15e5a4a290ea856781017b00f98a0bdd0a6397da7a0269b0c82d092b41d8a1e7

General

Target

62bc950a6e604db2c297318ef09ddc22_JaffaCakes118.exe
Size

44KB
MD5

62bc950a6e604db2c297318ef09ddc22
SHA1

b6a2a366acd9b781657abf9424d02c7684db13ca
SHA256

15e5a4a290ea856781017b00f98a0bdd0a6397da7a0269b0c82d092b41d8a1e7
SHA512

ee2af8c8d7112e9cb53cc56f4bf555b06bf1071df0dd112051b9089d71fec10159d2188f95d9ccd0b7996027025fa40ccb24dd7d1814c62830a87c304bf0bc0b
SSDEEP

384:C99fV9cTSYRGDQSXLf45NDQfr8Ke8p8RVh5RWp1J/R1M7LXqVRSGrN2HMiifi4:C99t9cWf7inbHMNM7eHfNuMiifi4

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

UAC bypass 3 TTPs 2 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	62bc950a6e604db2c297318ef09ddc22_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	62bc950a6e604db2c297318ef09ddc22_JaffaCakes118.exe

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\system32\drivers\services.exe	62bc950a6e604db2c297318ef09ddc22_JaffaCakes118.exe
File opened for modification	C:\WINDOWS\system32\drivers\services.exe	62bc950a6e604db2c297318ef09ddc22_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Run	62bc950a6e604db2c297318ef09ddc22_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Defender = "C:\\WINDOWS\\system32\\drivers\\services.exe"	62bc950a6e604db2c297318ef09ddc22_JaffaCakes118.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	62bc950a6e604db2c297318ef09ddc22_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	62bc950a6e604db2c297318ef09ddc22_JaffaCakes118.exe

System policy modification 1 TTPs 7 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	62bc950a6e604db2c297318ef09ddc22_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	62bc950a6e604db2c297318ef09ddc22_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	62bc950a6e604db2c297318ef09ddc22_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	62bc950a6e604db2c297318ef09ddc22_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	62bc950a6e604db2c297318ef09ddc22_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableUIADesktopToggle = "0"	62bc950a6e604db2c297318ef09ddc22_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0"	62bc950a6e604db2c297318ef09ddc22_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\62bc950a6e604db2c297318ef09ddc22_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\62bc950a6e604db2c297318ef09ddc22_JaffaCakes118.exe"
1⤵
- UAC bypass
- Drops file in Drivers directory
- Adds Run key to start application
- Checks whether UAC is enabled
- System policy modification
PID:2696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Impair Defenses

1

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2696-0-0x000007FEF5C4E000-0x000007FEF5C4F000-memory.dmp

Filesize
4KB

Download
memory/2696-1-0x000007FEF5990000-0x000007FEF632D000-memory.dmp

Filesize
9.6MB

Download
memory/2696-2-0x000007FEF5990000-0x000007FEF632D000-memory.dmp

Filesize
9.6MB

Download
memory/2696-3-0x000007FEF5990000-0x000007FEF632D000-memory.dmp

Filesize
9.6MB

Download
memory/2696-4-0x000007FEF5990000-0x000007FEF632D000-memory.dmp

Filesize
9.6MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads