General
-
Target
ff7b4715ae8ab9d62523acd2fdc9ec75_JaffaCakes118
-
Size
96KB
-
Sample
241219-mexycszqey
-
MD5
ff7b4715ae8ab9d62523acd2fdc9ec75
-
SHA1
2b6a96263f14ba908f30bacfbe4cd0e68bf4c521
-
SHA256
0d15e25de5b0c90dea3d15cc08496746bf8b2357408647ffd1169bf3af29ec3c
-
SHA512
83b897c297d31275c9f994dd75d127ea59b5279f90058535db99ce561757a5867a7643febe072128423b03ea1422645bb5b0bcd5d1cc445fdac4e9c2693e0e0b
-
SSDEEP
1536:toYtYBYE+DIZZhNopssyie70gX7QkpFpUuVhVQGaWlpa9Deok2Dyi:DMYE+D8jc7+IWUuhQGagpaLdD7
Static task
static1
Behavioral task
behavioral1
Sample
ff7b4715ae8ab9d62523acd2fdc9ec75_JaffaCakes118.exe
Resource
win7-20240903-en
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Targets
-
-
Target
ff7b4715ae8ab9d62523acd2fdc9ec75_JaffaCakes118
-
Size
96KB
-
MD5
ff7b4715ae8ab9d62523acd2fdc9ec75
-
SHA1
2b6a96263f14ba908f30bacfbe4cd0e68bf4c521
-
SHA256
0d15e25de5b0c90dea3d15cc08496746bf8b2357408647ffd1169bf3af29ec3c
-
SHA512
83b897c297d31275c9f994dd75d127ea59b5279f90058535db99ce561757a5867a7643febe072128423b03ea1422645bb5b0bcd5d1cc445fdac4e9c2693e0e0b
-
SSDEEP
1536:toYtYBYE+DIZZhNopssyie70gX7QkpFpUuVhVQGaWlpa9Deok2Dyi:DMYE+D8jc7+IWUuhQGagpaLdD7
-
Modifies firewall policy service
-
Sality family
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5