Extracted

• • Target

    0a8ed0857614e31fc3f1591613098774_JaffaCakes118

  • Size

    2.0MB

  • MD5

    0a8ed0857614e31fc3f1591613098774

  • SHA1

    bda66f3ab255fac2243eaec10d11a65b8bb1ef23

  • SHA256

    745331f5d9ab3bf71f3b664646f47ebefd393e9ded6c429234dde7ccf0c89484

  • SHA512

    b68cb1728faa22ecff305912f531fa4acde72627092296c3ff04b794d4b4b82e5e3887df60ea5f637560733511f2e8372114a961f7e224e7c638fd604d8cb75d

  • SSDEEP

    49152:DyqYSSqIgP6GuJfipmF0hIdppCIsq6nemQ4YvAjJ1iFh3:DEqDiZfM+dpvsumUvAjriFh3

  Score

  10^/10

  evasionexecutionpersistencetrojan

  • Disables service(s)

    evasionexecution

  • UAC bypass

    evasiontrojan

  • Disables taskbar notifications via registry modification

    evasion

  • Event Triggered Execution: Image File Execution Options Injection

    persistence

  • Stops running service(s)

    evasionexecution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Drops file in System32 directory

  behavioral1behavioral2