Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
25-01-2025 03:02
General
-
Target
JaffaCakes118_27a1a0664e032fbc633d1f191b883227.exe
-
Size
277KB
-
MD5
27a1a0664e032fbc633d1f191b883227
-
SHA1
402388a316f3166cca0d1b1d55788d182b217823
-
SHA256
6d40ef7c401bceff1c007139ade12cb340b65c417af8403bcd1d43f403196ec0
-
SHA512
be9a7b7ff195ee56ed5051a97b0cadda583f21f6c61b4eeaa2d4ce90cb92838a486869fedc279eebb1bbad49c7c9bbcea983951f6af05e614842d133984e0607
-
SSDEEP
6144:yuosqxoUo62bLTZuifHeVvNXwgQ3lzJxnTYICHDxYsprsJjNS:yqqxoUorbLTZRfH+tPQrNY7jxY6rs/S
Malware Config
Signatures
-
UAC bypass 3 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Installs/modifies Browser Helper Object 2 TTPs 1 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 4 IoCs
-
System policy modification 1 TTPs 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_27a1a0664e032fbc633d1f191b883227.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_27a1a0664e032fbc633d1f191b883227.exe"1⤵
- UAC bypass
- Checks whether UAC is enabled
- Installs/modifies Browser Helper Object
- System Location Discovery: System Language Discovery
- Modifies registry class
- System policy modification
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
888KB
-
Filesize
888KB
-
Filesize
888KB