Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
-
submitted
11/07/2024, 04:42
General
-
Target
37bc615b3aa027616a4942d3f5a2c904_JaffaCakes118.exe
-
Size
1.5MB
-
MD5
37bc615b3aa027616a4942d3f5a2c904
-
SHA1
8482e5f12818d401edb38ae61ef5864069add626
-
SHA256
85e67d72b9646ebe7098842fe66557b4da817e0b804ce108e43ebac48d8d033c
-
SHA512
c79b6eb299ede0ed4839277a44a49875e42421373c2d61ab77350b8632b55db7b84cc88539b3703d9c62893a3d6561570580adbc3527dd8709fc4387a3de30a1
-
SSDEEP
24576:ZQDQq2vZVn9KjSUT/sZCTCbzOZ8T6yLaGx7wt+00LZF//ohOXTOg+QlKuQbdBMLF:W8Lrn9KjSUTUZpztT6kaGxsiF/4OjOgR
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Modifies firewall policy service 3 TTPs 3 IoCs
-
Sality
Sality is backdoor written in C++, first discovered in 2003.
-
UAC bypass 3 TTPs 1 IoCs
-
Windows security bypass 2 TTPs 6 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 3 IoCs
-
UPX packed file 20 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Windows security modification 2 TTPs 7 IoCs
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Enumerates connected drives 3 TTPs 4 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in Windows directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of WriteProcessMemory 40 IoCs
-
System policy modification 1 TTPs 1 IoCs
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\37bc615b3aa027616a4942d3f5a2c904_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\37bc615b3aa027616a4942d3f5a2c904_JaffaCakes118.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\pft92CC~tmp\SetupBD.exe"C:\Users\Admin\AppData\Local\Temp\pft92CC~tmp\SetupBD.exe" /autorun3⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵
-
C:\Windows\system32\BackgroundTaskHost.exe"C:\Windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD5be9a4618755ebff85589355f3249ada7
SHA13f3e3e54f7a5d752725fddd2ff4d0e38693c4962
SHA256b0005bc6cdba0862ffbfdb912fcd678eabdbc9a24e0984baaa8fd1d8dcae25bb
SHA512646086b8070e592ae6f1b12c774d0ad8e1d44cbef84f57ef5b91d4695f21692d39a61a83bdacde084ce7b8d3aa1914b1f36c8d519cbb6ff6a4b6517d903fc17c
-
Filesize
72KB
MD516840fb73bc30e456ea90db335e1d709
SHA134cd4be4d2db25c0ef01d82d83087b9be3cbfa6b
SHA2562744f9d13ffa2613d17888a640dc8207c4758ad5216cb96926f0f32090406ac7
SHA512a87d4a3de1eac202b1948346e2086a44310896e2ca2bc908ec4347cfabf2eaafd09e6aca24e6f71dc58c80873f404aacf543a8e255c5ad19bea9b763970e3289
-
Filesize
48KB
MD5949611d553e22fb4d335ac8cfcc9ee89
SHA10bff83f7c78d80d19b6fac91feb65e3bf611e174
SHA2562ce83cf8239c304f773a3624d808016299cf84f642a453c63d5e4f53b4f1f30d
SHA512b8f293a7a2247e2fb4fbd0576da36d245d814c6a80c06765436f233f0009c2ef57a16bd7bab948bd27d1be53d246faf22b274933e060a9a425e39ef5a0d1386a
-
Filesize
108KB
MD5183590e47c92aeaea0c178488a0475b9
SHA14edc5a798aa0ea0816261d05cb3b60523f246f77
SHA256bee036412e3ac37d5563409bfc7a24b747de68a939b1f02727d6a9c99b71d8ba
SHA5121923622d9b0ba9f1c7da636e72a5c2ec84341c047836e0c3a6e19b821555f4ac3caa135c56673470c357833529439f78ccb9313c7dd9596012289e6cec18eb52
-
Filesize
1.3MB
MD5b19779e8c680def47ae4c235f344d485
SHA157711e0dbb11949db80fa0c0d8495ffa7a395e8b
SHA2569a826ef3a7fe1effe6f0dc4d1a5fb97c19c6ae340eeeba8bcd44dd7a16199fe8
SHA512e7c3aaf996c5205463d30d6e04a62a2a0b24d4a8002758a4a7438ff635b9c75bed26fab48066ba7e8517aa92b7bfae3cd43383493beff2392295073013f60d1b
-
Filesize
4KB
MD5414378bee661b0df11bdb2be32e15b84
SHA1b14fd9207864d6053b2cb099736b4dafc2084af4
SHA256f9efb3e6fe099c649fb4cc20ac6f9b7e90d3f60b8d98f48fb5d167f1a0b1b7f2
SHA512f042d5a58c5f4d6dee054eebc9270619a79318bdbaeeb9cd23969aba09d4ef1bca77a139c08af718672ec87b7adbd6ef0e4bfeddc1a03e559eac91763d9361dd
-
Filesize
16.6MB
-
Filesize
4KB
-
Filesize
236KB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
8KB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
8KB
-
Filesize
16.6MB
-
Filesize
236KB