Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
22/08/2024, 20:53
General
-
Target
b91c83f400f4da99dcfd67d6d4be399d_JaffaCakes118.exe
-
Size
44KB
-
MD5
b91c83f400f4da99dcfd67d6d4be399d
-
SHA1
eec3e91b0561d246b3e026e394c811d784374900
-
SHA256
c3e4d3da736b19e4bb4a37c061a861b5cd10b28e0e5b5aa090ffa6c2042ed37b
-
SHA512
1c48ae02b326a464bc5c2c86696290471af5ff9e8ab764a6b4d52b5957088e4cdf0d503d2dbd4b0c989d583adb6a1060bd7f5fdcbc9d74a0978cabee6b7449f7
-
SSDEEP
768:f4IYUB5VhCob0GTmcYDj0BSHhAV02SRpPY:wzUB5VQob07cYs0s0J2
Malware Config
Signatures
-
UAC bypass 3 TTPs 2 IoCs
-
Drops file in Drivers directory 2 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Checks whether UAC is enabled 1 TTPs 2 IoCs
-
Hijack Execution Flow: Executable Installer File Permissions Weakness 1 TTPs 1 IoCs
Possible Turn off User Account Control's privilege elevation for standard users.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
System policy modification 1 TTPs 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b91c83f400f4da99dcfd67d6d4be399d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b91c83f400f4da99dcfd67d6d4be399d_JaffaCakes118.exe"1⤵
- UAC bypass
- Drops file in Drivers directory
- Adds Run key to start application
- Checks whether UAC is enabled
- Hijack Execution Flow: Executable Installer File Permissions Weakness
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Hijack Execution Flow
1Executable Installer File Permissions Weakness
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Hijack Execution Flow
1Executable Installer File Permissions Weakness
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
664KB
-
Filesize
9.6MB
-
Filesize
4.8MB
-
Filesize
624KB
-
Filesize
9.6MB
-
Filesize
32KB
-
Filesize
304KB
-
Filesize
9.6MB
-
Filesize
100KB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
4KB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
4.7MB