Analysis
- max time kernel
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
02/10/2026, 08:44
General
- Target jaffacakes118_27f7338eeb8a103a4365b613160f82dbbaa39102be6b3d45b412bc29854aa33e.exe
- Size 682KB
- Sample261002-km5xtsttfw
- SHA256 27f7338eeb8a103a4365b613160f82dbbaa39102be6b3d45b412bc29854aa33e
Malware Config
Signatures
- UAC bypass 3 TTPs 1 IoCs
- Windows security bypass 2 TTPs 1 IoCs
- Executes dropped EXE 1 IoCs
- Windows security modification 2 TTPs 1 IoCs
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Drops file in System32 directory 1 IoCs
- UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of WriteProcessMemory 1 IoCs
- System policy modification 1 TTPs 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_27f7338eeb8a103a4365b613160f82dbbaa39102be6b3d45b412bc29854aa33e.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_27f7338eeb8a103a4365b613160f82dbbaa39102be6b3d45b412bc29854aa33e.exe"1⤵
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\uploadfilecontrol2012.exeC:\Windows\system32\uploadfilecontrol2012.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
4Replay Monitor
Loading Replay Monitor...
Downloads
uploadfilecontrol2012.exe
memory/3384-1-0x0000000000451000-0x0000000000452000-memory.dmp
memory/3384-0-0x0000000000C30000-0x0000000000C31000-memory.dmp
memory/3384-9-0x0000000000400000-0x00000000004B1000-memory.dmp
memory/4868-7-0x0000000000400000-0x00000000005EB000-memory.dmp
memory/4868-8-0x0000000000400000-0x00000000005EB000-memory.dmp
memory/4868-10-0x0000000000400000-0x00000000005EB000-memory.dmp