General
-
Target
JaffaCakes118_1c600d95a69230e14cee0b0a34f90ff0
-
Size
598KB
-
Sample
250704-t7pwsawqt5
-
MD5
1c600d95a69230e14cee0b0a34f90ff0
-
SHA1
39c1ee6903e778ec5b89f27bcc3e255e8f7a47e2
-
SHA256
0d9db274be9cd7c5086314c4afb05c92981b79ac1eec6ec55c2102318a851266
-
SHA512
1f2e7db3350e75038b5bfc0bc32083160818fcfded16aa28c59a20528663ccd935d7774bd0a6c00d04e29e74daa223f00b3cf5733df9195d968d6403058579f5
-
SSDEEP
1536:luubYWlngkYFKynXvAh1MFOMLwOueYdqXhVBZXcMik421dNSkWNVYM3O3:lOQgk6Kyn/wMFOMLN9AQdjWzT+
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_1c600d95a69230e14cee0b0a34f90ff0.exe
Resource
win10v2004-20250610-en
Behavioral task
behavioral2
Sample
JaffaCakes118_1c600d95a69230e14cee0b0a34f90ff0.exe
Resource
win11-20250619-en
Malware Config
Targets
-
-
Target
JaffaCakes118_1c600d95a69230e14cee0b0a34f90ff0
-
Size
598KB
-
MD5
1c600d95a69230e14cee0b0a34f90ff0
-
SHA1
39c1ee6903e778ec5b89f27bcc3e255e8f7a47e2
-
SHA256
0d9db274be9cd7c5086314c4afb05c92981b79ac1eec6ec55c2102318a851266
-
SHA512
1f2e7db3350e75038b5bfc0bc32083160818fcfded16aa28c59a20528663ccd935d7774bd0a6c00d04e29e74daa223f00b3cf5733df9195d968d6403058579f5
-
SSDEEP
1536:luubYWlngkYFKynXvAh1MFOMLwOueYdqXhVBZXcMik421dNSkWNVYM3O3:lOQgk6Kyn/wMFOMLN9AQdjWzT+
-
Modifies firewall policy service
-
Modifies security service
-
Modifies visibility of file extensions in Explorer
-
Modifies visiblity of hidden/system files in Explorer
-
UAC bypass
-
Windows security bypass
-
Disables RegEdit via registry modification
-
Disables Task Manager via registry modification
-
Disables taskbar notifications via registry modification
-
Event Triggered Execution: Image File Execution Options Injection
-
Drops startup file
-
Executes dropped EXE
-
Windows security modification
-
Adds Run key to start application
-
Checks whether UAC is enabled
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Image File Execution Options Injection
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Image File Execution Options Injection
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Indicator Removal
1Clear Persistence
1Modify Registry
11Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1