Overview

overview

10

Static

static

1

FormN899766.lnk

windows7-x64

10

FormN899766.lnk

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    a2b180b503deab62ce03587763b56fa0_JaffaCakes118
  • Size 906B
  • Sample240612-2dcy5ashmf
  • SHA256 e35870eeb89543b4fffa09a9f246714a6d18ba3c3d9ca916d585ea7e19ee86bb
  • MD5 SHA1 SHA512
Score
10/10
execution

Malware Config

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    http://fructus.com.my/admin/images/form.exe

Targets

    • Target
      FormN899766.lnk
    • Size 1KB
    • SHA256 cb769b39fb095af683c57d9eb16fd3c524906b3ff94d865e9c68ff6156f5646d
    • MD5 SHA1 SHA512
    Score
    10/10
    execution

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

      execution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks