Analysis

  • max time kernel
    20s
  • max time network
    142s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    18-07-2024 11:14

General

  • Target

    571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe

  • Size

    777KB

  • MD5

    571fd53c9573642e3397c1bc7913be59

  • SHA1

    09e4a0d7d252a82ab449873ef14e64abd9c3e5c4

  • SHA256

    143cf25d7afbe29915bb43fd9cdfe4ffe90054ad29ecd646a8770b612ea30ade

  • SHA512

    9c2f181d6ad80ad1c9b7337ea23c20b1ab21eeef618ed32919590fe989cb47d5b0fac4507489f8e950236534f70aea71ad9074768e536213306f5245930f895e

  • SSDEEP

    24576:WqeOs7C840n9lpG1Rtb938KZtf/1ZkHhWv:WqeOhL0nDEXxt9

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

Signatures

  • Ammyy Admin

    Remote admin tool with various capabilities.

  • AmmyyAdmin payload 5 IoCs
  • FlawedAmmyy RAT

    Remote-access trojan based on leaked code for the Ammyy remote admin software.

  • Modifies firewall policy service 3 TTPs 9 IoCs
  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

  • UAC bypass 3 TTPs 3 IoCs
  • Windows security bypass 2 TTPs 30 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • UPX packed file 24 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Windows security modification 2 TTPs 33 IoCs
  • Checks whether UAC is enabled 1 TTPs 3 IoCs
  • Enumerates connected drives 3 TTPs 4 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 1 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 24 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs
  • System policy modification 1 TTPs 3 IoCs

Processes

  • C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    1⤵
      PID:1108
    • C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      1⤵
        PID:1220
      • C:\Windows\Explorer.EXE
        C:\Windows\Explorer.EXE
        1⤵
          PID:1252
          • C:\Users\Admin\AppData\Local\Temp\571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe
            "C:\Users\Admin\AppData\Local\Temp\571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe"
            2⤵
            • Modifies firewall policy service
            • UAC bypass
            • Windows security bypass
            • Windows security modification
            • Checks whether UAC is enabled
            • Drops file in Windows directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            • System policy modification
            PID:1912
        • C:\Windows\system32\DllHost.exe
          C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
          1⤵
            PID:1600
          • C:\Users\Admin\AppData\Local\Temp\571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe
            "C:\Users\Admin\AppData\Local\Temp\571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe" -service -lunch
            1⤵
            • Modifies firewall policy service
            • UAC bypass
            • Windows security bypass
            • Windows security modification
            • Checks whether UAC is enabled
            • Modifies data under HKEY_USERS
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            • System policy modification
            PID:2852
            • C:\Users\Admin\AppData\Local\Temp\571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe
              "C:\Users\Admin\AppData\Local\Temp\571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe"
              2⤵
              • Modifies firewall policy service
              • UAC bypass
              • Windows security bypass
              • Checks computer location settings
              • Windows security modification
              • Checks whether UAC is enabled
              • Enumerates connected drives
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              • Suspicious use of WriteProcessMemory
              • System policy modification
              PID:344

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\ProgramData\AMMYY\hr

            Filesize

            22B

            MD5

            1d16f9933a7474e80cfcf64d12cac36f

            SHA1

            b5f444032fb62160742c8afb224214f90e5ee6a1

            SHA256

            ce04f504d8d50a43f64189dc45bcf68e2bf341dfffeba7d41f715f57dec43061

            SHA512

            7f8ba2a26dc9e3b2acfa56dfe3f875e9c1d2a354deb522fb490cb07d72050501aad49974556aee21fbdd3ed91ddeb2a4f5d60f0b5acee76cbefde998a1c6f785

          • C:\ProgramData\AMMYY\hr3

            Filesize

            68B

            MD5

            06e22dfaf08340dd9041468df2e6c82f

            SHA1

            f8873af4446e8e3a9d8070463916e2d1676c36dd

            SHA256

            188d2e98f93b952ac78f1c91ae927b515dc3e658eec7371b40731be53bd5584e

            SHA512

            73d9b9a3acc791559310db62c3301a8e02e8f9d3b57a701260863279db370d584232fd4d5dc64f10b5c46d179452d107cbae815bf20ab17a2e6cebf1abd6a742

          • C:\ProgramData\AMMYY\settings3.bin

            Filesize

            269B

            MD5

            097a18ed7b31114c7ef39ef06eff02f0

            SHA1

            276bb5fc8ab72ed3a447dd57be668ace8f75a7c1

            SHA256

            985b458559939244b777d09d71d6192a13f693b88b046ca904012603a5582812

            SHA512

            168ef05ddb434dd4003748c7cd6ea9ed5c8280506de4473c3b193fffc314b469e85e2474f919f189c9b7ffb16aa741d75900341a9802dae175ad185e1fea3e96

          • C:\Windows\SYSTEM.INI

            Filesize

            257B

            MD5

            6d70bceab8e6ef50dbbc8087790592f4

            SHA1

            dd0775c6567b5707a636c0095e50b6074720723e

            SHA256

            d47f7ae0be875cb7c184ef6a2a49da6d7db7fefb7adece7ba6e87d9ea3348748

            SHA512

            b5ccfc98f086d97053f5f471f389c70569264b1f47b4a25aae09b044139d9034972708f2890f73bcbcc0bf6dfdbc90112a8be8c25f54535dbe9824a56d61ad64

          • C:\pidkvl.pif

            Filesize

            100KB

            MD5

            4482a58da374fdf669635f1d6e0add57

            SHA1

            72fbb1782d591fda7c9af477e4b86fc8c2a3b08d

            SHA256

            0350eccb766d8475aa38048582c72b1a495d1d01da481b15cd7a62ab570b31d8

            SHA512

            b49795679d0d8715250dc277a84bc8f4b165f971d8001b7b994b58cb19757e28f3061516cd2ced4230b84cb5f6dc6a2425025ca38d9fe9497d5eb5ed434474dc

          • memory/344-53-0x0000000000400000-0x00000000004C8000-memory.dmp

            Filesize

            800KB

          • memory/344-85-0x0000000003D80000-0x0000000004E0E000-memory.dmp

            Filesize

            16.6MB

          • memory/344-81-0x0000000003D80000-0x0000000004E0E000-memory.dmp

            Filesize

            16.6MB

          • memory/344-82-0x0000000003D80000-0x0000000004E0E000-memory.dmp

            Filesize

            16.6MB

          • memory/344-83-0x0000000003D80000-0x0000000004E0E000-memory.dmp

            Filesize

            16.6MB

          • memory/1108-10-0x0000000000130000-0x0000000000132000-memory.dmp

            Filesize

            8KB

          • memory/1912-9-0x00000000024D0000-0x000000000355E000-memory.dmp

            Filesize

            16.6MB

          • memory/1912-6-0x00000000024D0000-0x000000000355E000-memory.dmp

            Filesize

            16.6MB

          • memory/1912-30-0x00000000024D0000-0x000000000355E000-memory.dmp

            Filesize

            16.6MB

          • memory/1912-24-0x0000000000290000-0x0000000000292000-memory.dmp

            Filesize

            8KB

          • memory/1912-23-0x0000000000290000-0x0000000000292000-memory.dmp

            Filesize

            8KB

          • memory/1912-22-0x0000000000590000-0x0000000000591000-memory.dmp

            Filesize

            4KB

          • memory/1912-8-0x00000000024D0000-0x000000000355E000-memory.dmp

            Filesize

            16.6MB

          • memory/1912-19-0x0000000000590000-0x0000000000591000-memory.dmp

            Filesize

            4KB

          • memory/1912-5-0x00000000024D0000-0x000000000355E000-memory.dmp

            Filesize

            16.6MB

          • memory/1912-18-0x0000000000290000-0x0000000000292000-memory.dmp

            Filesize

            8KB

          • memory/1912-7-0x00000000024D0000-0x000000000355E000-memory.dmp

            Filesize

            16.6MB

          • memory/1912-76-0x00000000024D0000-0x000000000355E000-memory.dmp

            Filesize

            16.6MB

          • memory/1912-4-0x00000000024D0000-0x000000000355E000-memory.dmp

            Filesize

            16.6MB

          • memory/1912-46-0x00000000005A0000-0x00000000005A2000-memory.dmp

            Filesize

            8KB

          • memory/1912-74-0x0000000000400000-0x00000000004C8000-memory.dmp

            Filesize

            800KB

          • memory/1912-67-0x0000000000290000-0x0000000000292000-memory.dmp

            Filesize

            8KB

          • memory/1912-28-0x00000000024D0000-0x000000000355E000-memory.dmp

            Filesize

            16.6MB

          • memory/1912-27-0x00000000024D0000-0x000000000355E000-memory.dmp

            Filesize

            16.6MB

          • memory/1912-0-0x0000000000400000-0x00000000004C8000-memory.dmp

            Filesize

            800KB

          • memory/2852-37-0x00000000011E0000-0x000000000226E000-memory.dmp

            Filesize

            16.6MB

          • memory/2852-38-0x00000000011E0000-0x000000000226E000-memory.dmp

            Filesize

            16.6MB

          • memory/2852-29-0x00000000011E0000-0x000000000226E000-memory.dmp

            Filesize

            16.6MB

          • memory/2852-32-0x00000000011E0000-0x000000000226E000-memory.dmp

            Filesize

            16.6MB

          • memory/2852-33-0x00000000011E0000-0x000000000226E000-memory.dmp

            Filesize

            16.6MB

          • memory/2852-71-0x0000000000400000-0x00000000004C8000-memory.dmp

            Filesize

            800KB

          • memory/2852-35-0x0000000000400000-0x00000000004C8000-memory.dmp

            Filesize

            800KB

          • memory/2852-36-0x00000000011E0000-0x000000000226E000-memory.dmp

            Filesize

            16.6MB

          • memory/2852-48-0x00000000011E0000-0x000000000226E000-memory.dmp

            Filesize

            16.6MB

          • memory/2852-50-0x00000000011E0000-0x000000000226E000-memory.dmp

            Filesize

            16.6MB

          • memory/2852-49-0x00000000011E0000-0x000000000226E000-memory.dmp

            Filesize

            16.6MB

          • memory/2852-52-0x0000000003340000-0x0000000003408000-memory.dmp

            Filesize

            800KB

          • memory/2852-51-0x00000000011E0000-0x000000000226E000-memory.dmp

            Filesize

            16.6MB