General
-
Target
ffe1a30c80c71d343f1d8dbadf2e07aa_JaffaCakes118
-
Size
100KB
-
Sample
241219-vhl92awlhs
-
MD5
ffe1a30c80c71d343f1d8dbadf2e07aa
-
SHA1
21e6dd9457beb8f429addcb0b08c02125a051bba
-
SHA256
f7446599707af682d2a5f95b5115b9a7e714f9f863f0a8b0cd39de13866f7189
-
SHA512
a2b6f91a20ca47097dda175e4a09bc53eccb6c8bd52c492434ad97c473f9512576feea0bf657612a3ad69d644de9d195364d5472e9c578cdcf84d68c358deef5
-
SSDEEP
1536:V+LYbpfDFC5jdNZLG/54Rg4PLl+OjQM6P7sNR2WvmRgXKrfQVR/tCLu67H:HFkz25atdjQNP7s+WORgXKb0/Su6b
Static task
static1
Behavioral task
behavioral1
Sample
ffe1a30c80c71d343f1d8dbadf2e07aa_JaffaCakes118.exe
Resource
win7-20240903-en
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Targets
-
-
Target
ffe1a30c80c71d343f1d8dbadf2e07aa_JaffaCakes118
-
Size
100KB
-
MD5
ffe1a30c80c71d343f1d8dbadf2e07aa
-
SHA1
21e6dd9457beb8f429addcb0b08c02125a051bba
-
SHA256
f7446599707af682d2a5f95b5115b9a7e714f9f863f0a8b0cd39de13866f7189
-
SHA512
a2b6f91a20ca47097dda175e4a09bc53eccb6c8bd52c492434ad97c473f9512576feea0bf657612a3ad69d644de9d195364d5472e9c578cdcf84d68c358deef5
-
SSDEEP
1536:V+LYbpfDFC5jdNZLG/54Rg4PLl+OjQM6P7sNR2WvmRgXKrfQVR/tCLu67H:HFkz25atdjQNP7s+WORgXKb0/Su6b
-
Modifies firewall policy service
-
Sality family
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5