Analysis

  • max time kernel
    148s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    20-06-2024 04:22

General

  • Target

    02c49ff5cd55eb5c2fd2e9d1017af70c_JaffaCakes118.exe

  • Size

    165KB

  • MD5

    02c49ff5cd55eb5c2fd2e9d1017af70c

  • SHA1

    df96670a8368a27d32e4171694121b765c232230

  • SHA256

    bf60ffee067198ee1d3d56c14218ee65a85dac4d2e84e71194d2aa1e597c0547

  • SHA512

    9ce0a92d5dbb247574076ee80aa8793d0c952aa9699ce41deaad974a179fb1e14064b520d60eba7de20e68d7e50ed815de56aa344d96cbc3062d4a4e7cc2e7a8

  • SSDEEP

    3072:sr85CW4cIeOY5nmIPPjFPIzdctOdt25OmlM8+:k9El3mIPPjFPgO+t25OmlMJ

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

Signatures

  • Detect Neshta payload 6 IoCs
  • Modifies firewall policy service 3 TTPs 3 IoCs
  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

  • UAC bypass 3 TTPs 1 IoCs
  • Windows security bypass 2 TTPs 6 IoCs
  • Disables RegEdit via registry modification 1 IoCs
  • Disables Task Manager via registry modification
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 3 IoCs
  • Modifies system executable filetype association 2 TTPs 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • UPX packed file 24 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Windows security modification 2 TTPs 7 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file 1 TTPs 2 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
  • Modifies registry class 40 IoCs
  • Suspicious behavior: EnumeratesProcesses 15 IoCs
  • Suspicious use of AdjustPrivilegeToken 33 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 1 IoCs

Processes

  • C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    1⤵
      PID:1100
    • C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      1⤵
        PID:1164
      • C:\Windows\Explorer.EXE
        C:\Windows\Explorer.EXE
        1⤵
          PID:1196
          • C:\Users\Admin\AppData\Local\Temp\02c49ff5cd55eb5c2fd2e9d1017af70c_JaffaCakes118.exe
            "C:\Users\Admin\AppData\Local\Temp\02c49ff5cd55eb5c2fd2e9d1017af70c_JaffaCakes118.exe"
            2⤵
            • Loads dropped DLL
            • Modifies system executable filetype association
            • Drops file in Program Files directory
            • Drops file in Windows directory
            • Modifies registry class
            • Suspicious use of WriteProcessMemory
            PID:2360
            • C:\Users\Admin\AppData\Local\Temp\3582-490\02c49ff5cd55eb5c2fd2e9d1017af70c_JaffaCakes118.exe
              "C:\Users\Admin\AppData\Local\Temp\3582-490\02c49ff5cd55eb5c2fd2e9d1017af70c_JaffaCakes118.exe"
              3⤵
              • Modifies firewall policy service
              • UAC bypass
              • Windows security bypass
              • Disables RegEdit via registry modification
              • Executes dropped EXE
              • Modifies system executable filetype association
              • Windows security modification
              • Checks whether UAC is enabled
              • Enumerates connected drives
              • Drops autorun.inf file
              • Drops file in Program Files directory
              • Drops file in Windows directory
              • Modifies registry class
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              • System policy modification
              PID:2964
              • C:\Windows\SysWOW64\explorer.exe
                explorer 02c49ff5cd55eb5c2fd2e9d1017af70c_JaffaCakes118l
                4⤵
                  PID:2656
          • C:\Windows\system32\DllHost.exe
            C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
            1⤵
              PID:668
            • C:\Windows\explorer.exe
              C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
              1⤵
              • Modifies Internet Explorer settings
              • Modifies registry class
              PID:2932

            Network

            MITRE ATT&CK Matrix ATT&CK v13

            Initial Access

            Replication Through Removable Media

            1
            T1091

            Persistence

            Create or Modify System Process

            1
            T1543

            Windows Service

            1
            T1543.003

            Event Triggered Execution

            1
            T1546

            Change Default File Association

            1
            T1546.001

            Privilege Escalation

            Create or Modify System Process

            1
            T1543

            Windows Service

            1
            T1543.003

            Abuse Elevation Control Mechanism

            1
            T1548

            Bypass User Account Control

            1
            T1548.002

            Event Triggered Execution

            1
            T1546

            Change Default File Association

            1
            T1546.001

            Defense Evasion

            Modify Registry

            7
            T1112

            Impair Defenses

            4
            T1562

            Disable or Modify Tools

            3
            T1562.001

            Disable or Modify System Firewall

            1
            T1562.004

            Abuse Elevation Control Mechanism

            1
            T1548

            Bypass User Account Control

            1
            T1548.002

            Credential Access

            Unsecured Credentials

            1
            T1552

            Credentials In Files

            1
            T1552.001

            Discovery

            System Information Discovery

            3
            T1082

            Query Registry

            1
            T1012

            Peripheral Device Discovery

            1
            T1120

            Lateral Movement

            Replication Through Removable Media

            1
            T1091

            Collection

            Data from Local System

            1
            T1005

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\MSOCACHE\ALL USERS\{90140000-0011-0000-0000-0000000FF1CE}-C\ose.exe
              Filesize

              186KB

              MD5

              58b58875a50a0d8b5e7be7d6ac685164

              SHA1

              1e0b89c1b2585c76e758e9141b846ed4477b0662

              SHA256

              2a0aa0763fdef9c38c5dd4d50703f0c7e27f4903c139804ec75e55f8388139ae

              SHA512

              d67214077162a105d01b11a8e207fab08b45b08fbfba0615a2ea146e1dd99eea35e4f02958a1754d3192292c00caf777f186f0a362e4b8b0da51fabbdb76375b

            • C:\MSOCACHE\ALL USERS\{90140000-0011-0000-0000-0000000FF1CE}-C\setup.exe
              Filesize

              1.1MB

              MD5

              566ed4f62fdc96f175afedd811fa0370

              SHA1

              d4b47adc40e0d5a9391d3f6f2942d1889dd2a451

              SHA256

              e17cd94c08fc0e001a49f43a0801cea4625fb9aee211b6dfebebec446c21f460

              SHA512

              cdf8f508d396a1a0d2e0fc25f2ae46398b25039a0dafa0919737cc44e3e926ebae4c3aa26f1a3441511430f1a36241f8e61c515a5d9bd98ad4740d4d0f7b8db7

            • C:\MSOCACHE\ALL USERS\{90140000-0115-0409-0000-0000000FF1CE}-C\DW20.EXE
              Filesize

              859KB

              MD5

              02ee6a3424782531461fb2f10713d3c1

              SHA1

              b581a2c365d93ebb629e8363fd9f69afc673123f

              SHA256

              ead58c483cb20bcd57464f8a4929079539d634f469b213054bf737d227c026dc

              SHA512

              6c9272cb1b6bde3ee887e1463ab30ea76568cb1a285d11393337b78c4ad1c3b7e6ce47646a92ab6d70bff4b02ab9d699b84af9437b720e52dcd35579fe2693ec

            • C:\MSOCache\ALLUSE~1\{90140~1\dwtrig20.exe
              Filesize

              547KB

              MD5

              cf6c595d3e5e9667667af096762fd9c4

              SHA1

              9bb44da8d7f6457099cb56e4f7d1026963dce7ce

              SHA256

              593e60cc30ae0789448547195af77f550387f6648d45847ea244dd0dd7abf03d

              SHA512

              ff4f789df9e6a6d0fbe12b3250f951fcf11e857906c65e96a30bb46266e7e1180d6103a03db2f3764e0d1346b2de7afba8259ba080057e4a268e45e8654dfa80

            • C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe
              Filesize

              129KB

              MD5

              b1e0da67a985533914394e6b8ac58205

              SHA1

              5a65e6076f592f9ea03af582d19d2407351ba6b6

              SHA256

              67629b025fed676bd607094fa7f21550e18c861495ba664ee0d2b215a4717d7f

              SHA512

              188ebb9a58565ca7ed81a46967a66d583f7dea43a2fc1fe8076a79ef4a83119ccaa22f948a944abae8f64b3a4b219f5184260eff7201eb660c321f6c0d1eba22

            • C:\ytegj.exe
              Filesize

              100KB

              MD5

              6096be32206403ef1d28f8f6ef92bbde

              SHA1

              2f21fb8fa5133e3aa1b63f96843daf89c6ecf103

              SHA256

              2a80f7e461087e12bc7c6eb49e130de811ba949d9a6f3fb47346ad97af0eb5d5

              SHA512

              9c1f9dcef7c82b882635d4828ed5a23d39a5bbfff03b151f11c5122b6feb997b8f659e2fc2f37c711bd8874fb23b225161b60f1c132a815414f0f165dc5891ab

            • \PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE
              Filesize

              252KB

              MD5

              9e2b9928c89a9d0da1d3e8f4bd96afa7

              SHA1

              ec66cda99f44b62470c6930e5afda061579cde35

              SHA256

              8899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043

              SHA512

              2ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156

            • \Users\Admin\AppData\Local\Temp\3582-490\02c49ff5cd55eb5c2fd2e9d1017af70c_JaffaCakes118.exe
              Filesize

              125KB

              MD5

              c6146a1633c9ecf052f67cc97b8342f6

              SHA1

              73e5da9adb23ca93a6af2b1d30b7775de4125ebc

              SHA256

              161b1a7c9747d598c7b8031a21527f08a32b6fd0a82841f3f553b70842cb164a

              SHA512

              02d42059dd7afc00f95672ffb9a20fd5344f6adde8cc21f0cb31653800e1bcf313a9d6c77bdcdf3800a1395644ff9c415740e4c170731a09846d59ee4602a403

            • memory/1100-29-0x0000000002010000-0x0000000002012000-memory.dmp
              Filesize

              8KB

            • memory/2360-39-0x0000000000570000-0x0000000000571000-memory.dmp
              Filesize

              4KB

            • memory/2360-4-0x0000000002B00000-0x0000000002B1F000-memory.dmp
              Filesize

              124KB

            • memory/2360-167-0x0000000000400000-0x000000000041B000-memory.dmp
              Filesize

              108KB

            • memory/2360-38-0x0000000000570000-0x0000000000571000-memory.dmp
              Filesize

              4KB

            • memory/2360-37-0x00000000001D0000-0x00000000001D2000-memory.dmp
              Filesize

              8KB

            • memory/2360-56-0x00000000001D0000-0x00000000001D2000-memory.dmp
              Filesize

              8KB

            • memory/2360-53-0x00000000001D0000-0x00000000001D2000-memory.dmp
              Filesize

              8KB

            • memory/2656-49-0x0000000000160000-0x0000000000161000-memory.dmp
              Filesize

              4KB

            • memory/2656-55-0x0000000000150000-0x0000000000152000-memory.dmp
              Filesize

              8KB

            • memory/2656-59-0x0000000000150000-0x0000000000152000-memory.dmp
              Filesize

              8KB

            • memory/2656-58-0x0000000000150000-0x0000000000152000-memory.dmp
              Filesize

              8KB

            • memory/2932-62-0x0000000003900000-0x0000000003910000-memory.dmp
              Filesize

              64KB

            • memory/2964-52-0x0000000002630000-0x00000000036BE000-memory.dmp
              Filesize

              16.6MB

            • memory/2964-161-0x0000000002630000-0x00000000036BE000-memory.dmp
              Filesize

              16.6MB

            • memory/2964-25-0x0000000002630000-0x00000000036BE000-memory.dmp
              Filesize

              16.6MB

            • memory/2964-54-0x00000000003F0000-0x00000000003F2000-memory.dmp
              Filesize

              8KB

            • memory/2964-16-0x0000000002630000-0x00000000036BE000-memory.dmp
              Filesize

              16.6MB

            • memory/2964-50-0x0000000002630000-0x00000000036BE000-memory.dmp
              Filesize

              16.6MB

            • memory/2964-51-0x0000000002630000-0x00000000036BE000-memory.dmp
              Filesize

              16.6MB

            • memory/2964-63-0x0000000002630000-0x00000000036BE000-memory.dmp
              Filesize

              16.6MB

            • memory/2964-64-0x0000000002630000-0x00000000036BE000-memory.dmp
              Filesize

              16.6MB

            • memory/2964-57-0x00000000003F0000-0x00000000003F2000-memory.dmp
              Filesize

              8KB

            • memory/2964-70-0x0000000002630000-0x00000000036BE000-memory.dmp
              Filesize

              16.6MB

            • memory/2964-97-0x0000000002630000-0x00000000036BE000-memory.dmp
              Filesize

              16.6MB

            • memory/2964-98-0x0000000002630000-0x00000000036BE000-memory.dmp
              Filesize

              16.6MB

            • memory/2964-132-0x0000000002630000-0x00000000036BE000-memory.dmp
              Filesize

              16.6MB

            • memory/2964-145-0x0000000002630000-0x00000000036BE000-memory.dmp
              Filesize

              16.6MB

            • memory/2964-45-0x0000000001C00000-0x0000000001C01000-memory.dmp
              Filesize

              4KB

            • memory/2964-162-0x0000000002630000-0x00000000036BE000-memory.dmp
              Filesize

              16.6MB

            • memory/2964-164-0x0000000002630000-0x00000000036BE000-memory.dmp
              Filesize

              16.6MB

            • memory/2964-166-0x0000000002630000-0x00000000036BE000-memory.dmp
              Filesize

              16.6MB

            • memory/2964-21-0x0000000002630000-0x00000000036BE000-memory.dmp
              Filesize

              16.6MB

            • memory/2964-177-0x0000000002630000-0x00000000036BE000-memory.dmp
              Filesize

              16.6MB

            • memory/2964-179-0x0000000002630000-0x00000000036BE000-memory.dmp
              Filesize

              16.6MB

            • memory/2964-23-0x0000000002630000-0x00000000036BE000-memory.dmp
              Filesize

              16.6MB

            • memory/2964-24-0x0000000002630000-0x00000000036BE000-memory.dmp
              Filesize

              16.6MB

            • memory/2964-207-0x0000000002630000-0x00000000036BE000-memory.dmp
              Filesize

              16.6MB

            • memory/2964-231-0x00000000003F0000-0x00000000003F2000-memory.dmp
              Filesize

              8KB

            • memory/2964-20-0x0000000002630000-0x00000000036BE000-memory.dmp
              Filesize

              16.6MB

            • memory/2964-17-0x0000000002630000-0x00000000036BE000-memory.dmp
              Filesize

              16.6MB

            • memory/2964-12-0x0000000000400000-0x000000000041F000-memory.dmp
              Filesize

              124KB