de629d333a4f39ca7b62809ef62facd92a2796cb61ad087cee48daa7efcc6880

General

Target
jaffacakes118_de629d333a4f39ca7b62809ef62facd92a2796cb61ad087cee48daa7efcc6880.exe
Size 91KB
Sample261002-jsrrqaxeqf
SHA256 de629d333a4f39ca7b62809ef62facd92a2796cb61ad087cee48daa7efcc6880
MD5 68c49953e669a44c8d90ae70cc211e40
SHA1 50d3cba7540525dcb3974ed77e762ec206c2a5f5
SHA512 b28bfad500d2d870d802f0c454f363adf90d4153aa875df0865a3419f8ccb8091cf5fe65a7e396f7f95a545a754b108853efa71098eb5ba489582ea1c934440d
SSDEEP 1536:55nNTfSPbksgUj1asW/ffP7cu4ndEEXIdInaL+nIrIdgdWfM9XxatwcU6:5z2b5xjH2AucFnOj9c
TLSH
T116932741E7A980E2E1E2003C61557B36D9FF68F02716BE539B70EA8A5E79FE0C534247
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

UAC bypass 3 TTPs 3 IoCs

defense_evasion trojan

Bypass User Account Control

Disable or Modify Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	jaffacakes118_de629d333a4f39ca7b62809ef62facd92a2796cb61ad087cee48daa7efcc6880.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	jaffacakes118_de629d333a4f39ca7b62809ef62facd92a2796cb61ad087cee48daa7efcc6880.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	jaffacakes118_de629d333a4f39ca7b62809ef62facd92a2796cb61ad087cee48daa7efcc6880.exe

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	jaffacakes118_de629d333a4f39ca7b62809ef62facd92a2796cb61ad087cee48daa7efcc6880.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\WindowsEx.dll	jaffacakes118_de629d333a4f39ca7b62809ef62facd92a2796cb61ad087cee48daa7efcc6880.exe
File opened for modification	C:\Windows\SysWOW64\WindowsEx.dll	jaffacakes118_de629d333a4f39ca7b62809ef62facd92a2796cb61ad087cee48daa7efcc6880.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

System Language Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_de629d333a4f39ca7b62809ef62facd92a2796cb61ad087cee48daa7efcc6880.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
884	jaffacakes118_de629d333a4f39ca7b62809ef62facd92a2796cb61ad087cee48daa7efcc6880.exe
884	jaffacakes118_de629d333a4f39ca7b62809ef62facd92a2796cb61ad087cee48daa7efcc6880.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	884	jaffacakes118_de629d333a4f39ca7b62809ef62facd92a2796cb61ad087cee48daa7efcc6880.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 884 wrote to memory of 1292	884	jaffacakes118_de629d333a4f39ca7b62809ef62facd92a2796cb61ad087cee48daa7efcc6880.exe	89

System policy modification 1 TTPs 3 IoCs

defense_evasion

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	jaffacakes118_de629d333a4f39ca7b62809ef62facd92a2796cb61ad087cee48daa7efcc6880.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	jaffacakes118_de629d333a4f39ca7b62809ef62facd92a2796cb61ad087cee48daa7efcc6880.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	jaffacakes118_de629d333a4f39ca7b62809ef62facd92a2796cb61ad087cee48daa7efcc6880.exe

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_de629d333a4f39ca7b62809ef62facd92a2796cb61ad087cee48daa7efcc6880.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_de629d333a4f39ca7b62809ef62facd92a2796cb61ad087cee48daa7efcc6880.exe"
1⤵
- UAC bypass
- Checks whether UAC is enabled
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:884
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_de629d333a4f39ca7b62809ef62facd92a2796cb61ad087cee48daa7efcc6880.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1292