Extracted

• • Target

    3cc8d9f3123b467e96e20389446f6df6_JaffaCakes118

  • Size

    1.8MB

  • MD5

    3cc8d9f3123b467e96e20389446f6df6

  • SHA1

    ca8f465a80b7a144685d6aec4bb1e463ef4560ba

  • SHA256

    42d4d05163f7215ec7f08dd805458eeb995657f00388550d73597ee79fedc7b9

  • SHA512

    2837a1ab4da588186ebceb49b5a55c654edfb3e39398b3c4ed42ace9c3e5fce91a409aa9a1921e92cd88ef824b92b252eaaef78e02ca65c47d10c49e3e6f3c8f

  • SSDEEP

    49152:Dgq1kMLzrf0SgEm8kG99Yry2cwIDa7CA6xm7I:DPBj0SJVHYryeE8Zs

  Score

  10^/10

  upxevasionexecutionpersistencetrojan

  • Disables service(s)

    evasionexecution

  • UAC bypass

    evasiontrojan

  • Disables taskbar notifications via registry modification

    evasion

  • Event Triggered Execution: Image File Execution Options Injection

    persistence

  • Stops running service(s)

    evasionexecution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Drops file in System32 directory

  behavioral1behavioral2