Extracted

Extracted

• • Target

    9334dbb61d19ac21c8f10bcda409a0d0_JaffaCakes118

  • Size

    2.0MB

  • MD5

    9334dbb61d19ac21c8f10bcda409a0d0

  • SHA1

    0a6bab38061f1681bdc259690699ffc284970648

  • SHA256

    0a662bd665b49469f488d81912ae84a7a2506e32a89390134cb0f934b4b57361

  • SHA512

    140da6648af9606443db039a0e976fbe327495c665c64c6c35f617c8fcaf7d34e9becc1c3dcbdb5b377811d66959b5c407b749b136597529f406aebc712e2422

  • SSDEEP

    49152:DgqdwTzUCSaogJDhTp7iK7VwgwV64rnB/FFc2ORZRO5b2BHzv:DPwTzX7JDhtFCgcrn5A2gRqb2Nzv

  Score

  10^/10

  defense_evasiondiscoveryevasionexecutionpersistencetrojan

  • Disables service(s)

    evasionexecution

  • UAC bypass

    evasiontrojan

  • Disables taskbar notifications via registry modification

    evasion

  • Event Triggered Execution: Image File Execution Options Injection

    persistence

  • Stops running service(s)

    evasionexecution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • Drops file in System32 directory

  behavioral1behavioral2