General
- Target jaffacakes118_PSD Abstract Background_1.exe
- Size 5.8MB
- Sample260910-dp7qwavgme
- SHA256 fece4cae194f563158fabc7782ae4bc53765b7b703bd5944e59edebc249145aa
- MD5 d280fae7612d90dda90f98719e096fa6
- SHA1 2a45f4578f842f61f58beab3243c07235c28bd67
- SHA512 0a465583e27d2a7fa2d8cd7ba5303a01eb89d0f85466437dd3f345d7d46500d78b6082b863c9d01ac3420730fa911105afd5c67746957930dfd0d0b7ee77842b
- SSDEEP 98304:Xqtl0giHtFJZGgELdovyZ/n628yOFjlQqnmKMeNGwRKryP/g1XhiLp2Gu2l:siHPqjLdoap628yOFGyEe4wRKrynMXhq
- TLSH T12756334466E297F7CCEF1C7B51BA022BCA72DB6DFD78B19B78929049F1D3A41044E902
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118_PSD Abstract Background_1.exe
Resource
win10v2004-20260513-en
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_PSD Abstract Background_1.exe
Resource
win11ltsc2024-20260709-en
13 signatures
150 seconds
Malware Config
Targets
-
- Target jaffacakes118_PSD Abstract Background_1.exe
- Size 5.8MB
- SHA256 fece4cae194f563158fabc7782ae4bc53765b7b703bd5944e59edebc249145aa
- MD5 d280fae7612d90dda90f98719e096fa6
- SHA1 2a45f4578f842f61f58beab3243c07235c28bd67
- SHA512 0a465583e27d2a7fa2d8cd7ba5303a01eb89d0f85466437dd3f345d7d46500d78b6082b863c9d01ac3420730fa911105afd5c67746957930dfd0d0b7ee77842b
- SSDEEP 98304:Xqtl0giHtFJZGgELdovyZ/n628yOFjlQqnmKMeNGwRKryP/g1XhiLp2Gu2l:siHPqjLdoap628yOFGyEe4wRKrynMXhq
- TLSH T12756334466E297F7CCEF1C7B51BA022BCA72DB6DFD78B19B78929049F1D3A41044E902
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
UAC bypass
-
Adds policy Run key to start application
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Adds Run key to start application
-
Checks whether UAC is enabled
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
4