Analysis
-
max time kernel
118s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
17/08/2024, 08:07
Behavioral task
behavioral1
Sample
a1c742d866027990e6cbdd94c4375b76_JaffaCakes118.exe
Resource
win7-20240704-en
windows7-x64
14 signatures
150 seconds
General
-
Target
a1c742d866027990e6cbdd94c4375b76_JaffaCakes118.exe
-
Size
115KB
-
MD5
a1c742d866027990e6cbdd94c4375b76
-
SHA1
284e0248453e1da0363660916f6fda89dd408db8
-
SHA256
d92f7d3539b7a8fbc0820d4b532d8f1c1c2df33f91066c60a2aa3fdc634b0e12
-
SHA512
fcc179ad8550240e6659353fb65eaab49e92e4562650ff2a2879e8ec1cf63280d014de12d17994266b2b3cc1ed1d53e81026337e4c4f8314f6b8b3bab0681d82
-
SSDEEP
3072:ynaRp18AmwacnSIoZAk+hXl7l51CfyU15K1WuW+AM:ynaJjaR3+zhVRCfyr1WR
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Modifies firewall policy service 3 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" a1c742d866027990e6cbdd94c4375b76_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" a1c742d866027990e6cbdd94c4375b76_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" a1c742d866027990e6cbdd94c4375b76_JaffaCakes118.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" a1c742d866027990e6cbdd94c4375b76_JaffaCakes118.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" a1c742d866027990e6cbdd94c4375b76_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" a1c742d866027990e6cbdd94c4375b76_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" a1c742d866027990e6cbdd94c4375b76_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" a1c742d866027990e6cbdd94c4375b76_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" a1c742d866027990e6cbdd94c4375b76_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" a1c742d866027990e6cbdd94c4375b76_JaffaCakes118.exe -
resource yara_rule behavioral1/memory/2656-0-0x0000000031420000-0x0000000031444000-memory.dmp upx behavioral1/memory/2656-7-0x0000000001E80000-0x0000000002F0E000-memory.dmp upx behavioral1/memory/2656-6-0x0000000031420000-0x0000000031444000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" a1c742d866027990e6cbdd94c4375b76_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" a1c742d866027990e6cbdd94c4375b76_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" a1c742d866027990e6cbdd94c4375b76_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" a1c742d866027990e6cbdd94c4375b76_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" a1c742d866027990e6cbdd94c4375b76_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" a1c742d866027990e6cbdd94c4375b76_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc a1c742d866027990e6cbdd94c4375b76_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\ctqzgdji.exe" a1c742d866027990e6cbdd94c4375b76_JaffaCakes118.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" a1c742d866027990e6cbdd94c4375b76_JaffaCakes118.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\ctqzgdji.exe a1c742d866027990e6cbdd94c4375b76_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\ctqzgdji.exe a1c742d866027990e6cbdd94c4375b76_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2656 a1c742d866027990e6cbdd94c4375b76_JaffaCakes118.exe -
Suspicious behavior: MapViewOfSection 23 IoCs
pid Process 2656 a1c742d866027990e6cbdd94c4375b76_JaffaCakes118.exe 2656 a1c742d866027990e6cbdd94c4375b76_JaffaCakes118.exe 2656 a1c742d866027990e6cbdd94c4375b76_JaffaCakes118.exe 2656 a1c742d866027990e6cbdd94c4375b76_JaffaCakes118.exe 2656 a1c742d866027990e6cbdd94c4375b76_JaffaCakes118.exe 2656 a1c742d866027990e6cbdd94c4375b76_JaffaCakes118.exe 2656 a1c742d866027990e6cbdd94c4375b76_JaffaCakes118.exe 2656 a1c742d866027990e6cbdd94c4375b76_JaffaCakes118.exe 2656 a1c742d866027990e6cbdd94c4375b76_JaffaCakes118.exe 2656 a1c742d866027990e6cbdd94c4375b76_JaffaCakes118.exe 2656 a1c742d866027990e6cbdd94c4375b76_JaffaCakes118.exe 2656 a1c742d866027990e6cbdd94c4375b76_JaffaCakes118.exe 2656 a1c742d866027990e6cbdd94c4375b76_JaffaCakes118.exe 2656 a1c742d866027990e6cbdd94c4375b76_JaffaCakes118.exe 2656 a1c742d866027990e6cbdd94c4375b76_JaffaCakes118.exe 2656 a1c742d866027990e6cbdd94c4375b76_JaffaCakes118.exe 2656 a1c742d866027990e6cbdd94c4375b76_JaffaCakes118.exe 2656 a1c742d866027990e6cbdd94c4375b76_JaffaCakes118.exe 2656 a1c742d866027990e6cbdd94c4375b76_JaffaCakes118.exe 2656 a1c742d866027990e6cbdd94c4375b76_JaffaCakes118.exe 2656 a1c742d866027990e6cbdd94c4375b76_JaffaCakes118.exe 2656 a1c742d866027990e6cbdd94c4375b76_JaffaCakes118.exe 2656 a1c742d866027990e6cbdd94c4375b76_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2656 a1c742d866027990e6cbdd94c4375b76_JaffaCakes118.exe Token: SeDebugPrivilege 2656 a1c742d866027990e6cbdd94c4375b76_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2656 wrote to memory of 384 2656 a1c742d866027990e6cbdd94c4375b76_JaffaCakes118.exe 3 PID 2656 wrote to memory of 384 2656 a1c742d866027990e6cbdd94c4375b76_JaffaCakes118.exe 3 PID 2656 wrote to memory of 384 2656 a1c742d866027990e6cbdd94c4375b76_JaffaCakes118.exe 3 PID 2656 wrote to memory of 384 2656 a1c742d866027990e6cbdd94c4375b76_JaffaCakes118.exe 3 PID 2656 wrote to memory of 384 2656 a1c742d866027990e6cbdd94c4375b76_JaffaCakes118.exe 3 PID 2656 wrote to memory of 384 2656 a1c742d866027990e6cbdd94c4375b76_JaffaCakes118.exe 3 PID 2656 wrote to memory of 384 2656 a1c742d866027990e6cbdd94c4375b76_JaffaCakes118.exe 3 PID 2656 wrote to memory of 396 2656 a1c742d866027990e6cbdd94c4375b76_JaffaCakes118.exe 4 PID 2656 wrote to memory of 396 2656 a1c742d866027990e6cbdd94c4375b76_JaffaCakes118.exe 4 PID 2656 wrote to memory of 396 2656 a1c742d866027990e6cbdd94c4375b76_JaffaCakes118.exe 4 PID 2656 wrote to memory of 396 2656 a1c742d866027990e6cbdd94c4375b76_JaffaCakes118.exe 4 PID 2656 wrote to memory of 396 2656 a1c742d866027990e6cbdd94c4375b76_JaffaCakes118.exe 4 PID 2656 wrote to memory of 396 2656 a1c742d866027990e6cbdd94c4375b76_JaffaCakes118.exe 4 PID 2656 wrote to memory of 396 2656 a1c742d866027990e6cbdd94c4375b76_JaffaCakes118.exe 4 PID 2656 wrote to memory of 432 2656 a1c742d866027990e6cbdd94c4375b76_JaffaCakes118.exe 5 PID 2656 wrote to memory of 432 2656 a1c742d866027990e6cbdd94c4375b76_JaffaCakes118.exe 5 PID 2656 wrote to memory of 432 2656 a1c742d866027990e6cbdd94c4375b76_JaffaCakes118.exe 5 PID 2656 wrote to memory of 432 2656 a1c742d866027990e6cbdd94c4375b76_JaffaCakes118.exe 5 PID 2656 wrote to memory of 432 2656 a1c742d866027990e6cbdd94c4375b76_JaffaCakes118.exe 5 PID 2656 wrote to memory of 432 2656 a1c742d866027990e6cbdd94c4375b76_JaffaCakes118.exe 5 PID 2656 wrote to memory of 432 2656 a1c742d866027990e6cbdd94c4375b76_JaffaCakes118.exe 5 PID 2656 wrote to memory of 476 2656 a1c742d866027990e6cbdd94c4375b76_JaffaCakes118.exe 6 PID 2656 wrote to memory of 476 2656 a1c742d866027990e6cbdd94c4375b76_JaffaCakes118.exe 6 PID 2656 wrote to memory of 476 2656 a1c742d866027990e6cbdd94c4375b76_JaffaCakes118.exe 6 PID 2656 wrote to memory of 476 2656 a1c742d866027990e6cbdd94c4375b76_JaffaCakes118.exe 6 PID 2656 wrote to memory of 476 2656 a1c742d866027990e6cbdd94c4375b76_JaffaCakes118.exe 6 PID 2656 wrote to memory of 476 2656 a1c742d866027990e6cbdd94c4375b76_JaffaCakes118.exe 6 PID 2656 wrote to memory of 476 2656 a1c742d866027990e6cbdd94c4375b76_JaffaCakes118.exe 6 PID 2656 wrote to memory of 492 2656 a1c742d866027990e6cbdd94c4375b76_JaffaCakes118.exe 7 PID 2656 wrote to memory of 492 2656 a1c742d866027990e6cbdd94c4375b76_JaffaCakes118.exe 7 PID 2656 wrote to memory of 492 2656 a1c742d866027990e6cbdd94c4375b76_JaffaCakes118.exe 7 PID 2656 wrote to memory of 492 2656 a1c742d866027990e6cbdd94c4375b76_JaffaCakes118.exe 7 PID 2656 wrote to memory of 492 2656 a1c742d866027990e6cbdd94c4375b76_JaffaCakes118.exe 7 PID 2656 wrote to memory of 492 2656 a1c742d866027990e6cbdd94c4375b76_JaffaCakes118.exe 7 PID 2656 wrote to memory of 492 2656 a1c742d866027990e6cbdd94c4375b76_JaffaCakes118.exe 7 PID 2656 wrote to memory of 500 2656 a1c742d866027990e6cbdd94c4375b76_JaffaCakes118.exe 8 PID 2656 wrote to memory of 500 2656 a1c742d866027990e6cbdd94c4375b76_JaffaCakes118.exe 8 PID 2656 wrote to memory of 500 2656 a1c742d866027990e6cbdd94c4375b76_JaffaCakes118.exe 8 PID 2656 wrote to memory of 500 2656 a1c742d866027990e6cbdd94c4375b76_JaffaCakes118.exe 8 PID 2656 wrote to memory of 500 2656 a1c742d866027990e6cbdd94c4375b76_JaffaCakes118.exe 8 PID 2656 wrote to memory of 500 2656 a1c742d866027990e6cbdd94c4375b76_JaffaCakes118.exe 8 PID 2656 wrote to memory of 500 2656 a1c742d866027990e6cbdd94c4375b76_JaffaCakes118.exe 8 PID 2656 wrote to memory of 596 2656 a1c742d866027990e6cbdd94c4375b76_JaffaCakes118.exe 9 PID 2656 wrote to memory of 596 2656 a1c742d866027990e6cbdd94c4375b76_JaffaCakes118.exe 9 PID 2656 wrote to memory of 596 2656 a1c742d866027990e6cbdd94c4375b76_JaffaCakes118.exe 9 PID 2656 wrote to memory of 596 2656 a1c742d866027990e6cbdd94c4375b76_JaffaCakes118.exe 9 PID 2656 wrote to memory of 596 2656 a1c742d866027990e6cbdd94c4375b76_JaffaCakes118.exe 9 PID 2656 wrote to memory of 596 2656 a1c742d866027990e6cbdd94c4375b76_JaffaCakes118.exe 9 PID 2656 wrote to memory of 596 2656 a1c742d866027990e6cbdd94c4375b76_JaffaCakes118.exe 9 PID 2656 wrote to memory of 672 2656 a1c742d866027990e6cbdd94c4375b76_JaffaCakes118.exe 10 PID 2656 wrote to memory of 672 2656 a1c742d866027990e6cbdd94c4375b76_JaffaCakes118.exe 10 PID 2656 wrote to memory of 672 2656 a1c742d866027990e6cbdd94c4375b76_JaffaCakes118.exe 10 PID 2656 wrote to memory of 672 2656 a1c742d866027990e6cbdd94c4375b76_JaffaCakes118.exe 10 PID 2656 wrote to memory of 672 2656 a1c742d866027990e6cbdd94c4375b76_JaffaCakes118.exe 10 PID 2656 wrote to memory of 672 2656 a1c742d866027990e6cbdd94c4375b76_JaffaCakes118.exe 10 PID 2656 wrote to memory of 672 2656 a1c742d866027990e6cbdd94c4375b76_JaffaCakes118.exe 10 PID 2656 wrote to memory of 752 2656 a1c742d866027990e6cbdd94c4375b76_JaffaCakes118.exe 11 PID 2656 wrote to memory of 752 2656 a1c742d866027990e6cbdd94c4375b76_JaffaCakes118.exe 11 PID 2656 wrote to memory of 752 2656 a1c742d866027990e6cbdd94c4375b76_JaffaCakes118.exe 11 PID 2656 wrote to memory of 752 2656 a1c742d866027990e6cbdd94c4375b76_JaffaCakes118.exe 11 PID 2656 wrote to memory of 752 2656 a1c742d866027990e6cbdd94c4375b76_JaffaCakes118.exe 11 PID 2656 wrote to memory of 752 2656 a1c742d866027990e6cbdd94c4375b76_JaffaCakes118.exe 11 PID 2656 wrote to memory of 752 2656 a1c742d866027990e6cbdd94c4375b76_JaffaCakes118.exe 11 PID 2656 wrote to memory of 812 2656 a1c742d866027990e6cbdd94c4375b76_JaffaCakes118.exe 12 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" a1c742d866027990e6cbdd94c4375b76_JaffaCakes118.exe
Processes
-
C:\Windows\system32\wininit.exewininit.exe1⤵PID:384
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe2⤵PID:476
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch3⤵PID:596
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}4⤵PID:2008
-
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe4⤵PID:1532
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS3⤵PID:672
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted3⤵PID:752
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted3⤵PID:812
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"4⤵PID:1116
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs3⤵PID:860
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService3⤵PID:976
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService3⤵PID:272
-
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe3⤵PID:1036
-
-
C:\Windows\system32\taskhost.exe"taskhost.exe"3⤵PID:1056
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork3⤵PID:1136
-
-
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"3⤵PID:1340
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation3⤵PID:2132
-
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe3⤵PID:2188
-
-
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe2⤵PID:492
-
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe2⤵PID:500
-
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵PID:396
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:432
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1164
-
C:\Users\Admin\AppData\Local\Temp\a1c742d866027990e6cbdd94c4375b76_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a1c742d866027990e6cbdd94c4375b76_JaffaCakes118.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2656
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1