Analysis
-
max time kernel
95s -
max time network
99s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
12-12-2024 05:57
General
-
Target
e5018ddddb28a436a5f47fe40d1cd2ed_JaffaCakes118.exe
-
Size
611KB
-
MD5
e5018ddddb28a436a5f47fe40d1cd2ed
-
SHA1
4088c0fcfba862ff07c7ac920b7cc5cbb0cf07db
-
SHA256
eb99d0cafee39055ea3bfab8f8cda0043590ab6b0ef23ba55fbdc6527c03ed8e
-
SHA512
55a35ebecdba88b9e879f80b8e7ae6a7bd799d7f51202c545861ba2adf5315b0b4f9cb183aff84416742c98ccba1c1b23b337093af2d49a1d94cde8273f5c92c
-
SSDEEP
12288:kSbAM3zZtweKD9pHncpLIS43zVt+X8EXUhbslQYLVlPg9L0UqVRGA:kSM2NtN4wJ43zvaU5uLVR0YJGA
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
http://klkjwre77638dfqwieuoi888.info/
Signatures
-
Modifies firewall policy service 3 TTPs 3 IoCs
-
Sality
Sality is backdoor written in C++, first discovered in 2003.
-
Sality family
-
UAC bypass 3 TTPs 1 IoCs
-
Windows security bypass 2 TTPs 6 IoCs
-
Disables RegEdit via registry modification 1 IoCs
-
Disables Task Manager via registry modification
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 3 IoCs
-
Windows security modification 2 TTPs 7 IoCs
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
UPX packed file 13 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of WriteProcessMemory 35 IoCs
-
System policy modification 1 TTPs 1 IoCs
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\e5018ddddb28a436a5f47fe40d1cd2ed_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e5018ddddb28a436a5f47fe40d1cd2ed_JaffaCakes118.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Disables RegEdit via registry modification
- Loads dropped DLL
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
\??\c:\b664c4d075fca462831664d4a6e9ee\update\update.exec:\b664c4d075fca462831664d4a6e9ee\update\update.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
539KB
MD58706f6910e0022bf4a7e5cbeed66aece
SHA11ec5258de785e380d2eb9c8634f64e736d929618
SHA256f150618a2489870ca9f65a87fd703bde3929079c5dc903bed4982c7497ba53ef
SHA512c923a97b8143b31781c6e85bdf7163fdd47871eb0a95db74be0ec200e4043608a927aeb8bd63efb2138eb030f6663127720f1768c80db14d604ed49f8a4bc345
-
Filesize
25KB
MD5ee207e35aea4d5df41d90221e1b66efa
SHA1757469cf9ad2f21f267bbe730560114fdf8a89a5
SHA256cf64c95e9a2d02967efc22b00efb3736156b913a95231eb63c1df45d43475e64
SHA51243e9f75725daa4f3428b2d9cee2c2cc8b2f2e991b8e58d72d2f429fbdfb614c86d172f03d3f9da98756bd4e245643d9a57c6efa422d6c60ad364a2322245542d
-
Filesize
737KB
MD50ff4e4e0dd01e7872d9c2013560fd4a7
SHA1f6a3aa7d551c99c3e9c00c9592c2be1b1cf1a81a
SHA256fadc30d8a636762c424ff4f49d528f22d59c46c20c24c5c4b73badb4deb5e8a1
SHA5128e154e66b6949e93532052a15762db2cbcf9d8dbfce9ef18ae2adcfd126974240716220151d1e59347fb4f094da7ab31701b32d3fdc5726c2da098154319a0b6
-
Filesize
373KB
MD58d13dfd9d7351b2da87ca237277b6cf3
SHA1a9ef7f91183857ae6dba937f9f95282f6c590a9d
SHA256dc2beb43cefa8840d3ac7d622079870f247f97a205a52cb4794b1d688c155463
SHA512d11eee63de309e2b81a92fa9c72a11c1a587e4491214e1d45ad20cba3677ebf99bf98483bbc7f579d5f830e4ca7473d532abc1c6dd7c64ad455e0cd1bcc9a792
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
688KB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
688KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
16.6MB
-
Filesize
688KB
-
Filesize
688KB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
8KB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
8KB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
376KB