General
- Target jaffacakes118_Microsoft Windows XP SP3 Corporate Student Edition April (7-_1.exe
- Size 10.2MB
- Sample260910-eyqpdsfd57
- SHA256 6ecdda90bb835af441cb5c3b1933c14742ddac992e6e96163b193fb312d1c7e3
- MD5 e106a201b4ea476f9e35343834ce2dd8
- SHA1 595c3ae4391534c369accbfb8d8473ca54b7fe0b
- SHA512 4b025b9f3d27aad90c80fb66c42a328b383653edb8d9f1b61b68628afd8053af7bc3a8285e37df51bf8689128e0ce3e3320bd77f96016655bff73688a1c83f12
- SSDEEP 49152:kchKoxEvoorD6MxapL3RLtrsaCh7lDSI6nfAJmUQwWpVd:kchFxEJrG13RL5sa87MnfAJhQVd
- TLSH T10BB63300D6C7593BF01E1D34EC224233FAFBED9B36A95B2FDD96980C01A52E495A0DD1
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
jaffacakes118_Microsoft Windows XP SP3 Corporate Student Edition April (7-_1.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
jaffacakes118_Microsoft Windows XP SP3 Corporate Student Edition April (7-_1.exe
Resource
win11ltsc2024-20260710-en
Malware Config
Targets
-
- Target jaffacakes118_Microsoft Windows XP SP3 Corporate Student Edition April (7-_1.exe
- Size 10.2MB
- SHA256 6ecdda90bb835af441cb5c3b1933c14742ddac992e6e96163b193fb312d1c7e3
- MD5 e106a201b4ea476f9e35343834ce2dd8
- SHA1 595c3ae4391534c369accbfb8d8473ca54b7fe0b
- SHA512 4b025b9f3d27aad90c80fb66c42a328b383653edb8d9f1b61b68628afd8053af7bc3a8285e37df51bf8689128e0ce3e3320bd77f96016655bff73688a1c83f12
- SSDEEP 49152:kchKoxEvoorD6MxapL3RLtrsaCh7lDSI6nfAJmUQwWpVd:kchFxEJrG13RL5sa87MnfAJhQVd
- TLSH T10BB63300D6C7593BF01E1D34EC224233FAFBED9B36A95B2FDD96980C01A52E495A0DD1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
UAC bypass
-
Modifies Windows Firewall
-
Executes dropped EXE
-
Adds Run key to start application
-
Checks whether UAC is enabled
-
Suspicious use of SetThreadContext
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
2Disable or Modify System Firewall
1Disable or Modify Tools
1Modify Registry
3