Extracted

Extracted

• • Target

    eb4e2a8e3747a92bfa9eddbd82922e59_JaffaCakes118

  • Size

    2.0MB

  • MD5

    eb4e2a8e3747a92bfa9eddbd82922e59

  • SHA1

    edb4309be523ffcc63d959bd5e9bbf60d4745c32

  • SHA256

    5be56a365a6205f79afd477feefbfc72b780440f1771df21efe634aa39e2e6d2

  • SHA512

    2f452c17fb730dcb95f4b72a665585f5bf227e09f49b05aeff447f47e77c4d59d1f973d19ef990b6fe3a6b7f1910a9beaf3d128e6ffe2e113c142c6309afdaaa

  • SSDEEP

    49152:DMqDXya6MmXveHhW7NmmsvMdAdg5G7Td7uDEpafagvYqiKneu:D9YMhhWIVvMdAio7uwpaigvpeu

  Score

  10^/10

  defense_evasiondiscoveryevasionexecutionpersistencetrojan

  • Disables service(s)

    evasionexecution

  • UAC bypass

    evasiontrojan

  • Disables taskbar notifications via registry modification

    evasion

  • Event Triggered Execution: Image File Execution Options Injection

    persistence

  • Stops running service(s)

    evasionexecution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • Drops file in System32 directory

  behavioral1behavioral2