Extracted

• • Target

    a8852241fc353dd8d654f4eadbf91a77_JaffaCakes118

  • Size

    2.2MB

  • MD5

    a8852241fc353dd8d654f4eadbf91a77

  • SHA1

    32c796695a9bdcb0c286f821e90f1159643384a0

  • SHA256

    8caf43911dd39f7d0c451e7bed961d38b957602c662a0358bdb9df996893494d

  • SHA512

    287cffcbfefcb5371b9600eb2385e1b982ae39749cfbd1fb0b9b1c6825a7a24b92b4992c93cb5d954d65b6e8d745b05678b7bdd8de51a7da57481dc720c47b63

  • SSDEEP

    49152:U2hrLuIu/NAg3nWStJmpeLMlIeKk/ykVkphTPz6PzhPz6Pz6Pz6Pz6Pz6PzWcOUv:pTuFFWStOeLMeeF/ykSr6rhr6r6r6r68

  Score

  10^/10

  defense_evasiondiscoveryevasionexecutionpersistencetrojan

  • Disables service(s)

    evasionexecution

  • UAC bypass

    evasiontrojan

  • Disables taskbar notifications via registry modification

    evasion

  • Event Triggered Execution: Image File Execution Options Injection

    persistence

  • Stops running service(s)

    evasionexecution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • Drops file in System32 directory

  behavioral1behavioral2