Extracted

Extracted

• • Target

    ee853c3a359058ae44734912d6cf6cbe_JaffaCakes118

  • Size

    2.3MB

  • MD5

    ee853c3a359058ae44734912d6cf6cbe

  • SHA1

    1fa3b14ce55ef939a9bbb466e628ee11b33dba7e

  • SHA256

    4517bb5a59310e5412ab90e4e741bec4124990f61897672b75c7e1afe0e959e9

  • SHA512

    1cb670e54674e85f1cde5fd59aa5f4feea5cef2074e88604fa09012c277bc8e16b38209e28d53f2a7e4567f0ccded5ac056f5373d7945857881376b9e17a9ff5

  • SSDEEP

    49152:HIiEK54KS/mF2mEEjlavGhS5KDoy/8yCRgTpQGIdMp3dHJZ1gSRQFl0n:HIiEKT2GphSsDmiOrM1tJngoQbC

  Score

  10^/10

  bootkitdefense_evasiondiscoverypersistenceupx

  • Modifies WinLogon for persistence

    persistence

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Drops file in System32 directory

  behavioral1behavioral2