Overview

overview

7

Static

static

3

b19ad74ff6...18.exe

windows7-x64

7

b19ad74ff6...18.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b19ad74ff67b85a0b2753668bf347ac1_JaffaCakes118

  • Size

    677KB

  • Sample

    241129-qzrtmasqgn

  • MD5

    b19ad74ff67b85a0b2753668bf347ac1

  • SHA1

    24fe0cd941a5be170ea148286f343bdd6dab6f2f

  • SHA256

    ed46efad86d3c844c98cb1d91592583f19a40481476a8de734ea8fac33932091

  • SHA512

    55b021f8f127ff45d91b03d326b1d6eb0161a7b1ea4bc8d62db7b0361a087d41547ad967b13fed9f7eb12c1ae496ca30f7abd2e215b8779a6545125cecf6d266

  • SSDEEP

    6144:921ndC6wLUZDGesMQ9hNrhniop8E7CzFRDsIM7fP2EPH5/h/4jv/80b7V/:92FqLfepQvN/3/IMb2EPH5ZQL/b7V/

Score
7/10
bootkitdiscoverypersistence

Malware Config

Targets

    • Target

      b19ad74ff67b85a0b2753668bf347ac1_JaffaCakes118

    • Size

      677KB

    • MD5

      b19ad74ff67b85a0b2753668bf347ac1

    • SHA1

      24fe0cd941a5be170ea148286f343bdd6dab6f2f

    • SHA256

      ed46efad86d3c844c98cb1d91592583f19a40481476a8de734ea8fac33932091

    • SHA512

      55b021f8f127ff45d91b03d326b1d6eb0161a7b1ea4bc8d62db7b0361a087d41547ad967b13fed9f7eb12c1ae496ca30f7abd2e215b8779a6545125cecf6d266

    • SSDEEP

      6144:921ndC6wLUZDGesMQ9hNrhniop8E7CzFRDsIM7fP2EPH5/h/4jv/80b7V/:92FqLfepQvN/3/IMb2EPH5ZQL/b7V/

    Score
    7/10
    bootkitdiscoverypersistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks