Analysis
-
max time kernel
96s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
13-12-2024 13:15
General
-
Target
ebad1565a57049cc945805e803f1e562_JaffaCakes118.exe
-
Size
1.8MB
-
MD5
ebad1565a57049cc945805e803f1e562
-
SHA1
7e973b5993a3d9091a59bd4fb9aba61693c8ee6f
-
SHA256
b584fd5433d632aa99dca6d74bb54c538c575c2e120b5a42e9ab3ba001dcf143
-
SHA512
4879e6f07cc05b0de9f4fae1a4909f7667b9d2ae98e6704b82abd23ec280f750855225f9f5f61c2d485abb7351ea886f07b6ebc9c4297d974d91c79f78aa1190
-
SSDEEP
49152:MeucdlvadiF32fteZFRaSINSAubGP/B8GpIN37xZuo:ModMYF3EM5OSrbGPzqNR
Malware Config
Signatures
-
UAC bypass 3 TTPs 2 IoCs
-
Adds policy Run key to start application 2 TTPs 2 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 2 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 5 IoCs
-
System policy modification 1 TTPs 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ebad1565a57049cc945805e803f1e562_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ebad1565a57049cc945805e803f1e562_JaffaCakes118.exe"1⤵
- UAC bypass
- Adds policy Run key to start application
- Checks computer location settings
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\rat.exe"C:\Users\Admin\AppData\Local\Temp\rat.exe"2⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- System policy modification
-
-
C:\Users\Admin\AppData\Local\Temp\epv_rl2c.exe"C:\Users\Admin\AppData\Local\Temp\epv_rl2c.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD5914926b5e35390083ae6c8018aa546af
SHA1cd40784beb4dd2e6f0b6e38601cfa75f4cc9578e
SHA25683e75938fd4c4b5014c7e80591005c7fafffb44f475d04746d27b5184606c473
SHA512d308d9ebd8347b97bb5f55d4de428ac3415c68078ae16cd4c9d2907698f2680d73ca68376a53b5395e05d822b96536850d2c0f211fe233d4c7ca2bf00743abaa
-
Filesize
704KB
MD55b5ec13b693ff8ee9a8501d29c0ed8e6
SHA12c4fd0f302bdfb5b67cbf92bf0762fa9d9da4651
SHA256e21bc4e1a449c8c0d10a06599f8bea521445426d9241d62213a7bae44beee42a
SHA51242a60bc17bca178b1c36f423e9dcdb2c73e218469d66cbb69ae6076666622e89976155e3264cd7416d4d5a98689dc3c7c2c996f5b49fe7d2d14beb12139dab93
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
4.8MB
-
Filesize
9.6MB
-
Filesize
624KB
-
Filesize
32KB
-
Filesize
9.6MB
-
Filesize
392KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
304KB
-
Filesize
664KB
-
Filesize
9.6MB
-
Filesize
9.6MB