Analysis
- max time kernel
148s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
25/09/2026, 17:26
General
- Target jaffacakes118_d5313ddb7a9e16539d7452b7f196aac7dbbbfde8c6be227a41cd1a5408206bf2.exe
- Size 120KB
- Sample260925-vz2faatt3k
- SHA256 d5313ddb7a9e16539d7452b7f196aac7dbbbfde8c6be227a41cd1a5408206bf2
Malware Config
Signatures
- UAC bypass 3 TTPs 3 IoCs
- Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
- Loads dropped DLL 1 IoCs
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
- Drops file in System32 directory 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
- System policy modification 1 TTPs 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_d5313ddb7a9e16539d7452b7f196aac7dbbbfde8c6be227a41cd1a5408206bf2.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_d5313ddb7a9e16539d7452b7f196aac7dbbbfde8c6be227a41cd1a5408206bf2.exe"1⤵
- UAC bypass
- Loads dropped DLL
- Checks whether UAC is enabled
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_d5313ddb7a9e16539d7452b7f196aac7dbbbfde8c6be227a41cd1a5408206bf2.exe"2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Event Triggered Execution
1AppInit DLLs
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Indicator Removal
1File Deletion
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
WindowsEx.dll
memory/5924-0-0x0000000000400000-0x000000000041E000-memory.dmp
memory/5924-6-0x0000000010000000-0x0000000010019000-memory.dmp
memory/5924-8-0x0000000010000000-0x0000000010019000-memory.dmp
memory/5924-7-0x0000000000400000-0x000000000041E000-memory.dmp