Analysis

  • max time kernel
    118s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    18-12-2024 02:40

General

  • Target

    f9c81b8a5139063674255967114f54d2_JaffaCakes118.exe

  • Size

    213KB

  • MD5

    f9c81b8a5139063674255967114f54d2

  • SHA1

    b819e9f11ce38a5a062c6d80a31e74b5db69f56e

  • SHA256

    8c7bd2a1f8df671ec341342ca31082be1018f32f60e3ab62e6eb27869d665267

  • SHA512

    5251c6cfec9b91a3fce824b61528284074affa4f053ad0dca2d7fe50d7f0da7e42328269501adf0e642dfc65fb964af646b29e01c91102d00f02c0d14cea7163

  • SSDEEP

    6144:oB7F/YqVV7qEwL3WcL7XAVPKZ7l+uK2zt27l+1LkJeEk:oB5rV5FwTWc/8PW7lVX27lUkJy

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

Signatures

  • Modifies firewall policy service 3 TTPs 3 IoCs
  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

  • Sality family
  • UAC bypass 3 TTPs 1 IoCs
  • Windows security bypass 2 TTPs 6 IoCs
  • Loads dropped DLL 1 IoCs
  • Windows security modification 2 TTPs 7 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Windows directory 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 23 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • System policy modification 1 TTPs 1 IoCs

Processes

  • C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    1⤵
      PID:1108
    • C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      1⤵
        PID:1160
      • C:\Windows\Explorer.EXE
        C:\Windows\Explorer.EXE
        1⤵
          PID:1192
          • C:\Users\Admin\AppData\Local\Temp\f9c81b8a5139063674255967114f54d2_JaffaCakes118.exe
            "C:\Users\Admin\AppData\Local\Temp\f9c81b8a5139063674255967114f54d2_JaffaCakes118.exe"
            2⤵
            • Modifies firewall policy service
            • UAC bypass
            • Windows security bypass
            • Loads dropped DLL
            • Windows security modification
            • Checks whether UAC is enabled
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            • System policy modification
            PID:2308
        • C:\Windows\system32\DllHost.exe
          C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
          1⤵
            PID:800

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\nsyD47F.tmp\System.dll

            Filesize

            9KB

            MD5

            ae182dc797cd9ad2c025066692fc041b

            SHA1

            7ee5f057be9febfa77f698a1b12213a5bbdd4742

            SHA256

            b214f6d6c4d27f749105f7e8846a7c2d475dbcc966876370b5a7dab6e4b8a471

            SHA512

            2a9a200d067df47638a86f4f058c6d78fb59bd064c65650cae5022a62a3714e33f93f6af1dd599fda180d5af18f432835a1f909807f4fb459aa9d6c24e3fbab7

          • memory/1108-9-0x0000000000410000-0x0000000000412000-memory.dmp

            Filesize

            8KB

          • memory/2308-6-0x0000000001DA0000-0x0000000002E2E000-memory.dmp

            Filesize

            16.6MB

          • memory/2308-32-0x00000000002D0000-0x00000000002D1000-memory.dmp

            Filesize

            4KB

          • memory/2308-8-0x0000000001DA0000-0x0000000002E2E000-memory.dmp

            Filesize

            16.6MB

          • memory/2308-5-0x0000000001DA0000-0x0000000002E2E000-memory.dmp

            Filesize

            16.6MB

          • memory/2308-0-0x0000000000400000-0x000000000045E000-memory.dmp

            Filesize

            376KB

          • memory/2308-7-0x0000000001DA0000-0x0000000002E2E000-memory.dmp

            Filesize

            16.6MB

          • memory/2308-1-0x0000000001DA0000-0x0000000002E2E000-memory.dmp

            Filesize

            16.6MB

          • memory/2308-18-0x0000000000270000-0x0000000000272000-memory.dmp

            Filesize

            8KB

          • memory/2308-4-0x0000000001DA0000-0x0000000002E2E000-memory.dmp

            Filesize

            16.6MB

          • memory/2308-40-0x0000000001DA0000-0x0000000002E2E000-memory.dmp

            Filesize

            16.6MB

          • memory/2308-19-0x00000000002D0000-0x00000000002D1000-memory.dmp

            Filesize

            4KB

          • memory/2308-3-0x0000000001DA0000-0x0000000002E2E000-memory.dmp

            Filesize

            16.6MB

          • memory/2308-39-0x0000000000400000-0x000000000045E000-memory.dmp

            Filesize

            376KB