Analysis
-
max time kernel
95s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
13-12-2024 16:10
General
-
Target
ec534b1e4735cb1a5e433744f7d9afdc_JaffaCakes118.exe
-
Size
255KB
-
MD5
ec534b1e4735cb1a5e433744f7d9afdc
-
SHA1
315308e5c59147874ccf2fb715e7687b34a18a2a
-
SHA256
deac8cda8716240891de34bbe884d239f10925955332be0a0507d247b076974f
-
SHA512
02dae880c2a56714290674f48cd1985c7fd11791afc31a33dc2ef6fa9a6c20c443228779c030601c05240d001f83d5dd59ce644c36564b2843bb8fb779819887
-
SSDEEP
6144:nmnIZJPXS3HF8ZJWGZ/f3rqqhVxnGMV+5T0OT5B1P0m:nmnwJP+HF8bWGZ/fbqQ/nxV+5T0O9B11
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
-
Sality
Sality is backdoor written in C++, first discovered in 2003.
-
Sality family
-
UAC bypass 3 TTPs 2 IoCs
-
Windows security bypass 2 TTPs 12 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 9 IoCs
-
Windows security modification 2 TTPs 14 IoCs
-
Checks whether UAC is enabled 1 TTPs 2 IoCs
-
UPX packed file 20 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 20 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of WriteProcessMemory 33 IoCs
-
System policy modification 1 TTPs 2 IoCs
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\ec534b1e4735cb1a5e433744f7d9afdc_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ec534b1e4735cb1a5e433744f7d9afdc_JaffaCakes118.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe"C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\3⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
187KB
MD567c2e58c28f913b0b3a298a5388ada76
SHA10097c9789638a57eeab2ff13d0b4d3b1d469ed1b
SHA2564a646549c9e3f593502ff76fefec5f1c0284de1dfdb6aff3351d2ef534f47582
SHA5120cfe8913455801c8fee72a8f0d8e6775e803c879c156b0aa0a3dc55b400490373e65f80e60aaf745c31f29a284cdb481906220f89b5ef9cdb9183c4e43eee40a
-
Filesize
15KB
MD567d8f4d5acdb722e9cb7a99570b3ded1
SHA1f4a729ba77332325ea4dbdeea98b579f501fd26f
SHA256fa8de036b1d9bb06be383a82041966c73473fc8382d041fb5c1758f991afeae7
SHA51203999cc26a76b0de6f7e4e8a45137ee4d9c250366ac5a458110f00f7962158311eea5f22d3ee4f32f85aa6969eb143bdb8f03ca989568764ed2bc488c89b4b7f
-
Filesize
11KB
MD5959ea64598b9a3e494c00e8fa793be7e
SHA140f284a3b92c2f04b1038def79579d4b3d066ee0
SHA25603cd57ab00236c753e7ddeee8ee1c10839ace7c426769982365531042e1f6f8b
SHA5125e765e090f712beffce40c5264674f430b08719940d66e3a4d4a516fd4ade859f7853f614d9d6bbb602780de54e11110d66dbb0f9ca20ef6096ede531f9f6d64
-
Filesize
4KB
MD5d16e06c5de8fb8213a0464568ed9852f
SHA1d063690dc0d2c824f714acb5c4bcede3aa193f03
SHA256728472ba312ae8af7f30d758ab473e0772477a68fcd1d2d547dafe6d8800d531
SHA51260502bb65d91a1a895f38bd0f070738152af58ffa4ac80bac3954aa8aad9fda9666e773988cbd00ce4741d2454bf5f2e0474ce8ea18cfe863ec4c36d09d1e27a
-
Filesize
868B
MD596f72aab0bb600d1559f9826e5c954f0
SHA126a244848edd8a4e5614e28fea12699dcea53b7f
SHA256f04307654ee71e1d6a779bd86b5f1fd3dfd89dacb944ba82b12d6f45d4d543fd
SHA512ee5f36187624e8975e1b0366fc220fa42a2a4a0b0bda6ef338c6b86af8ee7594c8425bcbc4d12cd2c14a693d11d30a0ff250a7043edc0733e355ee22ce144089
-
Filesize
84KB
MD5fae3be7a9827eaa3ef9f43832805e110
SHA10888a3ed318f17bf39e3c9af5848c965551b31a5
SHA25665aac0490feb6cb70ef76b39d3f08f61172dfce998fecf56a25c3f10d5c754a7
SHA51239d0496614a390c2e97636bd1d252c3cba8c0c28a7245f631cc7b7195bfe224cb176c97adbb92824df8db5e5340d5255171eabcac0da548385fed0d81578c6c2
-
Filesize
16KB
MD54e1c46e37af4b3ab0036cb1e85c81608
SHA18424a551d819cdae44d95a80af24a502d7e25ac1
SHA256468d24e632789e5d2e740bf7b084d72e4e3784ebc19d77dfe4b3d866bec8d789
SHA5129a2e140238bc6e4492cfcd022930b4facb3ca61d498febce949b36b526ef5ab434d94d0811bf958f572d1cf141b4411fa7950551244926a93d69b68d8fd33df6
-
Filesize
255KB
MD5ec534b1e4735cb1a5e433744f7d9afdc
SHA1315308e5c59147874ccf2fb715e7687b34a18a2a
SHA256deac8cda8716240891de34bbe884d239f10925955332be0a0507d247b076974f
SHA51202dae880c2a56714290674f48cd1985c7fd11791afc31a33dc2ef6fa9a6c20c443228779c030601c05240d001f83d5dd59ce644c36564b2843bb8fb779819887
-
Filesize
256B
MD5beb697dd92d9e88f4fcea1a53be1dd73
SHA12b41db4bcade86c767901069f535e8f73d02e6ba
SHA256ce91a312f7dc0dd5a9d27a23a94a7d94c874f98702b56f08a9a66f6180fa1146
SHA5124c95a4f2c5b302ab0bca25614a7625a77cac9c8c35254cd06d4f1d6f8257efcb67296eb2af8f69ab8ff73d4467618e6b855610ec4060dc5011b0c1bb67da2204
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
1.8MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
88KB
-
Filesize
16.6MB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
1.8MB
-
Filesize
8KB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
8KB
-
Filesize
1.8MB
-
Filesize
4KB
-
Filesize
16.6MB
-
Filesize
8KB
-
Filesize
16.6MB
-
Filesize
8KB