Overview

overview

10

Static

static

10

d3aec9fd71...18.exe

windows7-x64

10

d3aec9fd71...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d3aec9fd714d5aab5ead80728e627fa6_JaffaCakes118

  • Size

    10.7MB

  • Sample

    241207-z9wp1azmam

  • MD5

    d3aec9fd714d5aab5ead80728e627fa6

  • SHA1

    b97a68f7adcb78711b13f8e6a5675841abad673e

  • SHA256

    6c611171c45af25fc9e6547991268fa8f419f687f045a8af8732d29d9c675022

  • SHA512

    995dbfdd3e627158fc232b09569462b239b10403c487aef599920c1bf0c3fdac9828eddf28ccd7f8dc1ff349789042dcc52f5fe37e68d802dd302a4fd8b15e75

  • SSDEEP

    98304:67k7h7K7f7e7c7R767Z7Y7A7j7v7c737K:QKNAzkidQlemXjirK

Score
10/10
fakeavdiscoveryfakeavpersistencespyware

Malware Config

Targets

    • Target

      d3aec9fd714d5aab5ead80728e627fa6_JaffaCakes118

    • Size

      10.7MB

    • MD5

      d3aec9fd714d5aab5ead80728e627fa6

    • SHA1

      b97a68f7adcb78711b13f8e6a5675841abad673e

    • SHA256

      6c611171c45af25fc9e6547991268fa8f419f687f045a8af8732d29d9c675022

    • SHA512

      995dbfdd3e627158fc232b09569462b239b10403c487aef599920c1bf0c3fdac9828eddf28ccd7f8dc1ff349789042dcc52f5fe37e68d802dd302a4fd8b15e75

    • SSDEEP

      98304:67k7h7K7f7e7c7R767Z7Y7A7j7v7c737K:QKNAzkidQlemXjirK

    Score
    10/10
    fakeavdiscoveryfakeavpersistencespyware

    • FakeAV, RogueAntivirus

      FakeAV or Rogue AntiVirus is a class of malware that displays false alert messages.

      fakeavspywarefakeav

    • Fakeav family

      fakeav

    • FakeAV payload

      fakeavspyware

    • Event Triggered Execution: Image File Execution Options Injection

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks