Analysis

  • max time kernel
    122s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    15-12-2024 02:22

General

  • Target

    f1d91b0bd10d9d026aac1fa3139a306f_JaffaCakes118.exe

  • Size

    100KB

  • MD5

    f1d91b0bd10d9d026aac1fa3139a306f

  • SHA1

    96582a0adb131012dcacd4d3254350eab06ad3b3

  • SHA256

    c45bf646139646c7851cde0eaefe068ef9f445dbd737cb0740a60d7bbad5c24a

  • SHA512

    7a0105b611c4f1eb62879ebe635d2d344f155368508cf61f7fa3fee945b0fad79fbef0955318e8380f26dbf103ccb61fcdf5cbe4abcc7da168fcbb7cd66c4af8

  • SSDEEP

    3072:DJCc0oYnO+ZvYWCXT3YKG9jjzBzQGwIcNSWLF7XCl:lpJ+9psTY/xjzxjwIcIWCl

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

Signatures

  • Modifies firewall policy service 3 TTPs 3 IoCs
  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

  • Sality family
  • UAC bypass 3 TTPs 1 IoCs
  • Windows security bypass 2 TTPs 6 IoCs
  • Windows security modification 2 TTPs 7 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file 1 TTPs 2 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • UPX packed file 26 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 5 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 29 IoCs
  • Suspicious use of WriteProcessMemory 48 IoCs
  • System policy modification 1 TTPs 1 IoCs

Processes

  • C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    1⤵
      PID:1100
    • C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      1⤵
        PID:1156
      • C:\Windows\Explorer.EXE
        C:\Windows\Explorer.EXE
        1⤵
          PID:1204
          • C:\Users\Admin\AppData\Local\Temp\f1d91b0bd10d9d026aac1fa3139a306f_JaffaCakes118.exe
            "C:\Users\Admin\AppData\Local\Temp\f1d91b0bd10d9d026aac1fa3139a306f_JaffaCakes118.exe"
            2⤵
            • Modifies firewall policy service
            • UAC bypass
            • Windows security bypass
            • Windows security modification
            • Checks whether UAC is enabled
            • Enumerates connected drives
            • Drops autorun.inf file
            • Drops file in Program Files directory
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            • System policy modification
            PID:2124
        • C:\Windows\system32\DllHost.exe
          C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
          1⤵
            PID:1664

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • F:\txje.pif

            Filesize

            100KB

            MD5

            02aff1455cf75a7bbb62c0d41a6d1705

            SHA1

            b88337a2bd463f5cc33318d10f6ce467383ea2ae

            SHA256

            c8b31d7454186764f4bcc4bdfa58cae2702a649d4f0c61990892284d8af39519

            SHA512

            566fac6b0e82e4ce6ddc9ba1a9bf213087e7b0449168b9055765105c9b532b8277ad377e4c6147fb1502f314abe115cb34d8543e3fae1b092f392f8998cb4c28

          • memory/1100-8-0x0000000002090000-0x0000000002092000-memory.dmp

            Filesize

            8KB

          • memory/2124-30-0x0000000001EB0000-0x0000000002F3E000-memory.dmp

            Filesize

            16.6MB

          • memory/2124-6-0x0000000001EB0000-0x0000000002F3E000-memory.dmp

            Filesize

            16.6MB

          • memory/2124-0-0x0000000000400000-0x0000000000414000-memory.dmp

            Filesize

            80KB

          • memory/2124-32-0x0000000001EB0000-0x0000000002F3E000-memory.dmp

            Filesize

            16.6MB

          • memory/2124-22-0x00000000038A0000-0x00000000038A1000-memory.dmp

            Filesize

            4KB

          • memory/2124-21-0x0000000001EB0000-0x0000000002F3E000-memory.dmp

            Filesize

            16.6MB

          • memory/2124-4-0x0000000001EB0000-0x0000000002F3E000-memory.dmp

            Filesize

            16.6MB

          • memory/2124-18-0x00000000038A0000-0x00000000038A1000-memory.dmp

            Filesize

            4KB

          • memory/2124-17-0x00000000030C0000-0x00000000030C2000-memory.dmp

            Filesize

            8KB

          • memory/2124-5-0x0000000001EB0000-0x0000000002F3E000-memory.dmp

            Filesize

            16.6MB

          • memory/2124-7-0x0000000001EB0000-0x0000000002F3E000-memory.dmp

            Filesize

            16.6MB

          • memory/2124-26-0x0000000001EB0000-0x0000000002F3E000-memory.dmp

            Filesize

            16.6MB

          • memory/2124-25-0x0000000001EB0000-0x0000000002F3E000-memory.dmp

            Filesize

            16.6MB

          • memory/2124-27-0x0000000001EB0000-0x0000000002F3E000-memory.dmp

            Filesize

            16.6MB

          • memory/2124-28-0x0000000001EB0000-0x0000000002F3E000-memory.dmp

            Filesize

            16.6MB

          • memory/2124-29-0x0000000001EB0000-0x0000000002F3E000-memory.dmp

            Filesize

            16.6MB

          • memory/2124-24-0x00000000030C0000-0x00000000030C2000-memory.dmp

            Filesize

            8KB

          • memory/2124-31-0x0000000001EB0000-0x0000000002F3E000-memory.dmp

            Filesize

            16.6MB

          • memory/2124-23-0x00000000030C0000-0x00000000030C2000-memory.dmp

            Filesize

            8KB

          • memory/2124-34-0x0000000001EB0000-0x0000000002F3E000-memory.dmp

            Filesize

            16.6MB

          • memory/2124-35-0x0000000001EB0000-0x0000000002F3E000-memory.dmp

            Filesize

            16.6MB

          • memory/2124-47-0x0000000000740000-0x0000000000742000-memory.dmp

            Filesize

            8KB

          • memory/2124-50-0x0000000004CA0000-0x0000000004CA1000-memory.dmp

            Filesize

            4KB

          • memory/2124-51-0x0000000001EB0000-0x0000000002F3E000-memory.dmp

            Filesize

            16.6MB

          • memory/2124-53-0x0000000001EB0000-0x0000000002F3E000-memory.dmp

            Filesize

            16.6MB

          • memory/2124-55-0x0000000001EB0000-0x0000000002F3E000-memory.dmp

            Filesize

            16.6MB

          • memory/2124-57-0x0000000001EB0000-0x0000000002F3E000-memory.dmp

            Filesize

            16.6MB

          • memory/2124-58-0x0000000001EB0000-0x0000000002F3E000-memory.dmp

            Filesize

            16.6MB

          • memory/2124-60-0x0000000001EB0000-0x0000000002F3E000-memory.dmp

            Filesize

            16.6MB

          • memory/2124-62-0x0000000001EB0000-0x0000000002F3E000-memory.dmp

            Filesize

            16.6MB

          • memory/2124-65-0x0000000001EB0000-0x0000000002F3E000-memory.dmp

            Filesize

            16.6MB

          • memory/2124-67-0x0000000001EB0000-0x0000000002F3E000-memory.dmp

            Filesize

            16.6MB

          • memory/2124-69-0x0000000000740000-0x0000000000742000-memory.dmp

            Filesize

            8KB

          • memory/2124-70-0x0000000001EB0000-0x0000000002F3E000-memory.dmp

            Filesize

            16.6MB

          • memory/2124-3-0x0000000001EB0000-0x0000000002F3E000-memory.dmp

            Filesize

            16.6MB

          • memory/2124-143-0x0000000000400000-0x0000000000414000-memory.dmp

            Filesize

            80KB

          We care about your privacy.

          This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.