Overview

overview

10

Static

static

10

JaffaCakes...4f.exe

windows7-x64

10

JaffaCakes...4f.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_a8dae2b3c2683d33223df4fd1e68204f

  • Size

    3.5MB

  • Sample

    250108-yj9y9s1jfv

  • MD5

    a8dae2b3c2683d33223df4fd1e68204f

  • SHA1

    4f2d04454951d70bbff2c6dc94c9767654254ff8

  • SHA256

    8215f8aa52f8c4380af0f2bc0115b3769c1f21ba32049daa6660e1759ef87d06

  • SHA512

    ac04c80c8cae5d174b50063065893d6960bff78caf48f0f9afe1d58019604bc273bf40c8f77f6465ce5efbeceea1c95ff3947eb8811d99c9c6c6fa67ac435be4

  • SSDEEP

    49152:67N1ahCf0V7N1ahC60V7N1ahCT0V7N1ahCG0V7N1ahCc0:67i7H7G7T7

Score
10/10
fakeavdiscoveryfakeavpersistencespyware

Malware Config

Targets

    • Target

      JaffaCakes118_a8dae2b3c2683d33223df4fd1e68204f

    • Size

      3.5MB

    • MD5

      a8dae2b3c2683d33223df4fd1e68204f

    • SHA1

      4f2d04454951d70bbff2c6dc94c9767654254ff8

    • SHA256

      8215f8aa52f8c4380af0f2bc0115b3769c1f21ba32049daa6660e1759ef87d06

    • SHA512

      ac04c80c8cae5d174b50063065893d6960bff78caf48f0f9afe1d58019604bc273bf40c8f77f6465ce5efbeceea1c95ff3947eb8811d99c9c6c6fa67ac435be4

    • SSDEEP

      49152:67N1ahCf0V7N1ahC60V7N1ahCT0V7N1ahCG0V7N1ahCc0:67i7H7G7T7

    Score
    10/10
    fakeavdiscoveryfakeavpersistencespyware

    • FakeAV, RogueAntivirus

      FakeAV or Rogue AntiVirus is a class of malware that displays false alert messages.

      fakeavspywarefakeav

    • Fakeav family

      fakeav

    • FakeAV payload

      fakeavspyware

    • Event Triggered Execution: Image File Execution Options Injection

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks