Extracted

Extracted

• • Target

    29b2d42732f059e2462348387cf992ef_JaffaCakes118

  • Size

    2.1MB

  • MD5

    29b2d42732f059e2462348387cf992ef

  • SHA1

    b82ee7f6e44facb0640b0732a5857cf6bc3278a1

  • SHA256

    16f0a2cfcb031796e99cd46bdbe28a4a621586c843bd1e3106d543ce1afb8fc3

  • SHA512

    bf0e09f8226c5366545eb71bd98eead2f6be659a15f3ac41d310e6e351f40eee8ba1295baa9ce038c1a5ed576b2515b13d74165523e4678f074fd6728bf7db35

  • SSDEEP

    49152:AtKOxwdTJxPJV6yFXSbhowRsDqUPN6r/1gQo1LnvS7:AFwlJx6MXSbhpOLPO1gHJS7

  Score

  10^/10

  evasionexecutionpersistencetrojan

  • Disables service(s)

    evasionexecution

  • UAC bypass

    evasiontrojan

  • Disables taskbar notifications via registry modification

    evasion

  • Event Triggered Execution: Image File Execution Options Injection

    persistence

  • Stops running service(s)

    evasionexecution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Drops file in System32 directory

  behavioral1behavioral2