Extracted

Extracted

• • Target

    8a147aabf983ae0b5d80ca7c920016b6_JaffaCakes118

  • Size

    2.2MB

  • MD5

    8a147aabf983ae0b5d80ca7c920016b6

  • SHA1

    ec879d5bfa801d30692d119c1761bd99ea509b44

  • SHA256

    8651377079118fbcd225e4fa0388e84fcf9ae11913a0781c0ed05ffe990b28c6

  • SHA512

    6937bc2933673f5f2d9691ae040407c52341f5a8c31ced8cae74c0acba3466beb086b0b10357db332bd680a201e426a4af430b01eeab34d1ceabe2b99f9a27db

  • SSDEEP

    49152:8vBn0W4Q5wQktUfHAiB6WX5ljHLRodQ017X0qi0aXlAFpD/+Z:qN0meQn6WX5jEQ01/jpDWZ

  Score

  10^/10

  defense_evasiondiscoveryevasionexecutionpersistence

  • Disables service(s)

    evasionexecution

  • Modifies WinLogon for persistence

    persistence

  • Event Triggered Execution: Image File Execution Options Injection

    persistence

  • Stops running service(s)

    evasionexecution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  behavioral1behavioral2