Extracted

Extracted

• • Target

    eeff0def88f30543c4b7f93976df37b4_JaffaCakes118

  • Size

    2.3MB

  • MD5

    eeff0def88f30543c4b7f93976df37b4

  • SHA1

    299b1944a074d04e1f3f23a05918eb2fd4542c4a

  • SHA256

    1f59da5f8c3ed10ee6e27ca87592e3e81ab3cab6b7337ae40fae6a1e5887b243

  • SHA512

    0335863a8d5c3cb968f67429fbc375943717c20393230da083a335f3d2540d8ec9434513f45113d504b7f389c982268628f91129c2db279b4e8ae1fd3ac43fa8

  • SSDEEP

    49152:ukG9SpUleRvzfsEdDRUczjRO4Ye47YfW5I5GWMo/4abNpH1cZZ6k:uPSq6vzfJDRUczjfBGeF/4abNpVKZ6k

  Score

  10^/10

  defense_evasiondiscoveryevasionexecutionpersistence

  • Disables service(s)

    evasionexecution

  • Modifies WinLogon for persistence

    persistence

  • Blocklisted process makes network request

  • Event Triggered Execution: Image File Execution Options Injection

    persistence

  • Stops running service(s)

    evasionexecution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  behavioral1behavioral2