Extracted

• • Target

    d308d96b1772ecdc63ebb81b1069e7c9_JaffaCakes118

  • Size

    2.3MB

  • MD5

    d308d96b1772ecdc63ebb81b1069e7c9

  • SHA1

    7df9e6dd127c3e5ada3bc63f1df8f6a6517eb10d

  • SHA256

    59959c0b5519999aa75d7e51b27d786ea8365e80cbafc44baeb0e252c7eedab3

  • SHA512

    551c30d7bf41b51985d34e416fdbaa4d70396d0f0a071286518fe64de7cbbbfc53f7fd8bfbe22ee42a2f618c1b889d2464486ee448572bb1a1506af546629f96

  • SSDEEP

    49152:4ko5ZasrwscqzHD3lSOKzIvjJcQ7ZnQ5DGzbQTK1e:4p5ws7tYOKzwL7Z+evU

  Score

  10^/10

  defense_evasiondiscoveryevasionexecutionpersistencetrojanupx

  • Disables service(s)

    evasionexecution

  • UAC bypass

    evasiontrojan

  • Disables taskbar notifications via registry modification

    evasion

  • Event Triggered Execution: Image File Execution Options Injection

    persistence

  • Stops running service(s)

    evasionexecution

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • Drops file in System32 directory

  behavioral1behavioral2