Overview

overview

8

Static

static

3

f8142c80cd...18.exe

windows7-x64

8

f8142c80cd...18.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f8142c80cd44335e6ca137f8441307d0_JaffaCakes118

  • Size

    71KB

  • Sample

    240418-qk212sfc9s

  • MD5

    f8142c80cd44335e6ca137f8441307d0

  • SHA1

    e9a8043d34fbfabefefd2afa41e3d1b8cfbd2163

  • SHA256

    593656e8b4b62735aae353a2d5d10913cb3901b10c1bcb2d069f9ad76085a116

  • SHA512

    3a178a2100495dce8c38e9994ef447aa786d89c16f41c41ab950823f00c7d4bf8b3426cdfdcc83402b8e385b66546b986b193d1b7295f5865fd40bb66f1a5976

  • SSDEEP

    1536:VGniOp5k6QUeDMIj9sFjFFImqsioDuz8PQuR0uOWtkjPzrDZj9Mfl:VGntOURIj9sd5ruz8oubOWtifDsd

Score
8/10
evasionpersistence

Malware Config

Targets

    • Target

      f8142c80cd44335e6ca137f8441307d0_JaffaCakes118

    • Size

      71KB

    • MD5

      f8142c80cd44335e6ca137f8441307d0

    • SHA1

      e9a8043d34fbfabefefd2afa41e3d1b8cfbd2163

    • SHA256

      593656e8b4b62735aae353a2d5d10913cb3901b10c1bcb2d069f9ad76085a116

    • SHA512

      3a178a2100495dce8c38e9994ef447aa786d89c16f41c41ab950823f00c7d4bf8b3426cdfdcc83402b8e385b66546b986b193d1b7295f5865fd40bb66f1a5976

    • SSDEEP

      1536:VGniOp5k6QUeDMIj9sFjFFImqsioDuz8PQuR0uOWtkjPzrDZj9Mfl:VGntOURIj9sd5ruz8oubOWtifDsd

    Score
    8/10
    evasionpersistence

    • Adds policy Run key to start application

      persistence

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks