c2d307ca069370489f033ce5d8859290462e66f6b6ecbd6fb5a1b6aa266adc3a | Triage

Sharing

General

Target

56bbde7cf490ccabf4c5ee11e021ba40_JaffaCakes118
Size

420KB
Sample

241018-lpxjxazdlg
MD5

56bbde7cf490ccabf4c5ee11e021ba40
SHA1

4e1dab7e6507ec8336bc86f42fd5f4d1c63c4def
SHA256

c2d307ca069370489f033ce5d8859290462e66f6b6ecbd6fb5a1b6aa266adc3a
SHA512

f8dd905b19a55bcabddb9849616cc16a96fab5d120d52eb85bc48e1933137bbeb90af51bca261a46dbed68aee7d5d27507efcf6484eb56dd58224e015a5c5ca6
SSDEEP

6144:SEx6AROKJHi8zKRKfdlO4C4jF9GZJMtGOkq84BVM:SVARxJHi0KRKm4jFAZ9hq84BVM

Score

10^/10

bootkit discovery evasion persistence

Malware Config

Targets

- Target
  
  56bbde7cf490ccabf4c5ee11e021ba40_JaffaCakes118
- Size
  
  420KB
- MD5
  
  56bbde7cf490ccabf4c5ee11e021ba40
- SHA1
  
  4e1dab7e6507ec8336bc86f42fd5f4d1c63c4def
- SHA256
  
  c2d307ca069370489f033ce5d8859290462e66f6b6ecbd6fb5a1b6aa266adc3a
- SHA512
  
  f8dd905b19a55bcabddb9849616cc16a96fab5d120d52eb85bc48e1933137bbeb90af51bca261a46dbed68aee7d5d27507efcf6484eb56dd58224e015a5c5ca6
- SSDEEP
  
  6144:SEx6AROKJHi8zKRKfdlO4C4jF9GZJMtGOkq84BVM:SVARxJHi0KRKm4jFAZ9hq84BVM
Score

10^/10

bootkit discovery evasion persistence
- Modifies firewall policy service
  evasion
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Pre-OS Boot

Bootkit

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Pre-OS Boot

Bootkit

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

bootkitdiscoveryevasionpersistence

behavioral2

bootkitdiscoveryevasionpersistence