Extracted

• • Target
    jaffacakes118_fc01f8b38c8c039e8c8f64207230eaaaa1064bf6588937ff9b9fb46ea3010c2b.bin
  • Size 308KB
  • SHA256 fc01f8b38c8c039e8c8f64207230eaaaa1064bf6588937ff9b9fb46ea3010c2b
  • MD5 b946048da3218ed78bfabe6128e6ab02
  • SHA1 43a82a67fb5ed99a55439fbe4b00c3a20ce9b02a
  • SHA512 f1fadb9d957d758be1f26be1115e0f306318b53c4191ffb3b6de5735b2f666c387974f100041e0b3d3725eb1a0f30b5934759b76ad967a05613beff1a71cf4fd
  • SSDEEP 6144:zwIeeXe3eh4hbpByacEuEA1PDpr0eB6Zg41Mp76SCYKSF5ENnlS9wPaYdNS7wxq5:zwIeeXe3eh4hbpByj7whlLCMD4
  • TLSH
    T1AD64EE2122EA90487173BFD35BDC79E95F5BF7B62A3A286E201843078763D58CE19731
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionpersistenceprivilege_escalation

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Executes a VBScript file via the Windows Script Host.

    execution
  behavioral1behavioral2