Extracted

Extracted

• • Target

    df466958538c6b28eb2604b27dfb108c_JaffaCakes118

  • Size

    2.5MB

  • MD5

    df466958538c6b28eb2604b27dfb108c

  • SHA1

    8f5f789f48005010debe839a3b94a17774fafd7e

  • SHA256

    959fc5578657c7e2196670dc09c05689986e699418e30f720884a7ac08837a42

  • SHA512

    e18bc88d07e078afb1f9d7376c6871298b553014460e2fae47852a69f3a85a3f3d326211dbc166c7fa48d880db8cdf3889f65c603c65ae4aa8cc994635c4aec1

  • SSDEEP

    49152:wBCD2WkxAPaUlSTX/FplIQjHa4P+36bJdgIh3pShBz+xkLYAXp+a:wBpWXyUqIN4P+qbJKC38+xkLYAXp+a

  Score

  10^/10

  defense_evasiondiscoveryevasionexecutionpersistence

  • Disables service(s)

    evasionexecution

  • Modifies WinLogon for persistence

    persistence

  • Event Triggered Execution: Image File Execution Options Injection

    persistence

  • Stops running service(s)

    evasionexecution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  behavioral1behavioral2