General
-
Target
ca53d50aeb4b2178f917eff9ded05779_JaffaCakes118
-
Size
100KB
-
Sample
241206-bnwk4ssmay
-
MD5
ca53d50aeb4b2178f917eff9ded05779
-
SHA1
4f0c3bc006e30a3523d283b46786b121f24e960d
-
SHA256
cd7e3e8a72e2110b4262d30915047850e609a4a8d2fca5c1e0b1b538901d98b4
-
SHA512
1ac1261debdf9089f24ada1065f36dd2e6397f34cb612dfdf7a28ab0fc010ead96abc98da48892cc85459db5b3e2f2c1d03b9403cb1ee2bce886e00e0c1bbf0b
-
SSDEEP
1536:WVPM4X/HAkUExRx/ns0KHC3M7MUZ7moGZufvetV0Pv//kUG5lBtKTMI40/Jhbgs3:u0KgkUExPPaHC30GZufvQuf/mtKrGUd
Static task
static1
Behavioral task
behavioral1
Sample
ca53d50aeb4b2178f917eff9ded05779_JaffaCakes118.exe
Resource
win7-20240903-en
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Targets
-
-
Target
ca53d50aeb4b2178f917eff9ded05779_JaffaCakes118
-
Size
100KB
-
MD5
ca53d50aeb4b2178f917eff9ded05779
-
SHA1
4f0c3bc006e30a3523d283b46786b121f24e960d
-
SHA256
cd7e3e8a72e2110b4262d30915047850e609a4a8d2fca5c1e0b1b538901d98b4
-
SHA512
1ac1261debdf9089f24ada1065f36dd2e6397f34cb612dfdf7a28ab0fc010ead96abc98da48892cc85459db5b3e2f2c1d03b9403cb1ee2bce886e00e0c1bbf0b
-
SSDEEP
1536:WVPM4X/HAkUExRx/ns0KHC3M7MUZ7moGZufvetV0Pv//kUG5lBtKTMI40/Jhbgs3:u0KgkUExPPaHC30GZufvQuf/mtKrGUd
-
Modifies firewall policy service
-
Sality family
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5