Extracted

• • Target
    jaffacakes118_HEUR.Backdoor.Win32.Generic.f8d65b4c4fe4cf343ee981a92aa8cdd5
  • Size 1.2MB
  • SHA256 1cdf2f47a8985757d4a1bcd8f2bdb35d29484148703323c8a3a1d9a09eb76dd9
  • MD5 f8d65b4c4fe4cf343ee981a92aa8cdd5
  • SHA1 0cadac7f4faabfb1ec37f3cbe9e0e13081670b96
  • SHA512 c19aba9e9f1a908aaf7be0a8087d253188234ae3731699d218f0236be450fa79fde0c5b127d226605c1a8aa895a934676b3e3b97eec8584a35a144bdf73c6bb6
  • SSDEEP 24576:p+cN2rQwgO7Dr/dowoNGb++GDlghkXXvNeWGsmtGR0gM:Ips4P/B/y/8SUM0gM
  • TLSH
    T1EE45AD22A2B11C76C06227794C0B77E56B6AFF512A34FA46AFEC1C4C5FF925138252D3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionpersistenceprivilege_escalation

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2