Analysis

  • max time kernel
    147s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-12-2024 08:12

General

  • Target

    ff1b67d1d50cc56b663de39f3f454d65_JaffaCakes118.exe

  • Size

    100KB

  • MD5

    ff1b67d1d50cc56b663de39f3f454d65

  • SHA1

    ce827ac7d8658467abcc79483dc39f83b455c671

  • SHA256

    c9c5fbb57e38b4f653976b7749052797525ed3ed99cd06f243d69b6ce66ab4f1

  • SHA512

    ea9fcfed8ac3746753978f0ad48f53d41e29e0f9a240c62e04fe729d3580f4144f4fbf8c08adefc72fda9f9b64ab24a42efc00395f7e3cea37728de17798bb7f

  • SSDEEP

    1536:OsW6F3sa40IUzBNCAhJuPZKdrzzcEOWzFhWrrqZwdzmmKWrHH/fs286N8D6Wot5e:OK2zATnJuMdL1xznkGg+A/dWClY

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

Signatures

  • Modifies firewall policy service 3 TTPs 3 IoCs
  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

  • Sality family
  • UAC bypass 3 TTPs 1 IoCs
  • Windows security bypass 2 TTPs 6 IoCs
  • Disables RegEdit via registry modification 1 IoCs
  • Disables Task Manager via registry modification
  • Windows security modification 2 TTPs 7 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file 1 TTPs 2 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • UPX packed file 36 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 11 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 30 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 1 IoCs

Processes

  • C:\Windows\system32\fontdrvhost.exe
    "fontdrvhost.exe"
    1⤵
      PID:792
    • C:\Windows\system32\fontdrvhost.exe
      "fontdrvhost.exe"
      1⤵
        PID:800
      • C:\Windows\system32\dwm.exe
        "dwm.exe"
        1⤵
          PID:420
        • C:\Windows\system32\sihost.exe
          sihost.exe
          1⤵
            PID:2596
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
            1⤵
              PID:2644
            • C:\Windows\system32\taskhostw.exe
              taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
              1⤵
                PID:2808
              • C:\Windows\Explorer.EXE
                C:\Windows\Explorer.EXE
                1⤵
                  PID:3520
                  • C:\Users\Admin\AppData\Local\Temp\ff1b67d1d50cc56b663de39f3f454d65_JaffaCakes118.exe
                    "C:\Users\Admin\AppData\Local\Temp\ff1b67d1d50cc56b663de39f3f454d65_JaffaCakes118.exe"
                    2⤵
                    • Modifies firewall policy service
                    • UAC bypass
                    • Windows security bypass
                    • Disables RegEdit via registry modification
                    • Windows security modification
                    • Checks whether UAC is enabled
                    • Enumerates connected drives
                    • Drops autorun.inf file
                    • Drops file in Program Files directory
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    • Modifies registry class
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of WriteProcessMemory
                    • System policy modification
                    PID:540
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
                  1⤵
                    PID:3648
                  • C:\Windows\system32\DllHost.exe
                    C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                    1⤵
                      PID:3824
                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                      1⤵
                        PID:3916
                      • C:\Windows\System32\RuntimeBroker.exe
                        C:\Windows\System32\RuntimeBroker.exe -Embedding
                        1⤵
                          PID:3992
                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                          1⤵
                            PID:4072
                          • C:\Windows\System32\RuntimeBroker.exe
                            C:\Windows\System32\RuntimeBroker.exe -Embedding
                            1⤵
                              PID:3576
                            • C:\Windows\System32\RuntimeBroker.exe
                              C:\Windows\System32\RuntimeBroker.exe -Embedding
                              1⤵
                                PID:396
                              • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
                                "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
                                1⤵
                                  PID:672
                                • C:\Windows\system32\backgroundTaskHost.exe
                                  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
                                  1⤵
                                    PID:1988

                                  Network

                                  • flag-us
                                    DNS
                                    8.8.8.8.in-addr.arpa
                                    Remote address:
                                    8.8.8.8:53
                                    Request
                                    8.8.8.8.in-addr.arpa
                                    IN PTR
                                    Response
                                    8.8.8.8.in-addr.arpa
                                    IN PTR
                                    dnsgoogle
                                  • flag-us
                                    DNS
                                    154.239.44.20.in-addr.arpa
                                    Remote address:
                                    8.8.8.8:53
                                    Request
                                    154.239.44.20.in-addr.arpa
                                    IN PTR
                                    Response
                                  • flag-us
                                    DNS
                                    88.210.23.2.in-addr.arpa
                                    Remote address:
                                    8.8.8.8:53
                                    Request
                                    88.210.23.2.in-addr.arpa
                                    IN PTR
                                    Response
                                    88.210.23.2.in-addr.arpa
                                    IN PTR
                                    a2-23-210-88deploystaticakamaitechnologiescom
                                  • flag-us
                                    DNS
                                    4.159.190.20.in-addr.arpa
                                    Remote address:
                                    8.8.8.8:53
                                    Request
                                    4.159.190.20.in-addr.arpa
                                    IN PTR
                                    Response
                                  • flag-us
                                    DNS
                                    95.221.229.192.in-addr.arpa
                                    Remote address:
                                    8.8.8.8:53
                                    Request
                                    95.221.229.192.in-addr.arpa
                                    IN PTR
                                    Response
                                  • flag-us
                                    DNS
                                    228.249.119.40.in-addr.arpa
                                    Remote address:
                                    8.8.8.8:53
                                    Request
                                    228.249.119.40.in-addr.arpa
                                    IN PTR
                                    Response
                                  • flag-us
                                    DNS
                                    53.210.109.20.in-addr.arpa
                                    Remote address:
                                    8.8.8.8:53
                                    Request
                                    53.210.109.20.in-addr.arpa
                                    IN PTR
                                    Response
                                  • flag-us
                                    DNS
                                    198.187.3.20.in-addr.arpa
                                    Remote address:
                                    8.8.8.8:53
                                    Request
                                    198.187.3.20.in-addr.arpa
                                    IN PTR
                                    Response
                                  • flag-us
                                    DNS
                                    182.129.81.91.in-addr.arpa
                                    Remote address:
                                    8.8.8.8:53
                                    Request
                                    182.129.81.91.in-addr.arpa
                                    IN PTR
                                    Response
                                  • flag-us
                                    DNS
                                    43.229.111.52.in-addr.arpa
                                    Remote address:
                                    8.8.8.8:53
                                    Request
                                    43.229.111.52.in-addr.arpa
                                    IN PTR
                                    Response
                                  • flag-us
                                    DNS
                                    172.210.232.199.in-addr.arpa
                                    Remote address:
                                    8.8.8.8:53
                                    Request
                                    172.210.232.199.in-addr.arpa
                                    IN PTR
                                    Response
                                  No results found
                                  • 8.8.8.8:53
                                    8.8.8.8.in-addr.arpa
                                    dns
                                    66 B
                                    90 B
                                    1
                                    1

                                    DNS Request

                                    8.8.8.8.in-addr.arpa

                                  • 8.8.8.8:53
                                    154.239.44.20.in-addr.arpa
                                    dns
                                    72 B
                                    158 B
                                    1
                                    1

                                    DNS Request

                                    154.239.44.20.in-addr.arpa

                                  • 8.8.8.8:53
                                    88.210.23.2.in-addr.arpa
                                    dns
                                    70 B
                                    133 B
                                    1
                                    1

                                    DNS Request

                                    88.210.23.2.in-addr.arpa

                                  • 8.8.8.8:53
                                    4.159.190.20.in-addr.arpa
                                    dns
                                    71 B
                                    157 B
                                    1
                                    1

                                    DNS Request

                                    4.159.190.20.in-addr.arpa

                                  • 8.8.8.8:53
                                    95.221.229.192.in-addr.arpa
                                    dns
                                    73 B
                                    144 B
                                    1
                                    1

                                    DNS Request

                                    95.221.229.192.in-addr.arpa

                                  • 8.8.8.8:53
                                    228.249.119.40.in-addr.arpa
                                    dns
                                    73 B
                                    159 B
                                    1
                                    1

                                    DNS Request

                                    228.249.119.40.in-addr.arpa

                                  • 8.8.8.8:53
                                    53.210.109.20.in-addr.arpa
                                    dns
                                    72 B
                                    158 B
                                    1
                                    1

                                    DNS Request

                                    53.210.109.20.in-addr.arpa

                                  • 8.8.8.8:53
                                    198.187.3.20.in-addr.arpa
                                    dns
                                    71 B
                                    157 B
                                    1
                                    1

                                    DNS Request

                                    198.187.3.20.in-addr.arpa

                                  • 8.8.8.8:53
                                    182.129.81.91.in-addr.arpa
                                    dns
                                    72 B
                                    147 B
                                    1
                                    1

                                    DNS Request

                                    182.129.81.91.in-addr.arpa

                                  • 8.8.8.8:53
                                    43.229.111.52.in-addr.arpa
                                    dns
                                    72 B
                                    158 B
                                    1
                                    1

                                    DNS Request

                                    43.229.111.52.in-addr.arpa

                                  • 8.8.8.8:53
                                    172.210.232.199.in-addr.arpa
                                    dns
                                    74 B
                                    128 B
                                    1
                                    1

                                    DNS Request

                                    172.210.232.199.in-addr.arpa

                                  MITRE ATT&CK Enterprise v15

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads

                                  • F:\xieegp.pif

                                    Filesize

                                    100KB

                                    MD5

                                    873e81ff8f8425ec60faaba1d946c575

                                    SHA1

                                    375b16f2e04ca4718da4c8950a1528ba9f48cb08

                                    SHA256

                                    5e9d57fa2f21989339dbb105aa7543867f64c87a9231c35f6c6ca9e4ad3be537

                                    SHA512

                                    78b950f66fbb74007f4725b932300bbe989e96660e67e383673c51e98d0cfa230659bc041bf2b24eca276c26546bce9e91e4874409b283e1df925763300172af

                                  • memory/540-25-0x00000000021C0000-0x000000000324E000-memory.dmp

                                    Filesize

                                    16.6MB

                                  • memory/540-7-0x00000000006D0000-0x00000000006D1000-memory.dmp

                                    Filesize

                                    4KB

                                  • memory/540-4-0x00000000021C0000-0x000000000324E000-memory.dmp

                                    Filesize

                                    16.6MB

                                  • memory/540-0-0x0000000000400000-0x0000000000415000-memory.dmp

                                    Filesize

                                    84KB

                                  • memory/540-6-0x00000000006B0000-0x00000000006B2000-memory.dmp

                                    Filesize

                                    8KB

                                  • memory/540-9-0x00000000006B0000-0x00000000006B2000-memory.dmp

                                    Filesize

                                    8KB

                                  • memory/540-11-0x00000000006B0000-0x00000000006B2000-memory.dmp

                                    Filesize

                                    8KB

                                  • memory/540-8-0x00000000021C0000-0x000000000324E000-memory.dmp

                                    Filesize

                                    16.6MB

                                  • memory/540-5-0x00000000021C0000-0x000000000324E000-memory.dmp

                                    Filesize

                                    16.6MB

                                  • memory/540-10-0x00000000021C0000-0x000000000324E000-memory.dmp

                                    Filesize

                                    16.6MB

                                  • memory/540-13-0x00000000021C0000-0x000000000324E000-memory.dmp

                                    Filesize

                                    16.6MB

                                  • memory/540-14-0x00000000021C0000-0x000000000324E000-memory.dmp

                                    Filesize

                                    16.6MB

                                  • memory/540-12-0x00000000021C0000-0x000000000324E000-memory.dmp

                                    Filesize

                                    16.6MB

                                  • memory/540-15-0x00000000021C0000-0x000000000324E000-memory.dmp

                                    Filesize

                                    16.6MB

                                  • memory/540-16-0x00000000021C0000-0x000000000324E000-memory.dmp

                                    Filesize

                                    16.6MB

                                  • memory/540-26-0x00000000006B0000-0x00000000006B2000-memory.dmp

                                    Filesize

                                    8KB

                                  • memory/540-18-0x00000000021C0000-0x000000000324E000-memory.dmp

                                    Filesize

                                    16.6MB

                                  • memory/540-19-0x00000000021C0000-0x000000000324E000-memory.dmp

                                    Filesize

                                    16.6MB

                                  • memory/540-21-0x00000000021C0000-0x000000000324E000-memory.dmp

                                    Filesize

                                    16.6MB

                                  • memory/540-22-0x00000000021C0000-0x000000000324E000-memory.dmp

                                    Filesize

                                    16.6MB

                                  • memory/540-1-0x00000000021C0000-0x000000000324E000-memory.dmp

                                    Filesize

                                    16.6MB

                                  • memory/540-3-0x00000000021C0000-0x000000000324E000-memory.dmp

                                    Filesize

                                    16.6MB

                                  • memory/540-17-0x00000000021C0000-0x000000000324E000-memory.dmp

                                    Filesize

                                    16.6MB

                                  • memory/540-27-0x00000000021C0000-0x000000000324E000-memory.dmp

                                    Filesize

                                    16.6MB

                                  • memory/540-29-0x00000000021C0000-0x000000000324E000-memory.dmp

                                    Filesize

                                    16.6MB

                                  • memory/540-30-0x00000000021C0000-0x000000000324E000-memory.dmp

                                    Filesize

                                    16.6MB

                                  • memory/540-33-0x00000000021C0000-0x000000000324E000-memory.dmp

                                    Filesize

                                    16.6MB

                                  • memory/540-37-0x00000000021C0000-0x000000000324E000-memory.dmp

                                    Filesize

                                    16.6MB

                                  • memory/540-39-0x00000000021C0000-0x000000000324E000-memory.dmp

                                    Filesize

                                    16.6MB

                                  • memory/540-40-0x00000000021C0000-0x000000000324E000-memory.dmp

                                    Filesize

                                    16.6MB

                                  • memory/540-41-0x00000000021C0000-0x000000000324E000-memory.dmp

                                    Filesize

                                    16.6MB

                                  • memory/540-44-0x00000000021C0000-0x000000000324E000-memory.dmp

                                    Filesize

                                    16.6MB

                                  • memory/540-46-0x00000000021C0000-0x000000000324E000-memory.dmp

                                    Filesize

                                    16.6MB

                                  • memory/540-53-0x00000000021C0000-0x000000000324E000-memory.dmp

                                    Filesize

                                    16.6MB

                                  • memory/540-55-0x00000000021C0000-0x000000000324E000-memory.dmp

                                    Filesize

                                    16.6MB

                                  • memory/540-57-0x00000000021C0000-0x000000000324E000-memory.dmp

                                    Filesize

                                    16.6MB

                                  • memory/540-59-0x00000000021C0000-0x000000000324E000-memory.dmp

                                    Filesize

                                    16.6MB

                                  • memory/540-60-0x00000000021C0000-0x000000000324E000-memory.dmp

                                    Filesize

                                    16.6MB

                                  • memory/540-64-0x00000000021C0000-0x000000000324E000-memory.dmp

                                    Filesize

                                    16.6MB

                                  • memory/540-65-0x00000000021C0000-0x000000000324E000-memory.dmp

                                    Filesize

                                    16.6MB

                                  • memory/540-67-0x00000000021C0000-0x000000000324E000-memory.dmp

                                    Filesize

                                    16.6MB

                                  • memory/540-24-0x00000000021C0000-0x000000000324E000-memory.dmp

                                    Filesize

                                    16.6MB

                                  • memory/540-78-0x0000000000400000-0x0000000000415000-memory.dmp

                                    Filesize

                                    84KB

                                  We care about your privacy.

                                  This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.