Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
04/11/2024, 01:27
Static task
static1
Behavioral task
behavioral1
Sample
8e77f6a0086b786659d36deaf5a577aa_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
8e77f6a0086b786659d36deaf5a577aa_JaffaCakes118.exe
-
Size
172KB
-
MD5
8e77f6a0086b786659d36deaf5a577aa
-
SHA1
ee2d97a09f60be9f61122afa3000d8df07716b9f
-
SHA256
7c436d65195f966e5111a1e99b8be66835076bfb83429600309cc39eedd7644a
-
SHA512
e2c15b3b88bbf33afc20c79182a6a3f7d34d1d3018c4b64cc09e0dd5e09a9875d2bf4e1ae8d8bc4a4d807bff361d90859fa3f6ef1bcd5339d3da42189f17cd61
-
SSDEEP
3072:ciKloQSrkKgRENEI5apGTwQqVMTW0hiJDzc9QqJXc1l7JT4JuSK:cn8M1n
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 8e77f6a0086b786659d36deaf5a577aa_JaffaCakes118.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UACDisableNotify = "0" 8e77f6a0086b786659d36deaf5a577aa_JaffaCakes118.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UACDisableNotify = "0" 8e77f6a0086b786659d36deaf5a577aa_JaffaCakes118.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 8e77f6a0086b786659d36deaf5a577aa_JaffaCakes118.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2552 set thread context of 2576 2552 8e77f6a0086b786659d36deaf5a577aa_JaffaCakes118.exe 86 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8e77f6a0086b786659d36deaf5a577aa_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2576 8e77f6a0086b786659d36deaf5a577aa_JaffaCakes118.exe 2576 8e77f6a0086b786659d36deaf5a577aa_JaffaCakes118.exe 2576 8e77f6a0086b786659d36deaf5a577aa_JaffaCakes118.exe 2576 8e77f6a0086b786659d36deaf5a577aa_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeBackupPrivilege 2552 8e77f6a0086b786659d36deaf5a577aa_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2552 8e77f6a0086b786659d36deaf5a577aa_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2552 wrote to memory of 2576 2552 8e77f6a0086b786659d36deaf5a577aa_JaffaCakes118.exe 86 PID 2552 wrote to memory of 2576 2552 8e77f6a0086b786659d36deaf5a577aa_JaffaCakes118.exe 86 PID 2552 wrote to memory of 2576 2552 8e77f6a0086b786659d36deaf5a577aa_JaffaCakes118.exe 86 PID 2552 wrote to memory of 2576 2552 8e77f6a0086b786659d36deaf5a577aa_JaffaCakes118.exe 86 PID 2552 wrote to memory of 2576 2552 8e77f6a0086b786659d36deaf5a577aa_JaffaCakes118.exe 86 PID 2552 wrote to memory of 2576 2552 8e77f6a0086b786659d36deaf5a577aa_JaffaCakes118.exe 86 PID 2552 wrote to memory of 2576 2552 8e77f6a0086b786659d36deaf5a577aa_JaffaCakes118.exe 86 PID 2576 wrote to memory of 3348 2576 8e77f6a0086b786659d36deaf5a577aa_JaffaCakes118.exe 56 PID 2576 wrote to memory of 3348 2576 8e77f6a0086b786659d36deaf5a577aa_JaffaCakes118.exe 56 PID 2576 wrote to memory of 3348 2576 8e77f6a0086b786659d36deaf5a577aa_JaffaCakes118.exe 56 PID 2576 wrote to memory of 3348 2576 8e77f6a0086b786659d36deaf5a577aa_JaffaCakes118.exe 56 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 8e77f6a0086b786659d36deaf5a577aa_JaffaCakes118.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3348
-
C:\Users\Admin\AppData\Local\Temp\8e77f6a0086b786659d36deaf5a577aa_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8e77f6a0086b786659d36deaf5a577aa_JaffaCakes118.exe"2⤵
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\8e77f6a0086b786659d36deaf5a577aa_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\8e77f6a0086b786659d36deaf5a577aa_JaffaCakes118.exe3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2576
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
4