Analysis
- max time kernel
148s - max time network
124s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
25/09/2026, 18:09
General
- Target jaffacakes118_908090d43f30ff8eb4e16e52df3b52fc262105c820a1eca72d7c8c8ffcac126f.exe
- Size 120KB
- Sample260925-wryvvsgd72
- SHA256 908090d43f30ff8eb4e16e52df3b52fc262105c820a1eca72d7c8c8ffcac126f
Malware Config
Signatures
- UAC bypass 3 TTPs 3 IoCs
- Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
- Loads dropped DLL 1 IoCs
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
- Drops file in System32 directory 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
- System policy modification 1 TTPs 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_908090d43f30ff8eb4e16e52df3b52fc262105c820a1eca72d7c8c8ffcac126f.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_908090d43f30ff8eb4e16e52df3b52fc262105c820a1eca72d7c8c8ffcac126f.exe"1⤵
- UAC bypass
- Loads dropped DLL
- Checks whether UAC is enabled
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_908090d43f30ff8eb4e16e52df3b52fc262105c820a1eca72d7c8c8ffcac126f.exe"2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Event Triggered Execution
1AppInit DLLs
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Indicator Removal
1File Deletion
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
WindowsEx.dll
memory/3128-0-0x0000000000400000-0x000000000041E000-memory.dmp
memory/3128-6-0x0000000010000000-0x000000001001B000-memory.dmp
memory/3128-8-0x0000000010000000-0x000000001001B000-memory.dmp
memory/3128-7-0x0000000000400000-0x000000000041E000-memory.dmp