Analysis
- max time kernel
144s - max time network
128s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
- submitted
25/06/2024, 21:27
General
- Target 0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe
- Size 336KB
- Sample240625-1a2bwathnb
- SHA256 958c736bb73157af0bf2ad7715e56b0cc7264cc4b844db71778d817f60e9ef0c
Malware Config
Extracted
-
sality
-
http://89.119.67.154/testo5/
-
http://kukutrustnet777.info/home.gif
-
http://kukutrustnet888.info/home.gif
-
http://kukutrustnet987.info/home.gif
Signatures
- Sality
Sality is backdoor written in C++, first discovered in 2003.
- UAC bypass 3 TTPs 1 IoCs
- Windows security bypass 2 TTPs 6 IoCs
- Disables RegEdit via registry modification 1 IoCs
- Disables Task Manager via registry modification
- Modifies Windows Firewall 2 TTPs 1 IoCs
- UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Windows security modification 2 TTPs 7 IoCs
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- Drops file in Windows directory 1 IoCs
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 48 IoCs
- System policy modification 1 TTPs 1 IoCs
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe"2⤵
- UAC bypass
- Windows security bypass
- Disables RegEdit via registry modification
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\netsh.exenetsh firewall set opmode disable3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Users\Admin\AppData\Local\Temp\0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118.exe4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=125.0.6422.142 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=125.0.2535.92 --initial-client-data=0x240,0x244,0x248,0x23c,0x2b0,0x7ffe09c94ef8,0x7ffe09c94f04,0x7ffe09c94f102⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2276,i,16866810346450717340,3849854439116899380,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --field-trial-handle=1936,i,16866810346450717340,3849854439116899380,262144 --variations-seed-version --mojo-platform-channel-handle=2428 /prefetch:32⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --field-trial-handle=2248,i,16866810346450717340,3849854439116899380,262144 --variations-seed-version --mojo-platform-channel-handle=2508 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4356,i,16866810346450717340,3849854439116899380,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:82⤵
-
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
memory/1840-27-0x0000000000400000-0x0000000000409000-memory.dmp
memory/1840-52-0x0000000000400000-0x0000000000409000-memory.dmp
memory/1840-48-0x0000000010000000-0x0000000010013000-memory.dmp
memory/1840-38-0x0000000000400000-0x0000000000409000-memory.dmp
memory/1840-25-0x0000000000400000-0x0000000000409000-memory.dmp
memory/2312-11-0x00000000008C0000-0x00000000008C1000-memory.dmp
memory/2312-43-0x00000000008B0000-0x00000000008B2000-memory.dmp
memory/2312-42-0x00000000008B0000-0x00000000008B2000-memory.dmp
memory/3536-49-0x000000007FFD0000-0x000000007FFD1000-memory.dmp
memory/3536-47-0x000000007FFF0000-0x000000007FFF7000-memory.dmp
memory/3776-16-0x0000000000400000-0x0000000000407000-memory.dmp
memory/3776-20-0x0000000000400000-0x0000000000407000-memory.dmp
memory/3776-41-0x0000000000400000-0x0000000000407000-memory.dmp
memory/4724-0-0x0000000000400000-0x0000000000435000-memory.dmp
memory/4724-18-0x0000000002A40000-0x0000000003A73000-memory.dmp
memory/4724-28-0x0000000002A40000-0x0000000003A73000-memory.dmp
memory/4724-29-0x00000000020E0000-0x00000000020E2000-memory.dmp
memory/4724-21-0x0000000000400000-0x0000000000435000-memory.dmp
memory/4724-6-0x0000000002A40000-0x0000000003A73000-memory.dmp
memory/4724-15-0x00000000020E0000-0x00000000020E2000-memory.dmp
memory/4724-9-0x0000000002A20000-0x0000000002A21000-memory.dmp
memory/4724-8-0x00000000020E0000-0x00000000020E2000-memory.dmp
memory/4724-1-0x0000000002A40000-0x0000000003A73000-memory.dmp