Analysis
-
max time kernel
93s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
04/10/2024, 23:33
Static task
static1
Behavioral task
behavioral1
Sample
1551609732c061e08bdf8b0085d547be_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
1551609732c061e08bdf8b0085d547be_JaffaCakes118.exe
-
Size
172KB
-
MD5
1551609732c061e08bdf8b0085d547be
-
SHA1
947cad2d3e1d7eeac454db98581069bbf12f9179
-
SHA256
e2277f1336c11d78106a6bab6d179af5a99cce1c11a7ab19283b58305726c82c
-
SHA512
131096e7956c7b738abb3f054fad75e6d4985625f427ff368201be793340351ad7f0ad637915197b4c56cac3d88f1aa480be3152a2bd5d06d1e9278f4988ffa2
-
SSDEEP
3072:8kVD1BSqao9c3HwsanTdgyOxsP+f+lyDyFDVwnuqLEWj1AVAk2EUXW4:JSqjc3HsTaxoq/J3LEWj1MPUXW4
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Modifies firewall policy service 3 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 1551609732c061e08bdf8b0085d547be_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 1551609732c061e08bdf8b0085d547be_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 1551609732c061e08bdf8b0085d547be_JaffaCakes118.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 1551609732c061e08bdf8b0085d547be_JaffaCakes118.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 1551609732c061e08bdf8b0085d547be_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 1551609732c061e08bdf8b0085d547be_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 1551609732c061e08bdf8b0085d547be_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 1551609732c061e08bdf8b0085d547be_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 1551609732c061e08bdf8b0085d547be_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 1551609732c061e08bdf8b0085d547be_JaffaCakes118.exe -
Loads dropped DLL 1 IoCs
pid Process 2216 1551609732c061e08bdf8b0085d547be_JaffaCakes118.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 1551609732c061e08bdf8b0085d547be_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 1551609732c061e08bdf8b0085d547be_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 1551609732c061e08bdf8b0085d547be_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 1551609732c061e08bdf8b0085d547be_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 1551609732c061e08bdf8b0085d547be_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 1551609732c061e08bdf8b0085d547be_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc 1551609732c061e08bdf8b0085d547be_JaffaCakes118.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 1551609732c061e08bdf8b0085d547be_JaffaCakes118.exe -
resource yara_rule behavioral2/memory/2216-3-0x0000000000400000-0x0000000000425000-memory.dmp upx behavioral2/memory/2216-8-0x00000000035C0000-0x000000000464E000-memory.dmp upx behavioral2/memory/2216-1-0x00000000035C0000-0x000000000464E000-memory.dmp upx behavioral2/memory/2216-5-0x0000000000400000-0x0000000000425000-memory.dmp upx behavioral2/memory/2216-4-0x0000000000400000-0x0000000000425000-memory.dmp upx behavioral2/memory/2216-2-0x0000000000400000-0x0000000000425000-memory.dmp upx behavioral2/memory/2216-10-0x00000000035C0000-0x000000000464E000-memory.dmp upx behavioral2/memory/2216-9-0x00000000035C0000-0x000000000464E000-memory.dmp upx behavioral2/memory/2216-18-0x00000000035C0000-0x000000000464E000-memory.dmp upx behavioral2/memory/2216-17-0x0000000000400000-0x0000000000425000-memory.dmp upx behavioral2/memory/2216-13-0x0000000000400000-0x0000000000425000-memory.dmp upx behavioral2/memory/2216-12-0x0000000000400000-0x0000000000425000-memory.dmp upx behavioral2/memory/2216-26-0x00000000035C0000-0x000000000464E000-memory.dmp upx -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI 1551609732c061e08bdf8b0085d547be_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1551609732c061e08bdf8b0085d547be_JaffaCakes118.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 2216 1551609732c061e08bdf8b0085d547be_JaffaCakes118.exe -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 1551609732c061e08bdf8b0085d547be_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1551609732c061e08bdf8b0085d547be_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1551609732c061e08bdf8b0085d547be_JaffaCakes118.exe"1⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Loads dropped DLL
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of UnmapMainImage
- System policy modification
PID:2216
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.6MB
MD54f3387277ccbd6d1f21ac5c07fe4ca68
SHA1e16506f662dc92023bf82def1d621497c8ab5890
SHA256767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac
SHA5129da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219