Analysis
-
max time kernel
20s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
-
submitted
18-07-2024 11:14
General
-
Target
571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe
-
Size
777KB
-
MD5
571fd53c9573642e3397c1bc7913be59
-
SHA1
09e4a0d7d252a82ab449873ef14e64abd9c3e5c4
-
SHA256
143cf25d7afbe29915bb43fd9cdfe4ffe90054ad29ecd646a8770b612ea30ade
-
SHA512
9c2f181d6ad80ad1c9b7337ea23c20b1ab21eeef618ed32919590fe989cb47d5b0fac4507489f8e950236534f70aea71ad9074768e536213306f5245930f895e
-
SSDEEP
24576:WqeOs7C840n9lpG1Rtb938KZtf/1ZkHhWv:WqeOhL0nDEXxt9
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Ammyy Admin
Remote admin tool with various capabilities.
-
AmmyyAdmin payload 5 IoCs
-
FlawedAmmyy RAT
Remote-access trojan based on leaked code for the Ammyy remote admin software.
-
Modifies firewall policy service 3 TTPs 9 IoCs
-
Sality
Sality is backdoor written in C++, first discovered in 2003.
-
UAC bypass 3 TTPs 3 IoCs
-
Windows security bypass 2 TTPs 30 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
UPX packed file 24 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Windows security modification 2 TTPs 33 IoCs
-
Checks whether UAC is enabled 1 TTPs 3 IoCs
-
Enumerates connected drives 3 TTPs 4 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in Windows directory 1 IoCs
-
Modifies data under HKEY_USERS 64 IoCs
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 24 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SendNotifyMessage 1 IoCs
-
Suspicious use of WriteProcessMemory 17 IoCs
-
System policy modification 1 TTPs 3 IoCs
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Users\Admin\AppData\Local\Temp\571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe" -service -lunch1⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\571fd53c9573642e3397c1bc7913be59_JaffaCakes118.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Checks computer location settings
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
- System policy modification
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
22B
MD51d16f9933a7474e80cfcf64d12cac36f
SHA1b5f444032fb62160742c8afb224214f90e5ee6a1
SHA256ce04f504d8d50a43f64189dc45bcf68e2bf341dfffeba7d41f715f57dec43061
SHA5127f8ba2a26dc9e3b2acfa56dfe3f875e9c1d2a354deb522fb490cb07d72050501aad49974556aee21fbdd3ed91ddeb2a4f5d60f0b5acee76cbefde998a1c6f785
-
Filesize
68B
MD506e22dfaf08340dd9041468df2e6c82f
SHA1f8873af4446e8e3a9d8070463916e2d1676c36dd
SHA256188d2e98f93b952ac78f1c91ae927b515dc3e658eec7371b40731be53bd5584e
SHA51273d9b9a3acc791559310db62c3301a8e02e8f9d3b57a701260863279db370d584232fd4d5dc64f10b5c46d179452d107cbae815bf20ab17a2e6cebf1abd6a742
-
Filesize
269B
MD5097a18ed7b31114c7ef39ef06eff02f0
SHA1276bb5fc8ab72ed3a447dd57be668ace8f75a7c1
SHA256985b458559939244b777d09d71d6192a13f693b88b046ca904012603a5582812
SHA512168ef05ddb434dd4003748c7cd6ea9ed5c8280506de4473c3b193fffc314b469e85e2474f919f189c9b7ffb16aa741d75900341a9802dae175ad185e1fea3e96
-
Filesize
257B
MD56d70bceab8e6ef50dbbc8087790592f4
SHA1dd0775c6567b5707a636c0095e50b6074720723e
SHA256d47f7ae0be875cb7c184ef6a2a49da6d7db7fefb7adece7ba6e87d9ea3348748
SHA512b5ccfc98f086d97053f5f471f389c70569264b1f47b4a25aae09b044139d9034972708f2890f73bcbcc0bf6dfdbc90112a8be8c25f54535dbe9824a56d61ad64
-
Filesize
100KB
MD54482a58da374fdf669635f1d6e0add57
SHA172fbb1782d591fda7c9af477e4b86fc8c2a3b08d
SHA2560350eccb766d8475aa38048582c72b1a495d1d01da481b15cd7a62ab570b31d8
SHA512b49795679d0d8715250dc277a84bc8f4b165f971d8001b7b994b58cb19757e28f3061516cd2ced4230b84cb5f6dc6a2425025ca38d9fe9497d5eb5ed434474dc
-
Filesize
800KB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
8KB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
16.6MB
-
Filesize
4KB
-
Filesize
16.6MB
-
Filesize
8KB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
8KB
-
Filesize
800KB
-
Filesize
8KB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
800KB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
800KB
-
Filesize
16.6MB