eabd8180037d88786f394268dc56e14d145f1897dbf79a0f9eda8425280e2d58

General

Target

2f646ca3db5e7c221261bc0210e27954_JaffaCakes118.exe
Size

44KB
MD5

2f646ca3db5e7c221261bc0210e27954
SHA1

aad085cce9c06aae43220ba37af39453d45b23fa
SHA256

eabd8180037d88786f394268dc56e14d145f1897dbf79a0f9eda8425280e2d58
SHA512

a61bda5b8c265f728ce595513d37c9446e68c26318feb4610a88b4c8c3fd518f62ba7a40015f9ff6b0486941c3498747051cf76c7795b55ab2ece8ca707f4243
SSDEEP

768:InAAwf7o4PoycIXkGAMcisybmpM3n/C3w1NBNIhJiuQnBUuao:InA17oKdcUcizCpGuFc

Score

10^/10

evasion trojan

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	2f646ca3db5e7c221261bc0210e27954_JaffaCakes118.exe

Windows security bypass 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UACDisableNotify = "0"	2f646ca3db5e7c221261bc0210e27954_JaffaCakes118.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	2f646ca3db5e7c221261bc0210e27954_JaffaCakes118.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UACDisableNotify = "0"	2f646ca3db5e7c221261bc0210e27954_JaffaCakes118.exe

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\X:	2f646ca3db5e7c221261bc0210e27954_JaffaCakes118.exe
File opened (read-only)	\??\H:	2f646ca3db5e7c221261bc0210e27954_JaffaCakes118.exe
File opened (read-only)	\??\J:	2f646ca3db5e7c221261bc0210e27954_JaffaCakes118.exe
File opened (read-only)	\??\K:	2f646ca3db5e7c221261bc0210e27954_JaffaCakes118.exe
File opened (read-only)	\??\L:	2f646ca3db5e7c221261bc0210e27954_JaffaCakes118.exe
File opened (read-only)	\??\M:	2f646ca3db5e7c221261bc0210e27954_JaffaCakes118.exe
File opened (read-only)	\??\O:	2f646ca3db5e7c221261bc0210e27954_JaffaCakes118.exe
File opened (read-only)	\??\Q:	2f646ca3db5e7c221261bc0210e27954_JaffaCakes118.exe
File opened (read-only)	\??\I:	2f646ca3db5e7c221261bc0210e27954_JaffaCakes118.exe
File opened (read-only)	\??\N:	2f646ca3db5e7c221261bc0210e27954_JaffaCakes118.exe
File opened (read-only)	\??\T:	2f646ca3db5e7c221261bc0210e27954_JaffaCakes118.exe
File opened (read-only)	\??\W:	2f646ca3db5e7c221261bc0210e27954_JaffaCakes118.exe
File opened (read-only)	\??\A:	2f646ca3db5e7c221261bc0210e27954_JaffaCakes118.exe
File opened (read-only)	\??\G:	2f646ca3db5e7c221261bc0210e27954_JaffaCakes118.exe
File opened (read-only)	\??\P:	2f646ca3db5e7c221261bc0210e27954_JaffaCakes118.exe
File opened (read-only)	\??\B:	2f646ca3db5e7c221261bc0210e27954_JaffaCakes118.exe
File opened (read-only)	\??\E:	2f646ca3db5e7c221261bc0210e27954_JaffaCakes118.exe
File opened (read-only)	\??\R:	2f646ca3db5e7c221261bc0210e27954_JaffaCakes118.exe
File opened (read-only)	\??\S:	2f646ca3db5e7c221261bc0210e27954_JaffaCakes118.exe
File opened (read-only)	\??\U:	2f646ca3db5e7c221261bc0210e27954_JaffaCakes118.exe
File opened (read-only)	\??\V:	2f646ca3db5e7c221261bc0210e27954_JaffaCakes118.exe
File opened (read-only)	\??\Y:	2f646ca3db5e7c221261bc0210e27954_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeBackupPrivilege	3060	2f646ca3db5e7c221261bc0210e27954_JaffaCakes118.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3060	2f646ca3db5e7c221261bc0210e27954_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3060	2f646ca3db5e7c221261bc0210e27954_JaffaCakes118.exe

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	2f646ca3db5e7c221261bc0210e27954_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\2f646ca3db5e7c221261bc0210e27954_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2f646ca3db5e7c221261bc0210e27954_JaffaCakes118.exe"
1⤵
- UAC bypass
- Windows security bypass
- Drops file in Drivers directory
- Windows security modification
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:3060