Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15-12-2024 05:49

General

  • Target

    f29472b941613ed18d2d65a797139dbd_JaffaCakes118.exe

  • Size

    100KB

  • MD5

    f29472b941613ed18d2d65a797139dbd

  • SHA1

    83e6b61b2232bdbdcdb92f88f1df03eaed290fa8

  • SHA256

    f0a5c4365d7d937f1ca285a6b6074c8bdd1dd9acf0d7ff0847b89445bd41f8e6

  • SHA512

    928a86b67e20c24d9b0136fcc0de3cbabc125b79b5ca0fcd9e804efd29f89e746061b98741eac7e63fd1777d7c46dd29cb58cd6c5a31f4ca109cac74e93ab3dd

  • SSDEEP

    1536:UbkNltaF3fghQwkHqecXHKeajGvaoP+BVY2L7DGM9lJFZMoJeB+Ya:UQNlto3fDwkVd3jGxOLjTjDeU

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

Signatures

  • Modifies firewall policy service 3 TTPs 3 IoCs
  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

  • Sality family
  • UAC bypass 3 TTPs 1 IoCs
  • Windows security bypass 2 TTPs 6 IoCs
  • Disables RegEdit via registry modification 1 IoCs
  • Disables Task Manager via registry modification
  • Windows security modification 2 TTPs 7 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file 1 TTPs 2 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • UPX packed file 41 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 11 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 30 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 1 IoCs

Processes

  • C:\Windows\system32\fontdrvhost.exe
    "fontdrvhost.exe"
    1⤵
      PID:800
    • C:\Windows\system32\fontdrvhost.exe
      "fontdrvhost.exe"
      1⤵
        PID:808
      • C:\Windows\system32\dwm.exe
        "dwm.exe"
        1⤵
          PID:380
        • C:\Windows\system32\sihost.exe
          sihost.exe
          1⤵
            PID:3008
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
            1⤵
              PID:2268
            • C:\Windows\system32\taskhostw.exe
              taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
              1⤵
                PID:1068
              • C:\Windows\Explorer.EXE
                C:\Windows\Explorer.EXE
                1⤵
                  PID:3444
                  • C:\Users\Admin\AppData\Local\Temp\f29472b941613ed18d2d65a797139dbd_JaffaCakes118.exe
                    "C:\Users\Admin\AppData\Local\Temp\f29472b941613ed18d2d65a797139dbd_JaffaCakes118.exe"
                    2⤵
                    • Modifies firewall policy service
                    • UAC bypass
                    • Windows security bypass
                    • Disables RegEdit via registry modification
                    • Windows security modification
                    • Checks whether UAC is enabled
                    • Enumerates connected drives
                    • Drops autorun.inf file
                    • Drops file in Program Files directory
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    • Modifies registry class
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of WriteProcessMemory
                    • System policy modification
                    PID:1624
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
                  1⤵
                    PID:3560
                  • C:\Windows\system32\DllHost.exe
                    C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                    1⤵
                      PID:3756
                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                      1⤵
                        PID:3844
                      • C:\Windows\System32\RuntimeBroker.exe
                        C:\Windows\System32\RuntimeBroker.exe -Embedding
                        1⤵
                          PID:3908
                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                          1⤵
                            PID:3984
                          • C:\Windows\System32\RuntimeBroker.exe
                            C:\Windows\System32\RuntimeBroker.exe -Embedding
                            1⤵
                              PID:3548
                            • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
                              "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
                              1⤵
                                PID:4184
                              • C:\Windows\System32\RuntimeBroker.exe
                                C:\Windows\System32\RuntimeBroker.exe -Embedding
                                1⤵
                                  PID:4892
                                • C:\Windows\system32\backgroundTaskHost.exe
                                  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
                                  1⤵
                                    PID:3504

                                  Network

                                  • flag-us
                                    DNS
                                    8.8.8.8.in-addr.arpa
                                    Remote address:
                                    8.8.8.8:53
                                    Request
                                    8.8.8.8.in-addr.arpa
                                    IN PTR
                                    Response
                                    8.8.8.8.in-addr.arpa
                                    IN PTR
                                    dnsgoogle
                                  • flag-us
                                    DNS
                                    241.150.49.20.in-addr.arpa
                                    Remote address:
                                    8.8.8.8:53
                                    Request
                                    241.150.49.20.in-addr.arpa
                                    IN PTR
                                    Response
                                  • flag-us
                                    DNS
                                    156.133.100.95.in-addr.arpa
                                    Remote address:
                                    8.8.8.8:53
                                    Request
                                    156.133.100.95.in-addr.arpa
                                    IN PTR
                                    Response
                                    156.133.100.95.in-addr.arpa
                                    IN PTR
                                    a95-100-133-156deploystaticakamaitechnologiescom
                                  • flag-us
                                    DNS
                                    71.159.190.20.in-addr.arpa
                                    Remote address:
                                    8.8.8.8:53
                                    Request
                                    71.159.190.20.in-addr.arpa
                                    IN PTR
                                    Response
                                  • flag-us
                                    DNS
                                    95.221.229.192.in-addr.arpa
                                    Remote address:
                                    8.8.8.8:53
                                    Request
                                    95.221.229.192.in-addr.arpa
                                    IN PTR
                                    Response
                                  • flag-us
                                    DNS
                                    58.55.71.13.in-addr.arpa
                                    Remote address:
                                    8.8.8.8:53
                                    Request
                                    58.55.71.13.in-addr.arpa
                                    IN PTR
                                    Response
                                  • flag-us
                                    DNS
                                    50.23.12.20.in-addr.arpa
                                    Remote address:
                                    8.8.8.8:53
                                    Request
                                    50.23.12.20.in-addr.arpa
                                    IN PTR
                                    Response
                                  • flag-us
                                    DNS
                                    171.39.242.20.in-addr.arpa
                                    Remote address:
                                    8.8.8.8:53
                                    Request
                                    171.39.242.20.in-addr.arpa
                                    IN PTR
                                    Response
                                  • flag-us
                                    DNS
                                    172.214.232.199.in-addr.arpa
                                    Remote address:
                                    8.8.8.8:53
                                    Request
                                    172.214.232.199.in-addr.arpa
                                    IN PTR
                                    Response
                                  • flag-us
                                    DNS
                                    172.210.232.199.in-addr.arpa
                                    Remote address:
                                    8.8.8.8:53
                                    Request
                                    172.210.232.199.in-addr.arpa
                                    IN PTR
                                    Response
                                  • flag-us
                                    DNS
                                    21.236.111.52.in-addr.arpa
                                    Remote address:
                                    8.8.8.8:53
                                    Request
                                    21.236.111.52.in-addr.arpa
                                    IN PTR
                                    Response
                                  • flag-us
                                    DNS
                                    28.73.42.20.in-addr.arpa
                                    Remote address:
                                    8.8.8.8:53
                                    Request
                                    28.73.42.20.in-addr.arpa
                                    IN PTR
                                    Response
                                  No results found
                                  • 8.8.8.8:53
                                    8.8.8.8.in-addr.arpa
                                    dns
                                    66 B
                                    90 B
                                    1
                                    1

                                    DNS Request

                                    8.8.8.8.in-addr.arpa

                                  • 8.8.8.8:53
                                    241.150.49.20.in-addr.arpa
                                    dns
                                    72 B
                                    158 B
                                    1
                                    1

                                    DNS Request

                                    241.150.49.20.in-addr.arpa

                                  • 8.8.8.8:53
                                    156.133.100.95.in-addr.arpa
                                    dns
                                    73 B
                                    139 B
                                    1
                                    1

                                    DNS Request

                                    156.133.100.95.in-addr.arpa

                                  • 8.8.8.8:53
                                    71.159.190.20.in-addr.arpa
                                    dns
                                    72 B
                                    158 B
                                    1
                                    1

                                    DNS Request

                                    71.159.190.20.in-addr.arpa

                                  • 8.8.8.8:53
                                    95.221.229.192.in-addr.arpa
                                    dns
                                    73 B
                                    144 B
                                    1
                                    1

                                    DNS Request

                                    95.221.229.192.in-addr.arpa

                                  • 8.8.8.8:53
                                    58.55.71.13.in-addr.arpa
                                    dns
                                    70 B
                                    144 B
                                    1
                                    1

                                    DNS Request

                                    58.55.71.13.in-addr.arpa

                                  • 8.8.8.8:53
                                    50.23.12.20.in-addr.arpa
                                    dns
                                    70 B
                                    156 B
                                    1
                                    1

                                    DNS Request

                                    50.23.12.20.in-addr.arpa

                                  • 8.8.8.8:53
                                    171.39.242.20.in-addr.arpa
                                    dns
                                    72 B
                                    158 B
                                    1
                                    1

                                    DNS Request

                                    171.39.242.20.in-addr.arpa

                                  • 8.8.8.8:53
                                    172.214.232.199.in-addr.arpa
                                    dns
                                    74 B
                                    128 B
                                    1
                                    1

                                    DNS Request

                                    172.214.232.199.in-addr.arpa

                                  • 8.8.8.8:53
                                    172.210.232.199.in-addr.arpa
                                    dns
                                    74 B
                                    128 B
                                    1
                                    1

                                    DNS Request

                                    172.210.232.199.in-addr.arpa

                                  • 8.8.8.8:53
                                    21.236.111.52.in-addr.arpa
                                    dns
                                    72 B
                                    158 B
                                    1
                                    1

                                    DNS Request

                                    21.236.111.52.in-addr.arpa

                                  • 8.8.8.8:53
                                    28.73.42.20.in-addr.arpa
                                    dns
                                    70 B
                                    156 B
                                    1
                                    1

                                    DNS Request

                                    28.73.42.20.in-addr.arpa

                                  MITRE ATT&CK Enterprise v15

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads

                                  • F:\ifetb.exe

                                    Filesize

                                    100KB

                                    MD5

                                    f199921308bd81485e946995226d8b9b

                                    SHA1

                                    b6acfa6de7b2d366c0e16deb047ff2d872a95314

                                    SHA256

                                    19bd66f54177862c18ceda9b5048d104dc098545cd1bca55a2ad1f9ff6544439

                                    SHA512

                                    b41fd1eb04eb98995934b09648dcaff1007c5877f5f67edac52c43a9b92955dd9b8adeb2657ccf679f6228e0698867a00281ba6c1ab9e04d61d3322242053c56

                                  • memory/1624-27-0x00000000021E0000-0x000000000326E000-memory.dmp

                                    Filesize

                                    16.6MB

                                  • memory/1624-63-0x00000000021E0000-0x000000000326E000-memory.dmp

                                    Filesize

                                    16.6MB

                                  • memory/1624-9-0x00000000021E0000-0x000000000326E000-memory.dmp

                                    Filesize

                                    16.6MB

                                  • memory/1624-4-0x00000000021E0000-0x000000000326E000-memory.dmp

                                    Filesize

                                    16.6MB

                                  • memory/1624-12-0x0000000000630000-0x0000000000632000-memory.dmp

                                    Filesize

                                    8KB

                                  • memory/1624-11-0x00000000021E0000-0x000000000326E000-memory.dmp

                                    Filesize

                                    16.6MB

                                  • memory/1624-5-0x00000000021E0000-0x000000000326E000-memory.dmp

                                    Filesize

                                    16.6MB

                                  • memory/1624-10-0x0000000000630000-0x0000000000632000-memory.dmp

                                    Filesize

                                    8KB

                                  • memory/1624-8-0x00000000021E0000-0x000000000326E000-memory.dmp

                                    Filesize

                                    16.6MB

                                  • memory/1624-7-0x00000000033B0000-0x00000000033B1000-memory.dmp

                                    Filesize

                                    4KB

                                  • memory/1624-6-0x0000000000630000-0x0000000000632000-memory.dmp

                                    Filesize

                                    8KB

                                  • memory/1624-13-0x00000000021E0000-0x000000000326E000-memory.dmp

                                    Filesize

                                    16.6MB

                                  • memory/1624-14-0x00000000021E0000-0x000000000326E000-memory.dmp

                                    Filesize

                                    16.6MB

                                  • memory/1624-15-0x00000000021E0000-0x000000000326E000-memory.dmp

                                    Filesize

                                    16.6MB

                                  • memory/1624-25-0x00000000021E0000-0x000000000326E000-memory.dmp

                                    Filesize

                                    16.6MB

                                  • memory/1624-17-0x00000000021E0000-0x000000000326E000-memory.dmp

                                    Filesize

                                    16.6MB

                                  • memory/1624-18-0x00000000021E0000-0x000000000326E000-memory.dmp

                                    Filesize

                                    16.6MB

                                  • memory/1624-19-0x00000000021E0000-0x000000000326E000-memory.dmp

                                    Filesize

                                    16.6MB

                                  • memory/1624-20-0x00000000021E0000-0x000000000326E000-memory.dmp

                                    Filesize

                                    16.6MB

                                  • memory/1624-22-0x00000000021E0000-0x000000000326E000-memory.dmp

                                    Filesize

                                    16.6MB

                                  • memory/1624-23-0x00000000021E0000-0x000000000326E000-memory.dmp

                                    Filesize

                                    16.6MB

                                  • memory/1624-24-0x0000000000630000-0x0000000000632000-memory.dmp

                                    Filesize

                                    8KB

                                  • memory/1624-16-0x00000000021E0000-0x000000000326E000-memory.dmp

                                    Filesize

                                    16.6MB

                                  • memory/1624-3-0x00000000021E0000-0x000000000326E000-memory.dmp

                                    Filesize

                                    16.6MB

                                  • memory/1624-42-0x00000000021E0000-0x000000000326E000-memory.dmp

                                    Filesize

                                    16.6MB

                                  • memory/1624-30-0x00000000021E0000-0x000000000326E000-memory.dmp

                                    Filesize

                                    16.6MB

                                  • memory/1624-33-0x00000000021E0000-0x000000000326E000-memory.dmp

                                    Filesize

                                    16.6MB

                                  • memory/1624-34-0x00000000021E0000-0x000000000326E000-memory.dmp

                                    Filesize

                                    16.6MB

                                  • memory/1624-37-0x00000000021E0000-0x000000000326E000-memory.dmp

                                    Filesize

                                    16.6MB

                                  • memory/1624-39-0x00000000021E0000-0x000000000326E000-memory.dmp

                                    Filesize

                                    16.6MB

                                  • memory/1624-40-0x00000000021E0000-0x000000000326E000-memory.dmp

                                    Filesize

                                    16.6MB

                                  • memory/1624-41-0x00000000021E0000-0x000000000326E000-memory.dmp

                                    Filesize

                                    16.6MB

                                  • memory/1624-28-0x00000000021E0000-0x000000000326E000-memory.dmp

                                    Filesize

                                    16.6MB

                                  • memory/1624-44-0x00000000021E0000-0x000000000326E000-memory.dmp

                                    Filesize

                                    16.6MB

                                  • memory/1624-43-0x00000000021E0000-0x000000000326E000-memory.dmp

                                    Filesize

                                    16.6MB

                                  • memory/1624-46-0x00000000021E0000-0x000000000326E000-memory.dmp

                                    Filesize

                                    16.6MB

                                  • memory/1624-47-0x00000000021E0000-0x000000000326E000-memory.dmp

                                    Filesize

                                    16.6MB

                                  • memory/1624-54-0x00000000021E0000-0x000000000326E000-memory.dmp

                                    Filesize

                                    16.6MB

                                  • memory/1624-56-0x00000000021E0000-0x000000000326E000-memory.dmp

                                    Filesize

                                    16.6MB

                                  • memory/1624-58-0x00000000021E0000-0x000000000326E000-memory.dmp

                                    Filesize

                                    16.6MB

                                  • memory/1624-60-0x00000000021E0000-0x000000000326E000-memory.dmp

                                    Filesize

                                    16.6MB

                                  • memory/1624-61-0x00000000021E0000-0x000000000326E000-memory.dmp

                                    Filesize

                                    16.6MB

                                  • memory/1624-0-0x0000000000400000-0x0000000000416000-memory.dmp

                                    Filesize

                                    88KB

                                  • memory/1624-65-0x00000000021E0000-0x000000000326E000-memory.dmp

                                    Filesize

                                    16.6MB

                                  • memory/1624-66-0x00000000021E0000-0x000000000326E000-memory.dmp

                                    Filesize

                                    16.6MB

                                  • memory/1624-68-0x00000000021E0000-0x000000000326E000-memory.dmp

                                    Filesize

                                    16.6MB

                                  • memory/1624-1-0x00000000021E0000-0x000000000326E000-memory.dmp

                                    Filesize

                                    16.6MB

                                  • memory/1624-79-0x0000000000400000-0x0000000000416000-memory.dmp

                                    Filesize

                                    88KB

                                  We care about your privacy.

                                  This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.