Analysis
- max time kernel
140s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
19/06/2024, 22:33
General
- Target 00e76d22743751ded8700795cf613c12_JaffaCakes118.exe
- Size 219KB
- Sample240619-2gr78avdld
- SHA256 eb2439a5f6e7b9bc8975921317eb99745edc93dd71bca80befcbf44a37c0fb4c
Malware Config
Extracted
-
sality
-
http://89.119.67.154/testo5/
-
http://kukutrustnet777.info/home.gif
-
http://kukutrustnet888.info/home.gif
-
http://kukutrustnet987.info/home.gif
-
http://www.klkjwre9fqwieluoi.info/
-
http://kukutrustnet777888.info/
Signatures
- Modifies firewall policy service 3 TTPs 3 IoCs
- Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
- Sality
Sality is backdoor written in C++, first discovered in 2003.
- UAC bypass 3 TTPs 1 IoCs
- Windows security bypass 2 TTPs 6 IoCs
- UPX packed file 10 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Windows security modification 2 TTPs 7 IoCs
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Drops autorun.inf file 1 TTPs 3 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
- Drops file in Program Files directory 1 IoCs
- Drops file in Windows directory 1 IoCs
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
- Suspicious use of WriteProcessMemory 25 IoCs
- System policy modification 1 TTPs 1 IoCs
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\00e76d22743751ded8700795cf613c12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\00e76d22743751ded8700795cf613c12_JaffaCakes118.exe"2⤵
- Modifies firewall policy service
- Modifies visibility of file extensions in Explorer
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Program Files\Microsoft Office\Root\Office16\winword.exe"C:\Program Files\Microsoft Office\Root\Office16\winword.exe"3⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=122.0.2365.52 --initial-client-data=0x240,0x244,0x248,0x23c,0x2ac,0x7ffbe8ef2e98,0x7ffbe8ef2ea4,0x7ffbe8ef2eb02⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2232 --field-trial-handle=2236,i,5367110156796017614,12594004256180761011,262144 --variations-seed-version /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=3256 --field-trial-handle=2236,i,5367110156796017614,12594004256180761011,262144 --variations-seed-version /prefetch:32⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=3348 --field-trial-handle=2236,i,5367110156796017614,12594004256180761011,262144 --variations-seed-version /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --mojo-platform-channel-handle=5240 --field-trial-handle=2236,i,5367110156796017614,12594004256180761011,262144 --variations-seed-version /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --mojo-platform-channel-handle=5308 --field-trial-handle=2236,i,5367110156796017614,12594004256180761011,262144 --variations-seed-version /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3664 --field-trial-handle=2236,i,5367110156796017614,12594004256180761011,262144 --variations-seed-version /prefetch:82⤵
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Hide Artifacts
1Hidden Files and Directories
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
autorun.inf
zPharaoh.exe
zPharaoh.exe
memory/2236-66-0x0000000000400000-0x0000000000427000-memory.dmp
memory/2236-6-0x00000000022F0000-0x000000000337E000-memory.dmp
memory/2236-7-0x00000000022F0000-0x000000000337E000-memory.dmp
memory/2236-5-0x00000000022F0000-0x000000000337E000-memory.dmp
memory/2236-10-0x0000000003F50000-0x0000000003F51000-memory.dmp
memory/2236-12-0x0000000003E00000-0x0000000003E02000-memory.dmp
memory/2236-11-0x0000000003E00000-0x0000000003E02000-memory.dmp
memory/2236-9-0x0000000003E00000-0x0000000003E02000-memory.dmp
memory/2236-8-0x00000000022F0000-0x000000000337E000-memory.dmp
memory/2236-4-0x00000000022F0000-0x000000000337E000-memory.dmp
memory/2236-2-0x00000000022F0000-0x000000000337E000-memory.dmp
memory/2236-55-0x00000000022F0000-0x000000000337E000-memory.dmp
memory/2236-0-0x0000000000400000-0x0000000000427000-memory.dmp
memory/2236-58-0x0000000003E00000-0x0000000003E02000-memory.dmp
memory/2236-53-0x00000000022F0000-0x000000000337E000-memory.dmp
memory/2236-54-0x00000000022F0000-0x000000000337E000-memory.dmp
memory/2236-52-0x00000000022F0000-0x000000000337E000-memory.dmp
memory/4804-44-0x00007FFBCE610000-0x00007FFBCE620000-memory.dmp
memory/4804-68-0x00007FFBCC420000-0x00007FFBCC430000-memory.dmp
memory/4804-47-0x00007FFC0E590000-0x00007FFC0E785000-memory.dmp
memory/4804-51-0x00007FFC0E590000-0x00007FFC0E785000-memory.dmp
memory/4804-48-0x00007FFBCE610000-0x00007FFBCE620000-memory.dmp
memory/4804-49-0x00007FFC0E590000-0x00007FFC0E785000-memory.dmp
memory/4804-45-0x00007FFBCE610000-0x00007FFBCE620000-memory.dmp
memory/4804-43-0x00007FFBCE610000-0x00007FFBCE620000-memory.dmp
memory/4804-81-0x00007FFC0E590000-0x00007FFC0E785000-memory.dmp
memory/4804-46-0x00007FFC0E62D000-0x00007FFC0E62E000-memory.dmp
memory/4804-50-0x00007FFBCE610000-0x00007FFBCE620000-memory.dmp
memory/4804-67-0x00007FFBCC420000-0x00007FFBCC430000-memory.dmp
memory/4804-82-0x00007FFC0E590000-0x00007FFC0E785000-memory.dmp
memory/4804-83-0x00007FFC0E590000-0x00007FFC0E785000-memory.dmp
memory/4804-101-0x00007FFBCE610000-0x00007FFBCE620000-memory.dmp
memory/4804-104-0x00007FFBCE610000-0x00007FFBCE620000-memory.dmp
memory/4804-103-0x00007FFBCE610000-0x00007FFBCE620000-memory.dmp
memory/4804-102-0x00007FFBCE610000-0x00007FFBCE620000-memory.dmp
memory/4804-105-0x00007FFC0E590000-0x00007FFC0E785000-memory.dmp