Analysis

  • max time kernel
    121s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    13/12/2024, 06:13 UTC

General

  • Target

    ea460c4a2450ec14303121428373edde_JaffaCakes118.dll

  • Size

    120KB

  • MD5

    ea460c4a2450ec14303121428373edde

  • SHA1

    47f567b5828584b50d312fcaf9361605359a187d

  • SHA256

    58f1a7cc1e5eb288c17d9964c3022f43863cac9ccf4b7374aedc90884fdd5636

  • SHA512

    29fbede23abd82210ec6fe15493d2141b1f614ea86debe2349e1a5584f55031e41677d51cd7810babaf58558816a2d33e5df5bba831d31f7aed4b17ce96cb1ff

  • SSDEEP

    3072:5toYSkw47n4GxHN17PZLoWdcYvw+ExYfz5Sh:5tHn4wHNVVld8+E+z0h

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Signatures

  • Modifies firewall policy service 3 TTPs 6 IoCs
  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

  • Sality family
  • UAC bypass 3 TTPs 2 IoCs
  • Windows security bypass 2 TTPs 12 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 6 IoCs
  • Windows security modification 2 TTPs 14 IoCs
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
  • Enumerates connected drives 3 TTPs 17 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file 23 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Windows directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 46 IoCs
  • Suspicious use of WriteProcessMemory 38 IoCs
  • System policy modification 1 TTPs 2 IoCs

Processes

  • C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    1⤵
      PID:1112
    • C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      1⤵
        PID:1168
      • C:\Windows\Explorer.EXE
        C:\Windows\Explorer.EXE
        1⤵
          PID:1208
          • C:\Windows\system32\rundll32.exe
            rundll32.exe C:\Users\Admin\AppData\Local\Temp\ea460c4a2450ec14303121428373edde_JaffaCakes118.dll,#1
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:1804
            • C:\Windows\SysWOW64\rundll32.exe
              rundll32.exe C:\Users\Admin\AppData\Local\Temp\ea460c4a2450ec14303121428373edde_JaffaCakes118.dll,#1
              3⤵
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2192
              • C:\Users\Admin\AppData\Local\Temp\f76951e.exe
                C:\Users\Admin\AppData\Local\Temp\f76951e.exe
                4⤵
                • Modifies firewall policy service
                • UAC bypass
                • Windows security bypass
                • Executes dropped EXE
                • Windows security modification
                • Checks whether UAC is enabled
                • Enumerates connected drives
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                • System policy modification
                PID:2152
              • C:\Users\Admin\AppData\Local\Temp\f7696d3.exe
                C:\Users\Admin\AppData\Local\Temp\f7696d3.exe
                4⤵
                • Executes dropped EXE
                PID:2208
              • C:\Users\Admin\AppData\Local\Temp\f76b04c.exe
                C:\Users\Admin\AppData\Local\Temp\f76b04c.exe
                4⤵
                • Modifies firewall policy service
                • UAC bypass
                • Windows security bypass
                • Executes dropped EXE
                • Windows security modification
                • Checks whether UAC is enabled
                • Enumerates connected drives
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                • System policy modification
                PID:2332
        • C:\Windows\system32\DllHost.exe
          C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
          1⤵
            PID:1268

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Windows\SYSTEM.INI

            Filesize

            257B

            MD5

            e677627c2134ea7be4a2681a5ddfed32

            SHA1

            c1bc045ff9685ff2568e79b798a4ff45e1b6867d

            SHA256

            1c2c57bbb8dd8c45203790a25b7aabc00e4c4b06ab3c39ea388539b667103a92

            SHA512

            d389114b15d34b5a232bc43c7e47b3e2dcbadee9aed487653342c13792e80a13902966c37c680a9601e4b5522fd82200edab57ab6e57dfd8383eba3a87d63fd4

          • \Users\Admin\AppData\Local\Temp\f76951e.exe

            Filesize

            97KB

            MD5

            d436dfd3b2a8ba38bebdc15d6f37b417

            SHA1

            cdeb8266bca8392882db4414c3bedf63a927a199

            SHA256

            0723591e06e3ed6ef199cdab378ea63dad26e2144ddf27b03a4073906a625219

            SHA512

            5a20f0dacca85f6c4dfb9486e7fe81085015d37a195a8350bd598df6ae578f5e1fecd92a53cd6a3d96f19dad3b38adfc7935bb0b0db7eb65ec6894cfce1161ef

          • memory/1112-32-0x00000000001E0000-0x00000000001E2000-memory.dmp

            Filesize

            8KB

          • memory/2152-66-0x0000000000560000-0x000000000161A000-memory.dmp

            Filesize

            16.7MB

          • memory/2152-159-0x0000000000560000-0x000000000161A000-memory.dmp

            Filesize

            16.7MB

          • memory/2152-14-0x0000000000400000-0x0000000000412000-memory.dmp

            Filesize

            72KB

          • memory/2152-158-0x0000000000400000-0x0000000000412000-memory.dmp

            Filesize

            72KB

          • memory/2152-67-0x0000000000560000-0x000000000161A000-memory.dmp

            Filesize

            16.7MB

          • memory/2152-18-0x0000000000560000-0x000000000161A000-memory.dmp

            Filesize

            16.7MB

          • memory/2152-21-0x0000000000560000-0x000000000161A000-memory.dmp

            Filesize

            16.7MB

          • memory/2152-24-0x0000000000560000-0x000000000161A000-memory.dmp

            Filesize

            16.7MB

          • memory/2152-26-0x0000000000560000-0x000000000161A000-memory.dmp

            Filesize

            16.7MB

          • memory/2152-17-0x0000000000560000-0x000000000161A000-memory.dmp

            Filesize

            16.7MB

          • memory/2152-19-0x0000000000560000-0x000000000161A000-memory.dmp

            Filesize

            16.7MB

          • memory/2152-52-0x0000000000280000-0x0000000000282000-memory.dmp

            Filesize

            8KB

          • memory/2152-65-0x0000000000560000-0x000000000161A000-memory.dmp

            Filesize

            16.7MB

          • memory/2152-93-0x0000000000560000-0x000000000161A000-memory.dmp

            Filesize

            16.7MB

          • memory/2152-60-0x0000000000280000-0x0000000000282000-memory.dmp

            Filesize

            8KB

          • memory/2152-92-0x0000000000560000-0x000000000161A000-memory.dmp

            Filesize

            16.7MB

          • memory/2152-89-0x0000000000560000-0x000000000161A000-memory.dmp

            Filesize

            16.7MB

          • memory/2152-49-0x0000000002ED0000-0x0000000002ED1000-memory.dmp

            Filesize

            4KB

          • memory/2152-23-0x0000000000560000-0x000000000161A000-memory.dmp

            Filesize

            16.7MB

          • memory/2152-22-0x0000000000560000-0x000000000161A000-memory.dmp

            Filesize

            16.7MB

          • memory/2152-20-0x0000000000560000-0x000000000161A000-memory.dmp

            Filesize

            16.7MB

          • memory/2152-79-0x0000000000280000-0x0000000000282000-memory.dmp

            Filesize

            8KB

          • memory/2152-72-0x0000000000560000-0x000000000161A000-memory.dmp

            Filesize

            16.7MB

          • memory/2152-71-0x0000000000560000-0x000000000161A000-memory.dmp

            Filesize

            16.7MB

          • memory/2152-25-0x0000000000560000-0x000000000161A000-memory.dmp

            Filesize

            16.7MB

          • memory/2152-69-0x0000000000560000-0x000000000161A000-memory.dmp

            Filesize

            16.7MB

          • memory/2152-68-0x0000000000560000-0x000000000161A000-memory.dmp

            Filesize

            16.7MB

          • memory/2192-61-0x0000000000160000-0x0000000000172000-memory.dmp

            Filesize

            72KB

          • memory/2192-12-0x0000000000130000-0x0000000000142000-memory.dmp

            Filesize

            72KB

          • memory/2192-0-0x0000000010000000-0x0000000010020000-memory.dmp

            Filesize

            128KB

          • memory/2192-213-0x00000000001D0000-0x00000000001E2000-memory.dmp

            Filesize

            72KB

          • memory/2192-1-0x0000000010000000-0x0000000010020000-memory.dmp

            Filesize

            128KB

          • memory/2192-40-0x0000000000140000-0x0000000000142000-memory.dmp

            Filesize

            8KB

          • memory/2192-41-0x0000000000150000-0x0000000000151000-memory.dmp

            Filesize

            4KB

          • memory/2192-82-0x0000000000140000-0x0000000000142000-memory.dmp

            Filesize

            8KB

          • memory/2192-87-0x00000000001D0000-0x00000000001E2000-memory.dmp

            Filesize

            72KB

          • memory/2192-3-0x0000000010000000-0x0000000010020000-memory.dmp

            Filesize

            128KB

          • memory/2192-76-0x00000000001D0000-0x00000000001E2000-memory.dmp

            Filesize

            72KB

          • memory/2192-50-0x0000000000150000-0x0000000000151000-memory.dmp

            Filesize

            4KB

          • memory/2192-59-0x0000000000140000-0x0000000000142000-memory.dmp

            Filesize

            8KB

          • memory/2192-2-0x0000000010000000-0x0000000010020000-memory.dmp

            Filesize

            128KB

          • memory/2192-9-0x0000000000130000-0x0000000000142000-memory.dmp

            Filesize

            72KB

          • memory/2192-62-0x0000000000140000-0x0000000000142000-memory.dmp

            Filesize

            8KB

          • memory/2208-184-0x0000000000400000-0x0000000000412000-memory.dmp

            Filesize

            72KB

          • memory/2208-104-0x00000000003F0000-0x00000000003F1000-memory.dmp

            Filesize

            4KB

          • memory/2208-135-0x0000000000260000-0x0000000000262000-memory.dmp

            Filesize

            8KB

          • memory/2208-114-0x0000000000260000-0x0000000000262000-memory.dmp

            Filesize

            8KB

          • memory/2208-112-0x0000000000260000-0x0000000000262000-memory.dmp

            Filesize

            8KB

          • memory/2208-64-0x0000000000400000-0x0000000000412000-memory.dmp

            Filesize

            72KB

          • memory/2332-111-0x0000000000270000-0x0000000000272000-memory.dmp

            Filesize

            8KB

          • memory/2332-113-0x0000000000270000-0x0000000000272000-memory.dmp

            Filesize

            8KB

          • memory/2332-110-0x0000000000280000-0x0000000000281000-memory.dmp

            Filesize

            4KB

          • memory/2332-88-0x0000000000400000-0x0000000000412000-memory.dmp

            Filesize

            72KB

          • memory/2332-171-0x0000000000910000-0x00000000019CA000-memory.dmp

            Filesize

            16.7MB

          • memory/2332-212-0x0000000000400000-0x0000000000412000-memory.dmp

            Filesize

            72KB

          • memory/2332-211-0x0000000000910000-0x00000000019CA000-memory.dmp

            Filesize

            16.7MB

          We care about your privacy.

          This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.