Extracted

Extracted

• • Target

    b2bd46e4156648e001ed731a637f30ce_JaffaCakes118

  • Size

    2.6MB

  • MD5

    b2bd46e4156648e001ed731a637f30ce

  • SHA1

    fbf107993c2ba05c020752ff5139ce3f07bdbbef

  • SHA256

    e8079ed79b19b4dee2b023bf633be8d93e624cba8ca8963c05a62cfcc8b3b008

  • SHA512

    0c72a98a3a2c903020528e7790ef1559a4cfdd42ae5c4888b9e5cbe725a4b40625b2447eff4a47544450057c9ee3d30fcdb61661be81e899145b066c109ed2d6

  • SSDEEP

    49152:Lidw4KIvVbsaJukZoxA1pzCW9cPBBcuXwUdt515LspMKjnAV7:edwAVbnIkuxA1pzV9eBN5LspMbV7

  Score

  10^/10

  defense_evasiondiscoveryevasionexecutionpersistence

  • Disables service(s)

    evasionexecution

  • Modifies WinLogon for persistence

    persistence

  • Event Triggered Execution: Image File Execution Options Injection

    persistence

  • Stops running service(s)

    evasionexecution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  behavioral1behavioral2