Analysis

  • max time kernel
    29s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    25-06-2024 23:32

General

  • Target

    0fef8b3ffe91ac29278c24d111ace7a2_JaffaCakes118.exe

  • Size

    569KB

  • MD5

    0fef8b3ffe91ac29278c24d111ace7a2

  • SHA1

    db04a427ea8edbd11d3989a4ac7832fd013b9baa

  • SHA256

    7435733affd75e2537138433aa382f7e1d3bb8c2dad4971d8893d29c4b1ba89c

  • SHA512

    4e3c82df09307c91c1d41bfae835128bccbeabccb5bb9546805c3ca74077eb6f74c8850a995ff574daf9cc7f7e61e37022ab2c4edd7479f8728bae1142ed412a

  • SSDEEP

    12288:J/IwFd+4DG5zP8dxslXI7DVqySi7P4PIXgB+OG8FG:ZG5zPqMXIPVq0j47wO

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

Signatures

  • Modifies firewall policy service 3 TTPs 9 IoCs
  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

  • UAC bypass 3 TTPs 3 IoCs
  • Windows security bypass 2 TTPs 18 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 4 IoCs
  • UPX packed file 18 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Windows security modification 2 TTPs 21 IoCs
  • Checks whether UAC is enabled 1 TTPs 3 IoCs
  • Enumerates connected drives 3 TTPs 13 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 48 IoCs
  • System policy modification 1 TTPs 3 IoCs

Processes

  • C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    1⤵
      PID:1228
    • C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      1⤵
        PID:1296
      • C:\Windows\Explorer.EXE
        C:\Windows\Explorer.EXE
        1⤵
          PID:1340
          • C:\Users\Admin\AppData\Local\Temp\0fef8b3ffe91ac29278c24d111ace7a2_JaffaCakes118.exe
            "C:\Users\Admin\AppData\Local\Temp\0fef8b3ffe91ac29278c24d111ace7a2_JaffaCakes118.exe"
            2⤵
            • Suspicious use of SetThreadContext
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:2372
            • C:\Users\Admin\AppData\Local\Temp\0fef8b3ffe91ac29278c24d111ace7a2_JaffaCakes118.exe
              "C:\Users\Admin\AppData\Local\Temp\0fef8b3ffe91ac29278c24d111ace7a2_JaffaCakes118.exe"
              3⤵
              • Modifies firewall policy service
              • UAC bypass
              • Windows security bypass
              • Loads dropped DLL
              • Windows security modification
              • Checks whether UAC is enabled
              • Enumerates connected drives
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              • System policy modification
              PID:2820
              • C:\Users\Admin\AppData\Local\Temp\2A8A.tmp
                C:\Users\Admin\AppData\Local\Temp\2A8A.tmp
                4⤵
                • Modifies firewall policy service
                • UAC bypass
                • Windows security bypass
                • Executes dropped EXE
                • Windows security modification
                • Checks whether UAC is enabled
                • Drops file in Windows directory
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                • System policy modification
                PID:2204
              • C:\Users\Admin\AppData\Local\Temp\2DE5.tmp
                C:\Users\Admin\AppData\Local\Temp\2DE5.tmp
                4⤵
                • Modifies firewall policy service
                • UAC bypass
                • Windows security bypass
                • Executes dropped EXE
                • Windows security modification
                • Checks whether UAC is enabled
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                • System policy modification
                PID:2768

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\2A8A.tmp

          Filesize

          104KB

          MD5

          ef5ae3f1fb47449f7040a5140a9b20de

          SHA1

          d5573febcf6faeddf4afcce3e35f66c14ac0f4d5

          SHA256

          9761fb628c7dfbea690ea820fafb3a000f891cc97f20e11fdc39a70e87595d94

          SHA512

          ab27b3c8f74173ed24b74082eb1309f163a9e813a13dbc79d7b82811241ac31c0ed16479e2f9ef13e51ef3ecd8f849ddc7c6b25f5ff916f7d19c0028907a93bf

        • C:\Windows\SYSTEM.INI

          Filesize

          257B

          MD5

          c9c32376a614a18b4a14aa2a36c421eb

          SHA1

          416088ea4a318af733b058f0f6c6396534092705

          SHA256

          ff113065d49e78a73b026ae90d35f70cedaed1895ad83f865697d765366a388a

          SHA512

          597f2dbd5dd010bbd0ebea4dbbd0e7c347c0ec4aed3193d76cb335f405cfa8ca709d889613850b8ad74f09b0ca2787f9a286170ddab529092e7ff41fff4b2d86

        • C:\bsay.pif

          Filesize

          100KB

          MD5

          4e2e92e9e3e37dc04bce1a78e9ee0ed5

          SHA1

          66babeb9c5125a92f6f350c172f4c80154aaaa0d

          SHA256

          c4f61809851de476aeb7d8fb062ec71124a28059200b2c33156fc56eb194fd01

          SHA512

          a7f8e6da6644f30583a45a3c8cf32c9babb6e3cdb672ed96dc5410a5739151318d77daacf2676639c82e0a83a270e7f040773370188a611509749f10154041a7

        • memory/1228-40-0x0000000000360000-0x0000000000362000-memory.dmp

          Filesize

          8KB

        • memory/1340-31-0x000000007FFF0000-0x000000007FFF1000-memory.dmp

          Filesize

          4KB

        • memory/1340-37-0x000000007EFC0000-0x000000007EFC6000-memory.dmp

          Filesize

          24KB

        • memory/2204-24-0x0000000000620000-0x00000000016AE000-memory.dmp

          Filesize

          16.6MB

        • memory/2204-28-0x0000000000620000-0x00000000016AE000-memory.dmp

          Filesize

          16.6MB

        • memory/2204-22-0x0000000000620000-0x00000000016AE000-memory.dmp

          Filesize

          16.6MB

        • memory/2204-61-0x0000000000620000-0x00000000016AE000-memory.dmp

          Filesize

          16.6MB

        • memory/2204-23-0x0000000000620000-0x00000000016AE000-memory.dmp

          Filesize

          16.6MB

        • memory/2204-20-0x0000000000400000-0x000000000041C000-memory.dmp

          Filesize

          112KB

        • memory/2204-25-0x0000000000620000-0x00000000016AE000-memory.dmp

          Filesize

          16.6MB

        • memory/2204-19-0x0000000000620000-0x00000000016AE000-memory.dmp

          Filesize

          16.6MB

        • memory/2204-26-0x0000000000620000-0x00000000016AE000-memory.dmp

          Filesize

          16.6MB

        • memory/2204-30-0x0000000000620000-0x00000000016AE000-memory.dmp

          Filesize

          16.6MB

        • memory/2204-18-0x0000000000400000-0x000000000041C000-memory.dmp

          Filesize

          112KB

        • memory/2204-29-0x0000000000620000-0x00000000016AE000-memory.dmp

          Filesize

          16.6MB

        • memory/2372-1-0x0000000074290000-0x000000007483B000-memory.dmp

          Filesize

          5.7MB

        • memory/2372-2-0x0000000074290000-0x000000007483B000-memory.dmp

          Filesize

          5.7MB

        • memory/2372-14-0x0000000074290000-0x000000007483B000-memory.dmp

          Filesize

          5.7MB

        • memory/2372-0-0x0000000074291000-0x0000000074292000-memory.dmp

          Filesize

          4KB

        • memory/2768-87-0x0000000000590000-0x000000000161E000-memory.dmp

          Filesize

          16.6MB

        • memory/2768-89-0x0000000000590000-0x000000000161E000-memory.dmp

          Filesize

          16.6MB

        • memory/2768-133-0x0000000000400000-0x000000000041C000-memory.dmp

          Filesize

          112KB

        • memory/2768-135-0x0000000000590000-0x000000000161E000-memory.dmp

          Filesize

          16.6MB

        • memory/2768-80-0x0000000000590000-0x000000000161E000-memory.dmp

          Filesize

          16.6MB

        • memory/2768-85-0x0000000000590000-0x000000000161E000-memory.dmp

          Filesize

          16.6MB

        • memory/2768-78-0x0000000000400000-0x000000000041C000-memory.dmp

          Filesize

          112KB

        • memory/2768-88-0x0000000000590000-0x000000000161E000-memory.dmp

          Filesize

          16.6MB

        • memory/2768-93-0x0000000000590000-0x000000000161E000-memory.dmp

          Filesize

          16.6MB

        • memory/2768-86-0x0000000000590000-0x000000000161E000-memory.dmp

          Filesize

          16.6MB

        • memory/2820-16-0x0000000000220000-0x000000000023C000-memory.dmp

          Filesize

          112KB

        • memory/2820-53-0x0000000000220000-0x0000000000222000-memory.dmp

          Filesize

          8KB

        • memory/2820-15-0x0000000000400000-0x0000000000461000-memory.dmp

          Filesize

          388KB

        • memory/2820-5-0x0000000000400000-0x0000000000461000-memory.dmp

          Filesize

          388KB

        • memory/2820-17-0x0000000000220000-0x000000000023C000-memory.dmp

          Filesize

          112KB

        • memory/2820-44-0x0000000000220000-0x0000000000222000-memory.dmp

          Filesize

          8KB

        • memory/2820-46-0x0000000000230000-0x0000000000231000-memory.dmp

          Filesize

          4KB

        • memory/2820-54-0x0000000000220000-0x0000000000222000-memory.dmp

          Filesize

          8KB

        • memory/2820-177-0x0000000000400000-0x0000000000461000-memory.dmp

          Filesize

          388KB

        • memory/2820-188-0x0000000000220000-0x0000000000222000-memory.dmp

          Filesize

          8KB

        • memory/2820-3-0x0000000000400000-0x0000000000461000-memory.dmp

          Filesize

          388KB