Extracted

• • Target

    8803b11dfdd25468983d1d2f9ff97f14_JaffaCakes118

  • Size

    2.0MB

  • MD5

    8803b11dfdd25468983d1d2f9ff97f14

  • SHA1

    ddbfe075d202f0eb40643fc989258f06e0a4ee0f

  • SHA256

    525d10cdb850eec48d493440924e00fea92722bfb3f8ccb34e2c3bac768d76ab

  • SHA512

    017ead1ddc34515c9fe67a7ac4aa8da142f12c2453c8af0aa52604b893bc8379d77acba7457bd42159707d06a01b8b297b08ffac325eddef2e8ff88b246c4382

  • SSDEEP

    49152:DyqU/32OZXgeL+9yX9MyJiCkFhSp1BRjbzQh7LHQjr//Wk:DkRX+cXF/jXBNbG7Lwd

  Score

  10^/10

  defense_evasiondiscoveryevasionexecutionpersistencetrojan

  • Disables service(s)

    evasionexecution

  • UAC bypass

    evasiontrojan

  • Disables taskbar notifications via registry modification

    evasion

  • Event Triggered Execution: Image File Execution Options Injection

    persistence

  • Stops running service(s)

    evasionexecution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • Drops file in System32 directory

  behavioral1behavioral2