Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
12/08/2024, 08:24
General
-
Target
8e02962c52bc21cc69e159f7c76e9e19_JaffaCakes118.exe
-
Size
154KB
-
MD5
8e02962c52bc21cc69e159f7c76e9e19
-
SHA1
9764effeb71c8d3531bbd0f24d18153eee15c598
-
SHA256
09965aff7cddcc6f9080373285313a193f95071f07ab24d0ed37b5c612cb9442
-
SHA512
f9d01a945c2283a5748d221afe478f0a190aa96eb845853ebae1b673919fa2820563017f800e624031d8a5a1a208e2300a007c440fe15d64c4dcb5ba4dc11915
-
SSDEEP
3072:OrSU1ur05E1x26Lsmw5FJN9dLovZP5FZxL9U2ZajJOeItGdxd3ExMx:OrVE1x2L95FJN30vZPtZajUxIbd0x
Malware Config
Signatures
-
UAC bypass 3 TTPs 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Installs/modifies Browser Helper Object 2 TTPs 1 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 4 IoCs
-
System policy modification 1 TTPs 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8e02962c52bc21cc69e159f7c76e9e19_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8e02962c52bc21cc69e159f7c76e9e19_JaffaCakes118.exe"1⤵
- UAC bypass
- Checks whether UAC is enabled
- Installs/modifies Browser Helper Object
- System Location Discovery: System Language Discovery
- Modifies registry class
- System policy modification
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
420KB
-
Filesize
4KB
-
Filesize
420KB
-
Filesize
420KB
-
Filesize
4KB