Extracted

Extracted

• • Target

    eaa6966575d28fa84ddcf3ba17c4d07e_JaffaCakes118

  • Size

    2.2MB

  • MD5

    eaa6966575d28fa84ddcf3ba17c4d07e

  • SHA1

    f5f44be0cb637bea6348e506ee94136bb41bfa8f

  • SHA256

    16fed893171b69ceb22b85992f486ff2fd45d26de273deced2fb46b2517d755f

  • SHA512

    57769e221cf3127284ded0c043d977168a7d5395abc2d095cbbd7564f0e5bae5574100e1364df2116e29db4244eea87d344041983c2a62328f3a12f24f72060d

  • SSDEEP

    49152:mDwQZshctg3xglTVGI8HoBfAIPYiiqowvq00p7PiKXT0phLdlh:mDwQEuUxglcI8HoiIrwzXopZdL

  Score

  10^/10

  defense_evasiondiscoveryevasionexecutionpersistencetrojan

  • Disables service(s)

    evasionexecution

  • Modifies WinLogon for persistence

    persistence

  • UAC bypass

    evasiontrojan

  • Event Triggered Execution: Image File Execution Options Injection

    persistence

  • Stops running service(s)

    evasionexecution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Checks whether UAC is enabled

    evasiontrojan

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  behavioral1behavioral2