General
-
Target
826ffbb21d2b094333b01d7f74ed7173_JaffaCakes118
-
Size
100KB
-
Sample
241031-j9n26asqd1
-
MD5
826ffbb21d2b094333b01d7f74ed7173
-
SHA1
2ddd93266b542224779256f3c8d69c1701bcd9a5
-
SHA256
146ed5812eb48e57295282e3e20761b524b8660e89cc3ad25109849dc73d19a2
-
SHA512
e0271fdde87512c4f9223f7cee55c564a91c5be25f8df6b254bd016c3f12577c64ef17b3dd04014be128287f07b8c868c32cc46a9c58cbfd15d7fc18a8300f17
-
SSDEEP
1536:6zYXLMT35z1CWtJ+Y7q2GnWJlxbYagk6Ci+z3o:8YoTJZCiJ+Y7snWJlxAQ
Static task
static1
Behavioral task
behavioral1
Sample
826ffbb21d2b094333b01d7f74ed7173_JaffaCakes118.exe
Resource
win7-20241010-en
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Targets
-
-
Target
826ffbb21d2b094333b01d7f74ed7173_JaffaCakes118
-
Size
100KB
-
MD5
826ffbb21d2b094333b01d7f74ed7173
-
SHA1
2ddd93266b542224779256f3c8d69c1701bcd9a5
-
SHA256
146ed5812eb48e57295282e3e20761b524b8660e89cc3ad25109849dc73d19a2
-
SHA512
e0271fdde87512c4f9223f7cee55c564a91c5be25f8df6b254bd016c3f12577c64ef17b3dd04014be128287f07b8c868c32cc46a9c58cbfd15d7fc18a8300f17
-
SSDEEP
1536:6zYXLMT35z1CWtJ+Y7q2GnWJlxbYagk6Ci+z3o:8YoTJZCiJ+Y7snWJlxAQ
-
Modifies firewall policy service
-
Sality family
-
Disables RegEdit via registry modification
-
Disables Task Manager via registry modification
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5