Analysis
-
max time kernel
71s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
19-09-2024 06:30
General
-
Target
eac3454e270d54890344fb234af7f110_JaffaCakes118.exe
-
Size
145KB
-
MD5
eac3454e270d54890344fb234af7f110
-
SHA1
e6bac4c7cfebe9d846246f8cd6b53860ef446af3
-
SHA256
e28f549541d8ccc28d91f83a365f230b411590168ecb84b7939afe877cd3da3b
-
SHA512
6632ea33ce40bd8aac62d3050c27c5862d0f5f9f8f93193d5cabbea780f54b0556207188e3346e512163bc24a4cd0c04da0c4a666e882cae72dd7f06934757b3
-
SSDEEP
3072:FwsYE9PK3YcebVS/dZFXwV3Qrkm7ggFTQH4A6WZrN+gout:F7FBiY5Etua7jFcYFgoS
Malware Config
Signatures
-
UAC bypass 3 TTPs 1 IoCs
-
Windows security bypass 2 TTPs 1 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Windows security modification 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
System policy modification 1 TTPs 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\eac3454e270d54890344fb234af7f110_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\eac3454e270d54890344fb234af7f110_JaffaCakes118.exe"1⤵
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- System policy modification
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
424KB
-
Filesize
4KB
-
Filesize
424KB