Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
12-12-2024 09:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e5c5bf8c972a348457423451beec4895_JaffaCakes118.dll
Resource
win7-20240729-en
windows7-x64
17 signatures
150 seconds
General
-
Target
e5c5bf8c972a348457423451beec4895_JaffaCakes118.dll
-
Size
120KB
-
MD5
e5c5bf8c972a348457423451beec4895
-
SHA1
5ac90136aa63fee1a492233fc9876ed4021bc51e
-
SHA256
0b37361ab33f4f47df4293bce275871b62192a383276a016347bdc3733aedb04
-
SHA512
6a388818df375879db959e0742399c2ef296b7ce565ffd6886ae06d51bc2a74e8b77d1c9c6ac8bcbc8a75e96e00d069add199a7c5ce84920f8bb35d9b746ea62
-
SSDEEP
1536:F5UQkVwu3gZqgrEdpeuaygr/A2UnereFn0Nc2zVjCkxrC:F5HkauQU7dpehygZqe1Nc03O
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f773794.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f771bda.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f771bda.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f771bda.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f773794.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f773794.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f771bda.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f773794.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f771bda.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f771bda.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f773794.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f773794.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f773794.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f771bda.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f771bda.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f771bda.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f771bda.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f773794.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f773794.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f773794.exe -
Executes dropped EXE 3 IoCs
pid Process 2532 f771bda.exe 2596 f771dec.exe 2436 f773794.exe -
Loads dropped DLL 6 IoCs
pid Process 2672 rundll32.exe 2672 rundll32.exe 2672 rundll32.exe 2672 rundll32.exe 2672 rundll32.exe 2672 rundll32.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f771bda.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f771bda.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f773794.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f771bda.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f771bda.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f773794.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f773794.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f771bda.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f773794.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f771bda.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f771bda.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f773794.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f773794.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f773794.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f771bda.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f773794.exe -
Enumerates connected drives 3 TTPs 17 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\J: f771bda.exe File opened (read-only) \??\L: f771bda.exe File opened (read-only) \??\M: f771bda.exe File opened (read-only) \??\N: f771bda.exe File opened (read-only) \??\O: f771bda.exe File opened (read-only) \??\G: f771bda.exe File opened (read-only) \??\H: f771bda.exe File opened (read-only) \??\K: f771bda.exe File opened (read-only) \??\R: f771bda.exe File opened (read-only) \??\G: f773794.exe File opened (read-only) \??\E: f771bda.exe File opened (read-only) \??\I: f771bda.exe File opened (read-only) \??\P: f771bda.exe File opened (read-only) \??\Q: f771bda.exe File opened (read-only) \??\E: f773794.exe File opened (read-only) \??\S: f771bda.exe File opened (read-only) \??\T: f771bda.exe -
resource yara_rule behavioral1/memory/2532-11-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/2532-18-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/2532-16-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/2532-15-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/2532-21-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/2532-20-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/2532-19-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/2532-17-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/2532-14-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/2532-13-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/2532-58-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/2532-59-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/2532-60-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/2532-61-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/2532-62-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/2532-64-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/2532-65-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/2532-77-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/2532-78-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/2532-81-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/2532-82-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/2532-147-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/2436-149-0x00000000009B0000-0x0000000001A6A000-memory.dmp upx behavioral1/memory/2436-203-0x00000000009B0000-0x0000000001A6A000-memory.dmp upx -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\f771c28 f771bda.exe File opened for modification C:\Windows\SYSTEM.INI f771bda.exe File created C:\Windows\f776ca8 f773794.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f771bda.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f773794.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2532 f771bda.exe 2532 f771bda.exe 2436 f773794.exe -
Suspicious use of AdjustPrivilegeToken 45 IoCs
description pid Process Token: SeDebugPrivilege 2532 f771bda.exe Token: SeDebugPrivilege 2532 f771bda.exe Token: SeDebugPrivilege 2532 f771bda.exe Token: SeDebugPrivilege 2532 f771bda.exe Token: SeDebugPrivilege 2532 f771bda.exe Token: SeDebugPrivilege 2532 f771bda.exe Token: SeDebugPrivilege 2532 f771bda.exe Token: SeDebugPrivilege 2532 f771bda.exe Token: SeDebugPrivilege 2532 f771bda.exe Token: SeDebugPrivilege 2532 f771bda.exe Token: SeDebugPrivilege 2532 f771bda.exe Token: SeDebugPrivilege 2532 f771bda.exe Token: SeDebugPrivilege 2532 f771bda.exe Token: SeDebugPrivilege 2532 f771bda.exe Token: SeDebugPrivilege 2532 f771bda.exe Token: SeDebugPrivilege 2532 f771bda.exe Token: SeDebugPrivilege 2532 f771bda.exe Token: SeDebugPrivilege 2532 f771bda.exe Token: SeDebugPrivilege 2532 f771bda.exe Token: SeDebugPrivilege 2532 f771bda.exe Token: SeDebugPrivilege 2532 f771bda.exe Token: SeDebugPrivilege 2532 f771bda.exe Token: SeDebugPrivilege 2532 f771bda.exe Token: SeDebugPrivilege 2436 f773794.exe Token: SeDebugPrivilege 2436 f773794.exe Token: SeDebugPrivilege 2436 f773794.exe Token: SeDebugPrivilege 2436 f773794.exe Token: SeDebugPrivilege 2436 f773794.exe Token: SeDebugPrivilege 2436 f773794.exe Token: SeDebugPrivilege 2436 f773794.exe Token: SeDebugPrivilege 2436 f773794.exe Token: SeDebugPrivilege 2436 f773794.exe Token: SeDebugPrivilege 2436 f773794.exe Token: SeDebugPrivilege 2436 f773794.exe Token: SeDebugPrivilege 2436 f773794.exe Token: SeDebugPrivilege 2436 f773794.exe Token: SeDebugPrivilege 2436 f773794.exe Token: SeDebugPrivilege 2436 f773794.exe Token: SeDebugPrivilege 2436 f773794.exe Token: SeDebugPrivilege 2436 f773794.exe Token: SeDebugPrivilege 2436 f773794.exe Token: SeDebugPrivilege 2436 f773794.exe Token: SeDebugPrivilege 2436 f773794.exe Token: SeDebugPrivilege 2436 f773794.exe Token: SeDebugPrivilege 2436 f773794.exe -
Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 2188 wrote to memory of 2672 2188 rundll32.exe 30 PID 2188 wrote to memory of 2672 2188 rundll32.exe 30 PID 2188 wrote to memory of 2672 2188 rundll32.exe 30 PID 2188 wrote to memory of 2672 2188 rundll32.exe 30 PID 2188 wrote to memory of 2672 2188 rundll32.exe 30 PID 2188 wrote to memory of 2672 2188 rundll32.exe 30 PID 2188 wrote to memory of 2672 2188 rundll32.exe 30 PID 2672 wrote to memory of 2532 2672 rundll32.exe 31 PID 2672 wrote to memory of 2532 2672 rundll32.exe 31 PID 2672 wrote to memory of 2532 2672 rundll32.exe 31 PID 2672 wrote to memory of 2532 2672 rundll32.exe 31 PID 2532 wrote to memory of 1056 2532 f771bda.exe 17 PID 2532 wrote to memory of 1072 2532 f771bda.exe 19 PID 2532 wrote to memory of 1172 2532 f771bda.exe 21 PID 2532 wrote to memory of 1412 2532 f771bda.exe 25 PID 2532 wrote to memory of 2188 2532 f771bda.exe 29 PID 2532 wrote to memory of 2672 2532 f771bda.exe 30 PID 2532 wrote to memory of 2672 2532 f771bda.exe 30 PID 2672 wrote to memory of 2596 2672 rundll32.exe 32 PID 2672 wrote to memory of 2596 2672 rundll32.exe 32 PID 2672 wrote to memory of 2596 2672 rundll32.exe 32 PID 2672 wrote to memory of 2596 2672 rundll32.exe 32 PID 2672 wrote to memory of 2436 2672 rundll32.exe 33 PID 2672 wrote to memory of 2436 2672 rundll32.exe 33 PID 2672 wrote to memory of 2436 2672 rundll32.exe 33 PID 2672 wrote to memory of 2436 2672 rundll32.exe 33 PID 2532 wrote to memory of 1056 2532 f771bda.exe 17 PID 2532 wrote to memory of 1072 2532 f771bda.exe 19 PID 2532 wrote to memory of 1172 2532 f771bda.exe 21 PID 2532 wrote to memory of 1412 2532 f771bda.exe 25 PID 2532 wrote to memory of 2596 2532 f771bda.exe 32 PID 2532 wrote to memory of 2596 2532 f771bda.exe 32 PID 2532 wrote to memory of 2436 2532 f771bda.exe 33 PID 2532 wrote to memory of 2436 2532 f771bda.exe 33 PID 2436 wrote to memory of 1056 2436 f773794.exe 17 PID 2436 wrote to memory of 1072 2436 f773794.exe 19 PID 2436 wrote to memory of 1172 2436 f773794.exe 21 PID 2436 wrote to memory of 1412 2436 f773794.exe 25 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f771bda.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f773794.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1056
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1072
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1172
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e5c5bf8c972a348457423451beec4895_JaffaCakes118.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e5c5bf8c972a348457423451beec4895_JaffaCakes118.dll,#13⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\f771bda.exeC:\Users\Admin\AppData\Local\Temp\f771bda.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2532
-
-
C:\Users\Admin\AppData\Local\Temp\f771dec.exeC:\Users\Admin\AppData\Local\Temp\f771dec.exe4⤵
- Executes dropped EXE
PID:2596
-
-
C:\Users\Admin\AppData\Local\Temp\f773794.exeC:\Users\Admin\AppData\Local\Temp\f773794.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2436
-
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1412
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD5ce152a01f68f7c3ebafd77c1ad8ffcd9
SHA10bdb22d5e27d1b7e8469b1bcf666fba3c1de5a9a
SHA256c975a00c3327d5d13875f0a5f414c7408c376cfbdccbc8893ba1b951be038462
SHA5120d0d650af5b59c4f439bfb3c629a2f3ca9b7a0334e6ba6880c01bb4a950a0f56e5163c9293036f7b46a6a79b766bd1bb3eee254178e3a01399a05e15ccba35e4
-
Filesize
257B
MD55fa9b49c3d28a57b8a0830e099d44424
SHA1d8920d5271d33b83416a69aecc16bd2787c31857
SHA25650ba3c419c791adba5eb783d68d1d046f4b5544813aa7c98302095928848ab52
SHA5127b01c601c4510f8c8b7a21c825a62b3900e5c2aeb52e7c39cb089d56fa25fbf81f0f7cdaa923e4d901721bfb7a957138213f57ce4a16ab33ab2cff76b8573d10