Extracted

Extracted

• • Target

    d999b09fd0ad1ef963ed1af0246a8110_JaffaCakes118

  • Size

    2.3MB

  • MD5

    d999b09fd0ad1ef963ed1af0246a8110

  • SHA1

    e34036f5fc0b7b3e41e3ec054ca0e8ff31d93d35

  • SHA256

    b9ed117523b02cc9130d82ddb9e151f37474a8049e5938a4af15ab1713548821

  • SHA512

    9106683ff7bf304980ecc09d23789dd3879d0d42a55027d87f5f13e577d23082ffef2dd73defd8e39964f195359214015cbac7f036cc7aa351fac260aab00e09

  • SSDEEP

    49152:kWlGYm7UMfEL8295VM9hmljWXZU+7Z3JZX+++NpbE:kPB7xfEL8s5mOaVZ3z+++NpbE

  Score

  10^/10

  defense_evasiondiscoveryevasionexecutionpersistence

  • Disables service(s)

    evasionexecution

  • Modifies WinLogon for persistence

    persistence

  • Blocklisted process makes network request

  • Event Triggered Execution: Image File Execution Options Injection

    persistence

  • Stops running service(s)

    evasionexecution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  behavioral1behavioral2