Overview

overview

10

Static

static

3

JaffaCakes...f0.exe

windows7-x64

10

JaffaCakes...f0.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    118s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    31-12-2024 04:50

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    JaffaCakes118_054cb8e52eae74d8d687e9e6309f04f0.exe

  • Size

    535KB

  • MD5

    054cb8e52eae74d8d687e9e6309f04f0

  • SHA1

    27d05d857a06e8864196b429a766a659479e0ccb

  • SHA256

    6ce3c2bec1dcbdc83c38c99069044a13a66815ee60afb9d3689fb42c4a41c481

  • SHA512

    8005bda9aacb38d29d7606a125b670ee35d28a8f7ac24376acfb02e82cfa5011cdd986727d958d6fce29b56cf65c08f7996cd90ac62df8519d1c69b832e1b550

  • SSDEEP

    12288:PrarZT4PhqyfI0h0bMcIP6KlOAJKwwKmxkcjLP/Ts/056Y66zCbuc:DPhW0h0bMcIP6Q5Qw8Gc7sPMCbuc

Score
10/10
salitybackdoordiscoveryevasiontrojanupx

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

Signatures

  • Modifies firewall policy service 3 TTPs 3 IoCs
    evasion
  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality
  • Sality family
    sality
  • UAC bypass 3 TTPs 1 IoCs
    evasiontrojan
  • Windows security bypass 2 TTPs 6 IoCs
    evasiontrojan
  • Loads dropped DLL 1 IoCs
  • Windows security modification 2 TTPs 7 IoCs
    evasiontrojan
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System policy modification 1 TTPs 1 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_054cb8e52eae74d8d687e9e6309f04f0.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_054cb8e52eae74d8d687e9e6309f04f0.exe"
    1⤵
    • Modifies firewall policy service
    • UAC bypass
    • Windows security bypass
    • Loads dropped DLL
    • Windows security modification
    • Checks whether UAC is enabled
    • System Location Discovery: System Language Discovery
    • System policy modification
    PID:856

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\nsdD5D6.tmp\System.dll
    Filesize

    11KB

    MD5

    c17103ae9072a06da581dec998343fc1

    SHA1

    b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

    SHA256

    dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

    SHA512

    d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

    Download Submit

  • memory/856-0-0x0000000000400000-0x000000000045B000-memory.dmp

    Filesize

    364KB

    Download

  • memory/856-7-0x0000000001DC0000-0x0000000002E4E000-memory.dmp

    Filesize

    16.6MB

    Download

  • memory/856-12-0x0000000000400000-0x000000000045B000-memory.dmp

    Filesize

    364KB

    Download

  • memory/856-13-0x0000000001DC0000-0x0000000002E4E000-memory.dmp

    Filesize

    16.6MB

    Download