General
-
Target
7f24a5ebb7bbbc9b2acf31bff3c83eea_JaffaCakes118
-
Size
6.8MB
-
Sample
241030-n9t1matrgq
-
MD5
7f24a5ebb7bbbc9b2acf31bff3c83eea
-
SHA1
516f93e6d5952212c6330c0404d8de9e99f7e06e
-
SHA256
6f57e1f0dfe12f224549518a9ac36512f334dfcd43944c8f2da600db15c92cce
-
SHA512
b16c23bf086c889cbd8a439b7835f2de6d56ec78ee5ac52e7b8e44684d98bb813f37e0a58653d8ed25a094bbe5c8062a4151fc86a5f1152bbc5dddd93cb5c5e6
-
SSDEEP
49152:67N1ahC70V7N1ahCF0V7N1ahCQ0V7N1ahCH0V7N1ahCP7N1ahCY0V7N1ahC20V7l:67u747d7K7P7l7D7k7j78
Malware Config
Targets
-
-
Target
7f24a5ebb7bbbc9b2acf31bff3c83eea_JaffaCakes118
-
Size
6.8MB
-
MD5
7f24a5ebb7bbbc9b2acf31bff3c83eea
-
SHA1
516f93e6d5952212c6330c0404d8de9e99f7e06e
-
SHA256
6f57e1f0dfe12f224549518a9ac36512f334dfcd43944c8f2da600db15c92cce
-
SHA512
b16c23bf086c889cbd8a439b7835f2de6d56ec78ee5ac52e7b8e44684d98bb813f37e0a58653d8ed25a094bbe5c8062a4151fc86a5f1152bbc5dddd93cb5c5e6
-
SSDEEP
49152:67N1ahC70V7N1ahCF0V7N1ahCQ0V7N1ahCH0V7N1ahCP7N1ahCY0V7N1ahC20V7l:67u747d7K7P7l7D7k7j78
Score10/10-
FakeAV, RogueAntivirus
FakeAV or Rogue AntiVirus is a class of malware that displays false alert messages.
-
Fakeav family
-
FakeAV payload
-
Event Triggered Execution: Image File Execution Options Injection
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Drops file in System32 directory
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Image File Execution Options Injection
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Image File Execution Options Injection
1