Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15-12-2024 17:25

General

  • Target

    f5007bac9500e52936d2ad2fca56c365_JaffaCakes118.exe

  • Size

    100KB

  • MD5

    f5007bac9500e52936d2ad2fca56c365

  • SHA1

    19218b75610e140f20baabd669b9f73d108fa2b2

  • SHA256

    da668d7f0ebc247a71c61e987b5c8c537b196bb9df41770191e52a7c6a545900

  • SHA512

    08c827296fa781c63b59980eb7ea55396e92b16518c2bf8fb874ad711cca6646f4066d920d539f88f3a4411868ed12abd092eedfd13237ebae779ca5e3cb2c1f

  • SSDEEP

    3072:9znnfxuRLxcir1AwSkSEP7K948cXJ0vbj1hGNa:9zfGLxnr1rYEDK948cXuWN

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

Signatures

  • Modifies firewall policy service 3 TTPs 3 IoCs
  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

  • Sality family
  • UAC bypass 3 TTPs 1 IoCs
  • Windows security bypass 2 TTPs 6 IoCs
  • Disables RegEdit via registry modification 1 IoCs
  • Disables Task Manager via registry modification
  • Windows security modification 2 TTPs 7 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file 1 TTPs 2 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • UPX packed file 39 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 11 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 30 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 1 IoCs

Processes

  • C:\Windows\system32\fontdrvhost.exe
    "fontdrvhost.exe"
    1⤵
      PID:784
    • C:\Windows\system32\fontdrvhost.exe
      "fontdrvhost.exe"
      1⤵
        PID:788
      • C:\Windows\system32\dwm.exe
        "dwm.exe"
        1⤵
          PID:380
        • C:\Windows\system32\sihost.exe
          sihost.exe
          1⤵
            PID:2896
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
            1⤵
              PID:2948
            • C:\Windows\system32\taskhostw.exe
              taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
              1⤵
                PID:3060
              • C:\Windows\Explorer.EXE
                C:\Windows\Explorer.EXE
                1⤵
                  PID:3500
                  • C:\Users\Admin\AppData\Local\Temp\f5007bac9500e52936d2ad2fca56c365_JaffaCakes118.exe
                    "C:\Users\Admin\AppData\Local\Temp\f5007bac9500e52936d2ad2fca56c365_JaffaCakes118.exe"
                    2⤵
                    • Modifies firewall policy service
                    • UAC bypass
                    • Windows security bypass
                    • Disables RegEdit via registry modification
                    • Windows security modification
                    • Checks whether UAC is enabled
                    • Enumerates connected drives
                    • Drops autorun.inf file
                    • Drops file in Program Files directory
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    • Modifies registry class
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of WriteProcessMemory
                    • System policy modification
                    PID:3596
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
                  1⤵
                    PID:3624
                  • C:\Windows\system32\DllHost.exe
                    C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                    1⤵
                      PID:3832
                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                      1⤵
                        PID:3920
                      • C:\Windows\System32\RuntimeBroker.exe
                        C:\Windows\System32\RuntimeBroker.exe -Embedding
                        1⤵
                          PID:3984
                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                          1⤵
                            PID:4088
                          • C:\Windows\System32\RuntimeBroker.exe
                            C:\Windows\System32\RuntimeBroker.exe -Embedding
                            1⤵
                              PID:3864
                            • C:\Windows\System32\RuntimeBroker.exe
                              C:\Windows\System32\RuntimeBroker.exe -Embedding
                              1⤵
                                PID:1704
                              • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
                                "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
                                1⤵
                                  PID:1768

                                Network

                                • flag-us
                                  DNS
                                  154.239.44.20.in-addr.arpa
                                  Remote address:
                                  8.8.8.8:53
                                  Request
                                  154.239.44.20.in-addr.arpa
                                  IN PTR
                                  Response
                                • flag-us
                                  DNS
                                  88.210.23.2.in-addr.arpa
                                  Remote address:
                                  8.8.8.8:53
                                  Request
                                  88.210.23.2.in-addr.arpa
                                  IN PTR
                                  Response
                                  88.210.23.2.in-addr.arpa
                                  IN PTR
                                  a2-23-210-88deploystaticakamaitechnologiescom
                                • flag-us
                                  DNS
                                  14.160.190.20.in-addr.arpa
                                  Remote address:
                                  8.8.8.8:53
                                  Request
                                  14.160.190.20.in-addr.arpa
                                  IN PTR
                                  Response
                                • flag-us
                                  DNS
                                  95.221.229.192.in-addr.arpa
                                  Remote address:
                                  8.8.8.8:53
                                  Request
                                  95.221.229.192.in-addr.arpa
                                  IN PTR
                                  Response
                                • flag-us
                                  DNS
                                  58.55.71.13.in-addr.arpa
                                  Remote address:
                                  8.8.8.8:53
                                  Request
                                  58.55.71.13.in-addr.arpa
                                  IN PTR
                                  Response
                                • flag-us
                                  DNS
                                  56.163.245.4.in-addr.arpa
                                  Remote address:
                                  8.8.8.8:53
                                  Request
                                  56.163.245.4.in-addr.arpa
                                  IN PTR
                                  Response
                                • flag-us
                                  DNS
                                  171.39.242.20.in-addr.arpa
                                  Remote address:
                                  8.8.8.8:53
                                  Request
                                  171.39.242.20.in-addr.arpa
                                  IN PTR
                                  Response
                                • flag-us
                                  DNS
                                  86.49.80.91.in-addr.arpa
                                  Remote address:
                                  8.8.8.8:53
                                  Request
                                  86.49.80.91.in-addr.arpa
                                  IN PTR
                                  Response
                                • flag-us
                                  DNS
                                  83.210.23.2.in-addr.arpa
                                  Remote address:
                                  8.8.8.8:53
                                  Request
                                  83.210.23.2.in-addr.arpa
                                  IN PTR
                                  Response
                                  83.210.23.2.in-addr.arpa
                                  IN PTR
                                  a2-23-210-83deploystaticakamaitechnologiescom
                                • flag-us
                                  DNS
                                  43.229.111.52.in-addr.arpa
                                  Remote address:
                                  8.8.8.8:53
                                  Request
                                  43.229.111.52.in-addr.arpa
                                  IN PTR
                                  Response
                                No results found
                                • 8.8.8.8:53
                                  154.239.44.20.in-addr.arpa
                                  dns
                                  72 B
                                  158 B
                                  1
                                  1

                                  DNS Request

                                  154.239.44.20.in-addr.arpa

                                • 8.8.8.8:53
                                  88.210.23.2.in-addr.arpa
                                  dns
                                  70 B
                                  133 B
                                  1
                                  1

                                  DNS Request

                                  88.210.23.2.in-addr.arpa

                                • 8.8.8.8:53
                                  14.160.190.20.in-addr.arpa
                                  dns
                                  72 B
                                  158 B
                                  1
                                  1

                                  DNS Request

                                  14.160.190.20.in-addr.arpa

                                • 8.8.8.8:53
                                  95.221.229.192.in-addr.arpa
                                  dns
                                  73 B
                                  144 B
                                  1
                                  1

                                  DNS Request

                                  95.221.229.192.in-addr.arpa

                                • 8.8.8.8:53
                                  58.55.71.13.in-addr.arpa
                                  dns
                                  70 B
                                  144 B
                                  1
                                  1

                                  DNS Request

                                  58.55.71.13.in-addr.arpa

                                • 8.8.8.8:53
                                  56.163.245.4.in-addr.arpa
                                  dns
                                  71 B
                                  157 B
                                  1
                                  1

                                  DNS Request

                                  56.163.245.4.in-addr.arpa

                                • 8.8.8.8:53
                                  171.39.242.20.in-addr.arpa
                                  dns
                                  72 B
                                  158 B
                                  1
                                  1

                                  DNS Request

                                  171.39.242.20.in-addr.arpa

                                • 8.8.8.8:53
                                  86.49.80.91.in-addr.arpa
                                  dns
                                  70 B
                                  145 B
                                  1
                                  1

                                  DNS Request

                                  86.49.80.91.in-addr.arpa

                                • 8.8.8.8:53
                                  83.210.23.2.in-addr.arpa
                                  dns
                                  70 B
                                  133 B
                                  1
                                  1

                                  DNS Request

                                  83.210.23.2.in-addr.arpa

                                • 8.8.8.8:53
                                  43.229.111.52.in-addr.arpa
                                  dns
                                  72 B
                                  158 B
                                  1
                                  1

                                  DNS Request

                                  43.229.111.52.in-addr.arpa

                                MITRE ATT&CK Enterprise v15

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                • C:\rsdpnq.exe

                                  Filesize

                                  100KB

                                  MD5

                                  249f5b27042d4bd0560ee838a74d00b2

                                  SHA1

                                  d228c923bf026d481e52918aa88007a6013152bb

                                  SHA256

                                  ad13d2d03566cfbae87ad8928773d0bb3ceed096cea24ff90544934571cbcbf4

                                  SHA512

                                  f60603ae905cf8cde45ee33329eafe085303e7a6c6ac07514d2dc759e5cd6036ed696e865e365b0c9b619bb1b8eb9d3c5cad2b66177247f3a254994af90d8508

                                • memory/3596-24-0x00000000022F0000-0x000000000337E000-memory.dmp

                                  Filesize

                                  16.6MB

                                • memory/3596-3-0x00000000022F0000-0x000000000337E000-memory.dmp

                                  Filesize

                                  16.6MB

                                • memory/3596-8-0x00000000022F0000-0x000000000337E000-memory.dmp

                                  Filesize

                                  16.6MB

                                • memory/3596-5-0x00000000022F0000-0x000000000337E000-memory.dmp

                                  Filesize

                                  16.6MB

                                • memory/3596-4-0x00000000022F0000-0x000000000337E000-memory.dmp

                                  Filesize

                                  16.6MB

                                • memory/3596-10-0x0000000000600000-0x0000000000601000-memory.dmp

                                  Filesize

                                  4KB

                                • memory/3596-14-0x00000000005F0000-0x00000000005F2000-memory.dmp

                                  Filesize

                                  8KB

                                • memory/3596-7-0x00000000022F0000-0x000000000337E000-memory.dmp

                                  Filesize

                                  16.6MB

                                • memory/3596-13-0x00000000022F0000-0x000000000337E000-memory.dmp

                                  Filesize

                                  16.6MB

                                • memory/3596-11-0x00000000022F0000-0x000000000337E000-memory.dmp

                                  Filesize

                                  16.6MB

                                • memory/3596-15-0x00000000022F0000-0x000000000337E000-memory.dmp

                                  Filesize

                                  16.6MB

                                • memory/3596-9-0x00000000005F0000-0x00000000005F2000-memory.dmp

                                  Filesize

                                  8KB

                                • memory/3596-6-0x00000000022F0000-0x000000000337E000-memory.dmp

                                  Filesize

                                  16.6MB

                                • memory/3596-12-0x00000000005F0000-0x00000000005F2000-memory.dmp

                                  Filesize

                                  8KB

                                • memory/3596-16-0x00000000022F0000-0x000000000337E000-memory.dmp

                                  Filesize

                                  16.6MB

                                • memory/3596-17-0x00000000022F0000-0x000000000337E000-memory.dmp

                                  Filesize

                                  16.6MB

                                • memory/3596-26-0x00000000005F0000-0x00000000005F2000-memory.dmp

                                  Filesize

                                  8KB

                                • memory/3596-19-0x00000000022F0000-0x000000000337E000-memory.dmp

                                  Filesize

                                  16.6MB

                                • memory/3596-20-0x00000000022F0000-0x000000000337E000-memory.dmp

                                  Filesize

                                  16.6MB

                                • memory/3596-22-0x00000000022F0000-0x000000000337E000-memory.dmp

                                  Filesize

                                  16.6MB

                                • memory/3596-23-0x00000000022F0000-0x000000000337E000-memory.dmp

                                  Filesize

                                  16.6MB

                                • memory/3596-0-0x0000000000400000-0x0000000000415000-memory.dmp

                                  Filesize

                                  84KB

                                • memory/3596-29-0x00000000022F0000-0x000000000337E000-memory.dmp

                                  Filesize

                                  16.6MB

                                • memory/3596-1-0x00000000022F0000-0x000000000337E000-memory.dmp

                                  Filesize

                                  16.6MB

                                • memory/3596-18-0x00000000022F0000-0x000000000337E000-memory.dmp

                                  Filesize

                                  16.6MB

                                • memory/3596-30-0x00000000022F0000-0x000000000337E000-memory.dmp

                                  Filesize

                                  16.6MB

                                • memory/3596-31-0x00000000022F0000-0x000000000337E000-memory.dmp

                                  Filesize

                                  16.6MB

                                • memory/3596-33-0x00000000022F0000-0x000000000337E000-memory.dmp

                                  Filesize

                                  16.6MB

                                • memory/3596-36-0x00000000022F0000-0x000000000337E000-memory.dmp

                                  Filesize

                                  16.6MB

                                • memory/3596-37-0x00000000022F0000-0x000000000337E000-memory.dmp

                                  Filesize

                                  16.6MB

                                • memory/3596-40-0x00000000022F0000-0x000000000337E000-memory.dmp

                                  Filesize

                                  16.6MB

                                • memory/3596-41-0x00000000022F0000-0x000000000337E000-memory.dmp

                                  Filesize

                                  16.6MB

                                • memory/3596-49-0x00000000022F0000-0x000000000337E000-memory.dmp

                                  Filesize

                                  16.6MB

                                • memory/3596-50-0x00000000022F0000-0x000000000337E000-memory.dmp

                                  Filesize

                                  16.6MB

                                • memory/3596-53-0x00000000022F0000-0x000000000337E000-memory.dmp

                                  Filesize

                                  16.6MB

                                • memory/3596-54-0x00000000022F0000-0x000000000337E000-memory.dmp

                                  Filesize

                                  16.6MB

                                • memory/3596-55-0x00000000022F0000-0x000000000337E000-memory.dmp

                                  Filesize

                                  16.6MB

                                • memory/3596-57-0x00000000022F0000-0x000000000337E000-memory.dmp

                                  Filesize

                                  16.6MB

                                • memory/3596-59-0x00000000022F0000-0x000000000337E000-memory.dmp

                                  Filesize

                                  16.6MB

                                • memory/3596-61-0x00000000022F0000-0x000000000337E000-memory.dmp

                                  Filesize

                                  16.6MB

                                • memory/3596-62-0x00000000022F0000-0x000000000337E000-memory.dmp

                                  Filesize

                                  16.6MB

                                • memory/3596-64-0x00000000022F0000-0x000000000337E000-memory.dmp

                                  Filesize

                                  16.6MB

                                • memory/3596-66-0x00000000022F0000-0x000000000337E000-memory.dmp

                                  Filesize

                                  16.6MB

                                • memory/3596-67-0x00000000022F0000-0x000000000337E000-memory.dmp

                                  Filesize

                                  16.6MB

                                • memory/3596-27-0x00000000022F0000-0x000000000337E000-memory.dmp

                                  Filesize

                                  16.6MB

                                • memory/3596-79-0x0000000000400000-0x0000000000415000-memory.dmp

                                  Filesize

                                  84KB

                                We care about your privacy.

                                This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.