Analysis
-
max time kernel
22s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
04-01-2025 19:26
General
-
Target
JaffaCakes118_7b5ffabad3723579e8c8455a6e85ebf5.exe
-
Size
328KB
-
MD5
7b5ffabad3723579e8c8455a6e85ebf5
-
SHA1
9f865688b6c7467b9a11dffd002b0cae158f6492
-
SHA256
9673ed9c891d934626efdbb865bf81ebca9e15eb03d484dc5aaf81ccfad55817
-
SHA512
e7282d0f87f97c6107f317573c3b705b05bc95e77a7abd77be34d5d4f81879df5ce242766c7b335d19bd13f02e4437a59f8d5f400fe4e2aec817dc8cdc999028
-
SSDEEP
6144:Hz8MtSGRxwyR8LZJ9MV9gYjLPXdDiwyGxS/EBhRZOly:YMDRxxcZ8V9gYHPtRdbZB
Malware Config
Extracted
xtremerat
xstremaa.no-ip.info
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Detect XtremeRAT payload 4 IoCs
-
Modifies firewall policy service 3 TTPs 6 IoCs
-
Sality
Sality is backdoor written in C++, first discovered in 2003.
-
Sality family
-
UAC bypass 3 TTPs 2 IoCs
-
Windows security bypass 2 TTPs 12 IoCs
-
XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
-
Xtremerat family
-
Deletes itself 1 IoCs
-
Windows security modification 2 TTPs 7 IoCs
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Enumerates connected drives 3 TTPs 6 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Suspicious use of SetThreadContext 1 IoCs
-
UPX packed file 24 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 45 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 36 IoCs
-
System policy modification 1 TTPs 1 IoCs
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7b5ffabad3723579e8c8455a6e85ebf5.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7b5ffabad3723579e8c8455a6e85ebf5.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7b5ffabad3723579e8c8455a6e85ebf5.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7b5ffabad3723579e8c8455a6e85ebf5.exe"3⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\svchost.exesvchost.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Deletes itself
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"4⤵
-
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
257B
MD53991426091c20ec8a1d458eb5e0e4fe0
SHA11d5d5262eac6dfeb98491dfc2ea3a14c82a4f26e
SHA2566db79bf1be43ae5fa70e70a5937f4a261a200abb880c6c338e45eef5cf64f1ce
SHA5125d75a8ea62c6d4fd4b4b03291bcd265fe37426b49ca3df4e30ab6d54a88cd3e23fe2de218d60552c7af83b31fa8c7d3eed5b3907342b4d9da3d12cf7081dddca
-
Filesize
100KB
MD5f088d6d36a35e54d211f73431d005871
SHA1eeb431c2a953a9a138826545ea72491404087a56
SHA256b4f5b3a778eb55b2664a04e88ea5917755c4f606b20f225512f300b08828ab62
SHA512bfffcb5acf38d0dacdddb0680e4e41ad5cb16d5ed9fbc28925f2877f2465a6e1cc0b7ffc3cf36276a1c8d4fe852208557ce78093905daf7c48890350b7266ae5
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
16.6MB
-
Filesize
4KB
-
Filesize
380KB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
380KB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
16.6MB
-
Filesize
380KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
380KB
-
Filesize
8KB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
380KB