Analysis
-
max time kernel
96s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
11-12-2024 14:07
General
-
Target
e1ce1f19c48d03d8e22a734dbd73b66b_JaffaCakes118.exe
-
Size
156KB
-
MD5
e1ce1f19c48d03d8e22a734dbd73b66b
-
SHA1
afc3bd7008db1e4c7c378c8f34c76f1eb0519c1a
-
SHA256
cdd200e616ced75e60ddd6ba7b58978900cb56f824011640ee313ac234a99370
-
SHA512
daed1d7ce753e4972f202c207838378c02ae36c877d62eb7c92bd1223c7ad7777a7be0659e603feb92c73e674465fd93871162525c84dbf671f3c4cafbe6b999
-
SSDEEP
3072:YkjAy4dDGkJ9vJYTJ/hbd/UDCi7XYbmRnSN67LYgb2bKSZ56/e:Y2cW9JblaCcnRx1KeSZae
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Sality
Sality is backdoor written in C++, first discovered in 2003.
-
Sality family
-
UAC bypass 3 TTPs 2 IoCs
-
Windows security bypass 2 TTPs 12 IoCs
-
Disables RegEdit via registry modification 2 IoCs
-
Disables Task Manager via registry modification
-
Modifies Windows Firewall 2 TTPs 2 IoCs
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 3 IoCs
-
Windows security modification 2 TTPs 14 IoCs
-
Checks whether UAC is enabled 1 TTPs 2 IoCs
-
UPX packed file 9 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
NSIS installer 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of WriteProcessMemory 40 IoCs
-
System policy modification 1 TTPs 2 IoCs
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\e1ce1f19c48d03d8e22a734dbd73b66b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e1ce1f19c48d03d8e22a734dbd73b66b_JaffaCakes118.exe"2⤵
- UAC bypass
- Windows security bypass
- Disables RegEdit via registry modification
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\netsh.exenetsh firewall set opmode disable3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe"C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\3⤵
- UAC bypass
- Windows security bypass
- Disables RegEdit via registry modification
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\netsh.exenetsh firewall set opmode disable4⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
84KB
MD5fa4ea61cd5dc0ff3182f45987f668a69
SHA159dc21f9a700b759ffaa00e504a840717e3acab7
SHA256137df35c950b8e6b0e8798fdf5250ae8b9132a9bfc2be5c0a41f1d633232b0e9
SHA512170e62c7b5333f1db139c422d9678ba736da1c0ca5223cfc5efdd45a69e743d8d4220aa9531747afc5fab74a01d0f9722526e52c33bb9e0df8a12dce771f4ab1
-
Filesize
13KB
MD5d765c492c21689e3d9d61634371fd861
SHA1ac200933671ae52c9d5544d0e2e8e9144d286c83
SHA256551e6042dd494ea01549555ffc194ab9729da09058ec714eb368dd06642c9bbc
SHA5129919a9e848c8f1e26c75d0d29207571e4b86a4140bd554743d2c1f8bd7f386fe4919345b163d89a5d907fb165e435ba0ac5f6b1101713636141f156a420e2e0f
-
Filesize
10KB
MD5fe24766ba314f620d57d0cf7339103c0
SHA18641545f03f03ff07485d6ec4d7b41cbb898c269
SHA256802ef71440f662f456bed6283a5ff78066af016897fe6bfd29cac6edc2967bbd
SHA51260d36959895cebf29c4e7713e6d414980139c7aa4ed1c8c96fefb672c1263af0ce909fb409534355895649c0e8056635112efb0da2ba05694446aec2ca77e2e3
-
Filesize
578B
MD5fd1501d060966570ae66c46c23b97c88
SHA18f4c871ec5755896a25a8289189c2bce24015719
SHA25630d7633e1b0457cfa6e24aecc48ebc7b14b5648c25517d80458e3e9f74cf9ea4
SHA512febed3503c354a075dd254908b250baa0aa6e49661ec8d00d3f926e84a73bcafc74e5a0a58a9f20a0b20221fbebc0777b35bcaa5b6e22a33e52990722eef45e6
-
Filesize
578B
MD545f51ad52f65c33a25978bba35a7d897
SHA16f3020c0ddc67ade24d0ee5af334031fd1eea15d
SHA256c0130763dd37c8c7c75db8afaa1880f2acb0658eaef24af8b97893851041c8ea
SHA512aa56d6785ce0ad40a241fd0801b5d77a6799c0293eeb73ec70e6b8bfb6eab32d7efeb9398820d4a28d566a4142dc02cb65bbc1265f0ceaecea37268680648dcc
-
Filesize
667B
MD5c3f75077fad789f0c0d1451d64f6a935
SHA1fdb19917cfcf2351d6abb9fb2dcd8646d0e1fa46
SHA2565d68fadcad4c328618fb1372bcdf4994bf94dc193a005acbcfc0f50ff537fb39
SHA512cd50ff74f38c9be72cca0a785ff8c6dbc9e1dd4238560dec2df5c55d61c5e70430599377d8a125d461b7767245c131dcaca2dc6e2038638144c61bdd61b5cefc
-
Filesize
156KB
MD5e1ce1f19c48d03d8e22a734dbd73b66b
SHA1afc3bd7008db1e4c7c378c8f34c76f1eb0519c1a
SHA256cdd200e616ced75e60ddd6ba7b58978900cb56f824011640ee313ac234a99370
SHA512daed1d7ce753e4972f202c207838378c02ae36c877d62eb7c92bd1223c7ad7777a7be0659e603feb92c73e674465fd93871162525c84dbf671f3c4cafbe6b999
-
Filesize
258B
MD5a8b27a8d5d528d88e908efa9625ac470
SHA16a456f695d3f837d9d7fd671e551aa7f28d9abb6
SHA2562a7d35963a4011cfe036c6be05142901dadea89c615dec5ca5d525eadeb3af90
SHA51261d1bab056d4f4404b237edd8a2d552bddff20a3da1b2715694c50a6f4879caecc9828b9ab6baab4c7f76364f15d3a9867b3a60d14e31ee2d501203decff2c88
-
Filesize
8KB
-
Filesize
324KB
-
Filesize
16.2MB
-
Filesize
16.2MB
-
Filesize
8KB
-
Filesize
324KB
-
Filesize
16.2MB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
16.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
16.2MB
-
Filesize
16.2MB
-
Filesize
8KB
-
Filesize
16.2MB
-
Filesize
16.2MB
-
Filesize
16.2MB
-
Filesize
324KB
-
Filesize
8KB
-
Filesize
324KB