cf32bc91a6949f852bcbab04daa60ff5c6d326f30099d15b1e9b66aeb8b54474 | Triage

Sharing

General

Target

JaffaCakes118_c8cb654fa54975e8205478aef6cfbf8b
Size

120KB
Sample

250208-3vk7hayjhv
MD5

c8cb654fa54975e8205478aef6cfbf8b
SHA1

3bd37b8de72f2b5b195fd6448d4af2a6282584ff
SHA256

cf32bc91a6949f852bcbab04daa60ff5c6d326f30099d15b1e9b66aeb8b54474
SHA512

51a930abb2f741af3fb8b8f24ec6385ea4e97c478eba406ea8f9e8693812b7a65f6b101b2cc4802ab0813b953d9850935131fd4ab948455a704d959ec171fb09
SSDEEP

3072:n1JxfXpkJlhNQOqtYMo818lzAibjFY5HYD1oEueWv6mJYJprp4UP:n1JVshXfMPmlzAibjFWDEugmqJdF

Score

8^/10

bootkit discovery persistence

Malware Config

Targets

- Target
  
  JaffaCakes118_c8cb654fa54975e8205478aef6cfbf8b
- Size
  
  120KB
- MD5
  
  c8cb654fa54975e8205478aef6cfbf8b
- SHA1
  
  3bd37b8de72f2b5b195fd6448d4af2a6282584ff
- SHA256
  
  cf32bc91a6949f852bcbab04daa60ff5c6d326f30099d15b1e9b66aeb8b54474
- SHA512
  
  51a930abb2f741af3fb8b8f24ec6385ea4e97c478eba406ea8f9e8693812b7a65f6b101b2cc4802ab0813b953d9850935131fd4ab948455a704d959ec171fb09
- SSDEEP
  
  3072:n1JxfXpkJlhNQOqtYMo818lzAibjFY5HYD1oEueWv6mJYJprp4UP:n1JVshXfMPmlzAibjFWDEugmqJdF
Score

8^/10

bootkit discovery persistence
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Pre-OS Boot

Bootkit

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Pre-OS Boot

Bootkit

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

System Network Configuration Discovery

Internet Connection Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

bootkitdiscoverypersistence

behavioral2

discoverypersistence