Analysis
-
max time kernel
118s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
01/01/2025, 05:34
General
-
Target
JaffaCakes118_4904115ffc4d10ac6804132dc4e1c3c2.exe
-
Size
1.0MB
-
MD5
4904115ffc4d10ac6804132dc4e1c3c2
-
SHA1
7b8dc7072f0ffcda7b8148f83d88c0c6356a601c
-
SHA256
061a3793a685845faa831e978a157cd62de65d8b88ebbcc3437f6d8560e5d837
-
SHA512
ee55d701182bf91da3ced32b1df5c2efddf4c59aae85cf2624a09f6b68bcc4f47bc205a6e35404b649601944984253a8dc79753a929a4b06be4656c834c08270
-
SSDEEP
24576:Bg3tuuiNxt18zAa0BvdViiTz1zB1xnalvW:ituui/tuH0bVlSlvW
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Modifies firewall policy service 3 TTPs 3 IoCs
-
Sality
Sality is backdoor written in C++, first discovered in 2003.
-
Sality family
-
UAC bypass 3 TTPs 1 IoCs
-
Windows security bypass 2 TTPs 6 IoCs
-
Loads dropped DLL 2 IoCs
-
Windows security modification 2 TTPs 7 IoCs
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Enumerates connected drives 3 TTPs 11 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
UPX packed file 30 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies Internet Explorer settings 1 TTPs 34 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 24 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 6 IoCs
-
Suspicious use of WriteProcessMemory 16 IoCs
-
System policy modification 1 TTPs 1 IoCs
Processes
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4904115ffc4d10ac6804132dc4e1c3c2.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4904115ffc4d10ac6804132dc4e1c3c2.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Loads dropped DLL
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵
-
C:\Windows\system32\taskeng.exetaskeng.exe {F45E1402-D912-4C1C-9AF9-C24AB9F65D00} S-1-5-21-4177215427-74451935-3209572229-1000:JSMURNPT\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://www.skype.com/go/downloading?source=lightinstaller&ver=5.1.0.104&LastError=120072⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1068 CREDAT:275457 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
342B
MD52ef3a1f9898af99e9deb061a58d9d9ec
SHA1daf84c8811295ad25892b3544b6a13357b0d2eeb
SHA256307d92dabad9c01751aecde1747a3f3760c27f893392b66925a5d0b5a87d17a8
SHA5126441c791c06532a6f3a2a646c0c45c9d37982b143c78f575c1d48bfd2711e2abe2fb810c657ced9759e77d6171a7280f2e4936b2ada11c692aeea4d659d1d64f
-
Filesize
342B
MD5101df68a6af22bad7926daf1ccc6ca0c
SHA131162e8cc5f4cfd7c7c0d4875294552735ea228a
SHA2561b5d380eefa2f4c61197ee28d8548bfb7caba8c57de5db99069ebe4e1a2b51ad
SHA5122896e14983ae97d95e2afa409bec7a9f09e8cadd8a61a3517fbad21c15f9f38a459d57177896d2cb020d56287fec6de816a044757a62b520445d01742e442cd9
-
Filesize
342B
MD559efbdbaadd7dda9a2aa86fdc3aba86b
SHA1f95ffaabf467a4c86a6509352c58564aaa207979
SHA256c78b02e3eb4cb214a611088cee26f7db3d92dce73d7ba91433e10e0e1031e49c
SHA51277440b2329252bce53c5b7383bbf4277ce4fb0e89a5431e3b300fe288f315d40c806e33d54a7a7a57c92afa4fe8057aa940d13af1048f8e6a8666296bbc1b7bf
-
Filesize
342B
MD538e2358ea14385c6381372daa8c3b832
SHA1382d0873ba7fc19672bea0a3271d033f93ef14e9
SHA25631693beec540d3327ed9b5ddc7dcbc6e20f32a7fe198820b848c924b1f913892
SHA5120475c4a9469242728748e923d3bd3c65f5968bf54da5c78a230f2112a187573ad933d008c9061a681533c16364d0e52ef8f46172194e7018d76973f388b76334
-
Filesize
342B
MD5e0f64db4e1dd2566fb07e649c61356bf
SHA1b67471ca2b97b6a286f99f7b98e26419dd234a24
SHA2560089d8b0dea6d64d07f71364f31a8226478e44b0c71dbe8e24bb16fb9e185643
SHA512df846821ab7b61f13c5229fdd50a889057e76ae2ad25e0ac3c39932549bc6a3dffc0e2152c493ba5c0c400475e577c8fa5b21ac24361a1a2c9b7bc203ddcdf49
-
Filesize
342B
MD5528c5bbea9dca71e705b27d376377444
SHA1d9acfad1b9a8616d73651c48f1751d920f7daf69
SHA2567c4eabe2467e00f5b26ee72c2675b747b493046af11521e8651fcb61e1f5b6e0
SHA5128082405b9ebc9918b63f3c3d7abd7315c0166222cb1e0efec08a734be7ef4483d26fe60d9d6e58b58ff89fa81329afba33fb461d6b144c1a0e748dce21e1218b
-
Filesize
342B
MD5a0c2ac680a036cf9bc99671509fba05f
SHA1eff71c4bff02f6f76158f7a4c60f0d68980312db
SHA25691063a8a447741dc8eeb3075ed6585689c4577ff357e7e460d6a4389fb6c5d24
SHA5125b42101f926a9f5144f81d69e8b35404674ebd1ca8b1b428af09a7dc6ce6b68bcee7f21a8a26dc78a981d0366c77931888caa9f2cc25e77a6572a03e85d9663e
-
Filesize
342B
MD5f90972348cf17eb6d75050b09d78d738
SHA1efd7de4f8080ff653c3f4c9fa17eaeb49d0088e1
SHA2563b9c50bd4d66f735ba3bc0131a94457f301c25298bfbe60bb187c080a32ee857
SHA51228becf410abc81419ada49753d20fdec81d35662afdd26c63af4869d2412557cf7fe5afcb7cd99ff58aa2f737a07d0a1ffa02bc180c9da02e3ef9eb0a7f1c135
-
Filesize
342B
MD506b22cbb0cc4d4066000e1a9ed8f498d
SHA17290506f97d72c353609c0f8ec6b708655e1174a
SHA2563a53ef72c94d2513166209839d52ac9e93a2e9ae61adb4f9c61ef73d817e6578
SHA51230b574b8cc7c4c63c94d3ca4096f4c69117a65af9f190b811db67a64a38900918b67cb7197c5cd6e6f4becd61feb554058c1dc01d3f5f66d4e54f2ce6a7fbdf6
-
Filesize
342B
MD5516b74ce2436eeb1ca1631e96b240a35
SHA1cec8a2a623596bf54a06bb2dd7e6b6a68475746d
SHA256980601cd0f067296d72a65aa7d1985a03f3df8fa0f8b4b777d70028c84bcd3f8
SHA5128ea09dd1f39b7c166ee72a05dc1981eb804a17739952c455501ded8f5ba34121b2b6f67762f8b1d7050d4562b0c66be27af6dfe8ff69c189924b646f78353ce3
-
Filesize
342B
MD50e02e647f15e8629c754fb307ecf030f
SHA1b6ac39ba3240d1b3e4572f0ec605bab96fc173af
SHA2567ce13b937c7cc19560076d4428ed999b90133541f4fda9e26502b1290d3bd724
SHA512d845451d35f10a4346b742a8c781d4011b6e4910cb61201778e9ed840644abc354a75eafee4d9678c4032139c49522a27fb9a2f7c3d7522991c5b621c974523e
-
Filesize
342B
MD5f881752cf094170ac65930561171e7ff
SHA1623e157d6f5f39a326beb618f19f9e80eeb57e3e
SHA2567dce03222b3fc21d29192a1e36a0028ae6907d151258376516c5e010871f90cc
SHA512b146be4d1a0a87e65e0cb8aef0f0021791c8ce6ab65db79dc24c617212c0e65965a7a4a3773e39362c0adb8c8ad975a9240b302eb4612a2ffb7d89e83c4e44a6
-
Filesize
342B
MD510eb7bbf1e4d69caa7826b51780d07b6
SHA117a1675358fd3fa10eb1251d100132fab3bf6fcc
SHA2564112cf76b65b8847d2d55ceeb2c0cc6380fbdc397bb2daaddc2e6ab57f64cc02
SHA5124ec5394f603cc3eb9877bc1cda3d9db931041be07fec477a8b85803af9f04a02aed809558104696d9daabafc83b71b07dfa861faf0ae7298978c1a619900d7dc
-
Filesize
342B
MD5642f6ae41a475cae033de89b72926569
SHA1b9735c43a6dec564cb79d52897a411f47b933872
SHA256ea0c35e542ecd9fe052bcf39b89f6323b97fddf1f78a6d6da47f735d98710777
SHA5123cce337cd10e8264b5ee91d8c34ae8ba889b940bec88adecaa53b7a1a85d49e9369863dc51ffea0780e10af09cd7f5576ac1f5a9a104a56c4248d58a8f718a46
-
Filesize
342B
MD5c229d599340fe6504748a75965499922
SHA1a4e2f69159c838b78ad6a623a9192babfc88b512
SHA2562c0723f13c6cc9164e15ebaf914ec405c790d166810ee362294060867715f8bd
SHA51254edfbf74a3afe1d33f24ab85a06f6ec9989dd0248e76f07fbe1273991f9dd34582ff8db03ebe4282eb1a9a8d59943ad78f5b50627bd59f0f68e3beb87587384
-
Filesize
342B
MD5597e75c9ffefd9b0e6c222571dd86ffa
SHA10354331a3b78550315dbae2d7b05a85a50b0fb4d
SHA256098efa2df33166afb3e19f3ac397e850f1f67604d0c2a0cea7d6d9d4635bb9ba
SHA5123ea4b42666eb53b9595adc7b9555febb34cc718ad966c859ba1277cae5c1ddda4487d7c43703b731ceaf30040755e2585e49ad6219d2865d1416ba0b4c32f5ca
-
Filesize
342B
MD5be118a5748dfb592efb0749b75dbf763
SHA19f2ee703174171adce2c6af74dfd27b794bf9296
SHA256f2285576c51d380b9414458b34b97e904b2d5766198573835802f54ec705cb35
SHA51236e9f9a5b2924e224ddd820eaba6fc9814a290237c30402a0d0bf9c553ceaa7050a0f60ba70ed4ba5ec4990a27dfc5ce75a3af5d336aa548344c7336272fec08
-
Filesize
342B
MD5338cdecb28ee80eda92b35a1f2463e48
SHA1a7552aefe55c0aae46b4933ec6a137555716f9eb
SHA256fd500d8e68dd9aa07e6d618f38b821e3464667fe4674b7f334c941ecb10007b5
SHA512dde6fa068a237b6def0bf36e2c12d9a67852f154d3ea9ff1a418f696f899a744caf3c55d272f8d74bc89e1bbd6edd2cffa80da27a4440e8274553a510dbd6184
-
Filesize
342B
MD5ae009dd71f255da85e80b3d1b902dbfc
SHA1e03a3c39d24fb40e33e8f2c7afd3911727976b3a
SHA256f6847cbf978984d6376fa452ef82c2d3b2ded94e4d8a9ecb2fabf1d3802edd70
SHA512a73053a0769f35edee0d5f1caebd14880f811b907b709c9ea334607a2fa6e2b9f3346341394262b61142954f2d8c201d709cb1934a57ffe5ce13190ce7b1e8d4
-
Filesize
342B
MD51bd5e3dd8de7265911153c23c3c6f035
SHA117f814b29ba9db26d6b419efc962f17c564b37a5
SHA2562c389a358fe272b4e211d084cf046fc311d78535997a3c96f370b19e757ac9d4
SHA51295f6d6e350852013e755eecd116b5b8dcb516117165e3c67d6ed1305fe402b930cb36a38b127e4375ed304cfd5375077a2a02fd32f5a2b299e8c00864a8e3bce
-
Filesize
342B
MD5baf2b5f227316edc70d8283e5c256bdf
SHA197946e50c0b8d536ec430270e4695a8df57537c4
SHA25600b0d96eef7f802068081a871e8e7978e030d4922719f8a615f18a9ee04e9af3
SHA512813b962e08454a593adf029f8945fcd7822ff53843e2b42a4e4e68d771cfcf5ef5add341e9fce2627531b49f8fb72a36046a9bb11d44889db63c601c634afed2
-
Filesize
342B
MD5b77d2ace4573503c774f3adf60a2cb4d
SHA1e482c67e7c9c20f744db5095b1fc66dd4bdcf526
SHA2560d83ddc85bec911b218183caafb21c49d71409f73834658b3c5c252ed777b986
SHA51201eaa119c83152647fe392575ed1909089e61082434d4bc0d58d2aa79062210dc2970dd360fc410ec1db7c417a54532d917a55d85a0bd55af414449cdc40cf58
-
Filesize
342B
MD58cd47bc572248b91cf3948df9e3adae8
SHA1c2f7ae288702e07742bff229f87e48dce83ab713
SHA256703be4e91f5d87fe13892a85f0f0eeecc6df5dfe81a10b8a1d0092443e225e6c
SHA512160391694ed5828f650f2039e8cbf63dfa3c46332e9edee8fc06293ed0184d5e2aefe4f8905b3c07cb328dd5544a94e6fd6ed43b82b8aee394d4dad18b65ebf9
-
Filesize
342B
MD55c97e47c334973966f7b2d0c7fba0a09
SHA166438828f7e5cbdd3914ace653a3d5d6174fbe2a
SHA256e377e85d6f326c54915b138bb947beb3696a61494ffe67248da4d8599af29a20
SHA512412232db09014b88db26eb592d1bea1e4c72e9c5bd672416e979269eb858b650d4ecd9851395a77b0c30cbd43f9a50493a76df72a7faf7955b3eaa0b3870640d
-
Filesize
342B
MD58b01822f71c058bb414ca2b0cba37110
SHA16457e20833abe81aa73f97f61a490e11b196e1ef
SHA2567f7a38f7853156de740d6251d47b2545c2c02b613b3bd6803ce90ba34fdd97ab
SHA5120a843099e8779367360ed94b22dc1d602549e5a2378124524df92ff241001912a156561a80235bd8312e8f1c69bb4da4e96ba494c567b073e06574f79b0c81b2
-
Filesize
342B
MD58f06c58bdf785e94f207b584518b2cf3
SHA17a76e1259cac6eaf2b6ddd8b83e32ff5c42f40c2
SHA256368f589211934736ec37265cfb4248d33025021da9bad507d9791bf8c12c75d7
SHA512d486a4df3fa53718aac4dbb706ec04dbfdaf34f328ea1fc9ab116758167e246b4dade8e7b8c992295f701f9827a3a7eb1d09efea0052ef0377fbf45446a22336
-
Filesize
342B
MD54a3110bb5d3c81d3ae26537e39c9ecee
SHA1da9a2397ab71092afce1bc26de4606fa3f9b81d2
SHA25638dcbd95fa19441567854b7efe98b8bbfc1e36db7d6225d77177c550dffc5e73
SHA51297c096db9218c4167dbace02bacefb5375ad614f50928b43a2bce1e89740ac276fbf1e038c44b4301a3c44298f5599c0222fdeaab26a63fa8ca07ab9b3f9c22c
-
Filesize
342B
MD5368ebd93b7e8f142a17d75d1bee71537
SHA15efc58da437f0ae614a3e9b0ee9c235046430d7f
SHA256e520dcb2873031c9dc1782688204fe7c7e50a5d22fe381218b1534df3eb9e4d6
SHA51288ff991c59c5b32b5fbe5b967b8741bf395c286e873b83a4c3f84d9948290e5b1078de6bdaf42a4064c41406cadf3b59c1175e39a38cf4ed3a570ea791c4f2c0
-
Filesize
342B
MD5f650dc78604ee2c32a93509e831d5479
SHA1e46f7184c4c57f60106e32a775807f07a89e95b9
SHA2563b3ef804bc116341881177a12e571ea1eafa1680a5562d32b780d4f4d51a8f78
SHA512d6d52d791d9325a6480908828f77fa05a567106f8d362af7c2dd90faaf2ebecb818191eaec4ba2df8709c31dae913587c5705789c964005645d8497317c43711
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
62KB
MD582331d322adf2d0d07363549012f7104
SHA1b423195a39b3e91978d8ebfe8a23d40cffd561f6
SHA256e1b7b081a51ce54a27b1b0bdf8c661e956ec3ae32d6c547c21c49b4e914b27bb
SHA512b7392a74c981828c309e111181e9e10dc7e252e6bb821e631cc93ba789db58aee145416ae453e710601c6cb839299b304b2166f1950155dd73b10c798a746160
-
Filesize
73KB
MD564f15c1e67d305bf5522ece465019b50
SHA1c54d95b98dd0f32adccb46e1030d13ca81ea9aae
SHA256bdc0326c2864498243657cc2c76d31816c208f5b159f0991b3698f093cf64619
SHA51274710ce2f6473b61176c31a180c973b0ad39b6159772de13eb3fd9f0c40864884687ee47bd9e67c6667702f7a8c02c2f5f79e0e19a2a3d6b369e7246a03fb8c6
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
2.6MB
-
Filesize
8KB
-
Filesize
2.6MB
-
Filesize
16.6MB
-
Filesize
8KB
-
Filesize
16.6MB
-
Filesize
4KB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
2.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
2.6MB
-
Filesize
16.6MB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
4KB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB