Analysis
-
max time kernel
117s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
04/10/2024, 23:33
Static task
static1
Behavioral task
behavioral1
Sample
1551609732c061e08bdf8b0085d547be_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
1551609732c061e08bdf8b0085d547be_JaffaCakes118.exe
-
Size
172KB
-
MD5
1551609732c061e08bdf8b0085d547be
-
SHA1
947cad2d3e1d7eeac454db98581069bbf12f9179
-
SHA256
e2277f1336c11d78106a6bab6d179af5a99cce1c11a7ab19283b58305726c82c
-
SHA512
131096e7956c7b738abb3f054fad75e6d4985625f427ff368201be793340351ad7f0ad637915197b4c56cac3d88f1aa480be3152a2bd5d06d1e9278f4988ffa2
-
SSDEEP
3072:8kVD1BSqao9c3HwsanTdgyOxsP+f+lyDyFDVwnuqLEWj1AVAk2EUXW4:JSqjc3HsTaxoq/J3LEWj1MPUXW4
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Modifies firewall policy service 3 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 1551609732c061e08bdf8b0085d547be_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 1551609732c061e08bdf8b0085d547be_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 1551609732c061e08bdf8b0085d547be_JaffaCakes118.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 1551609732c061e08bdf8b0085d547be_JaffaCakes118.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 1551609732c061e08bdf8b0085d547be_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 1551609732c061e08bdf8b0085d547be_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 1551609732c061e08bdf8b0085d547be_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 1551609732c061e08bdf8b0085d547be_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 1551609732c061e08bdf8b0085d547be_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 1551609732c061e08bdf8b0085d547be_JaffaCakes118.exe -
Loads dropped DLL 2 IoCs
pid Process 1992 1551609732c061e08bdf8b0085d547be_JaffaCakes118.exe 1992 1551609732c061e08bdf8b0085d547be_JaffaCakes118.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 1551609732c061e08bdf8b0085d547be_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc 1551609732c061e08bdf8b0085d547be_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 1551609732c061e08bdf8b0085d547be_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 1551609732c061e08bdf8b0085d547be_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 1551609732c061e08bdf8b0085d547be_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 1551609732c061e08bdf8b0085d547be_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 1551609732c061e08bdf8b0085d547be_JaffaCakes118.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 1551609732c061e08bdf8b0085d547be_JaffaCakes118.exe -
resource yara_rule behavioral1/memory/1992-4-0x0000000000400000-0x0000000000425000-memory.dmp upx behavioral1/memory/1992-3-0x0000000000400000-0x0000000000425000-memory.dmp upx behavioral1/memory/1992-8-0x0000000000400000-0x0000000000425000-memory.dmp upx behavioral1/memory/1992-7-0x0000000000400000-0x0000000000425000-memory.dmp upx behavioral1/memory/1992-2-0x0000000000400000-0x0000000000425000-memory.dmp upx behavioral1/memory/1992-1-0x0000000000400000-0x0000000000425000-memory.dmp upx behavioral1/memory/1992-5-0x0000000002650000-0x00000000036DE000-memory.dmp upx behavioral1/memory/1992-13-0x0000000002650000-0x00000000036DE000-memory.dmp upx behavioral1/memory/1992-15-0x0000000002650000-0x00000000036DE000-memory.dmp upx behavioral1/memory/1992-11-0x0000000002650000-0x00000000036DE000-memory.dmp upx behavioral1/memory/1992-17-0x0000000002650000-0x00000000036DE000-memory.dmp upx behavioral1/memory/1992-16-0x0000000002650000-0x00000000036DE000-memory.dmp upx behavioral1/memory/1992-14-0x0000000002650000-0x00000000036DE000-memory.dmp upx behavioral1/memory/1992-12-0x0000000002650000-0x00000000036DE000-memory.dmp upx behavioral1/memory/1992-21-0x0000000000400000-0x0000000000425000-memory.dmp upx behavioral1/memory/1992-19-0x0000000002650000-0x00000000036DE000-memory.dmp upx behavioral1/memory/1992-48-0x0000000000400000-0x0000000000425000-memory.dmp upx behavioral1/memory/1992-61-0x0000000002650000-0x00000000036DE000-memory.dmp upx -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI 1551609732c061e08bdf8b0085d547be_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1551609732c061e08bdf8b0085d547be_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1992 1551609732c061e08bdf8b0085d547be_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 23 IoCs
description pid Process Token: SeDebugPrivilege 1992 1551609732c061e08bdf8b0085d547be_JaffaCakes118.exe Token: SeDebugPrivilege 1992 1551609732c061e08bdf8b0085d547be_JaffaCakes118.exe Token: SeDebugPrivilege 1992 1551609732c061e08bdf8b0085d547be_JaffaCakes118.exe Token: SeDebugPrivilege 1992 1551609732c061e08bdf8b0085d547be_JaffaCakes118.exe Token: SeDebugPrivilege 1992 1551609732c061e08bdf8b0085d547be_JaffaCakes118.exe Token: SeDebugPrivilege 1992 1551609732c061e08bdf8b0085d547be_JaffaCakes118.exe Token: SeDebugPrivilege 1992 1551609732c061e08bdf8b0085d547be_JaffaCakes118.exe Token: SeDebugPrivilege 1992 1551609732c061e08bdf8b0085d547be_JaffaCakes118.exe Token: SeDebugPrivilege 1992 1551609732c061e08bdf8b0085d547be_JaffaCakes118.exe Token: SeDebugPrivilege 1992 1551609732c061e08bdf8b0085d547be_JaffaCakes118.exe Token: SeDebugPrivilege 1992 1551609732c061e08bdf8b0085d547be_JaffaCakes118.exe Token: SeDebugPrivilege 1992 1551609732c061e08bdf8b0085d547be_JaffaCakes118.exe Token: SeDebugPrivilege 1992 1551609732c061e08bdf8b0085d547be_JaffaCakes118.exe Token: SeDebugPrivilege 1992 1551609732c061e08bdf8b0085d547be_JaffaCakes118.exe Token: SeDebugPrivilege 1992 1551609732c061e08bdf8b0085d547be_JaffaCakes118.exe Token: SeDebugPrivilege 1992 1551609732c061e08bdf8b0085d547be_JaffaCakes118.exe Token: SeDebugPrivilege 1992 1551609732c061e08bdf8b0085d547be_JaffaCakes118.exe Token: SeDebugPrivilege 1992 1551609732c061e08bdf8b0085d547be_JaffaCakes118.exe Token: SeDebugPrivilege 1992 1551609732c061e08bdf8b0085d547be_JaffaCakes118.exe Token: SeDebugPrivilege 1992 1551609732c061e08bdf8b0085d547be_JaffaCakes118.exe Token: SeDebugPrivilege 1992 1551609732c061e08bdf8b0085d547be_JaffaCakes118.exe Token: SeDebugPrivilege 1992 1551609732c061e08bdf8b0085d547be_JaffaCakes118.exe Token: SeDebugPrivilege 1992 1551609732c061e08bdf8b0085d547be_JaffaCakes118.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 1992 1551609732c061e08bdf8b0085d547be_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1992 wrote to memory of 1116 1992 1551609732c061e08bdf8b0085d547be_JaffaCakes118.exe 19 PID 1992 wrote to memory of 1176 1992 1551609732c061e08bdf8b0085d547be_JaffaCakes118.exe 20 PID 1992 wrote to memory of 1232 1992 1551609732c061e08bdf8b0085d547be_JaffaCakes118.exe 21 PID 1992 wrote to memory of 1316 1992 1551609732c061e08bdf8b0085d547be_JaffaCakes118.exe 25 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 1551609732c061e08bdf8b0085d547be_JaffaCakes118.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1116
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1176
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1232
-
C:\Users\Admin\AppData\Local\Temp\1551609732c061e08bdf8b0085d547be_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1551609732c061e08bdf8b0085d547be_JaffaCakes118.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Loads dropped DLL
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1992 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"3⤵PID:2648
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1316
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD5d124f55b9393c976963407dff51ffa79
SHA12c7bbedd79791bfb866898c85b504186db610b5d
SHA256ea1e16247c848c8c171c4cd1fa17bc5a018a1fcb0c0dac25009066b6667b8eef
SHA512278fe3a4b1fbbe700e4f4483b610133e975e36e101455661d5197bd892a68839b9d555499040d200c92aefa9e3819380e395c0cd85d5fc845c6364d128a8cf06
-
Filesize
1.1MB
MD59b98d47916ead4f69ef51b56b0c2323c
SHA1290a80b4ded0efc0fd00816f373fcea81a521330
SHA25696e0ae104c9662d0d20fdf59844c2d18334e5847b6c4fc7f8ce4b3b87f39887b
SHA51268b67021f228d8d71df4deb0b6388558b2f935a6aa466a12199cd37ada47ee588ea407b278d190d3a498b0ef3f5f1a2573a469b7ea5561ab2e7055c45565fe94