • MD5 SHA1 SHA512 SSDEEP
Score
8/10
bootkitdiscoverypersistence

Malware Config

Targets

    • Target
      4abfb20a73e1d996a939448a3cb7452b_JaffaCakes118
    • Size 178KB
    • SHA256 4b0dff2b9e815c7a4ffacfaac103564af2e8b38235823b08344c56033b6d4dff
    • MD5 SHA1 SHA512 SSDEEP
    Score
    8/10
    bootkitdiscoverypersistence

    • Drops file in Drivers directory

    • Server Software Component: Terminal Services DLL

      persistence

    • Deletes itself

    • Loads dropped DLL

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks