Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
28-01-2025 16:19
General
-
Target
JaffaCakes118_4cdf6d282861677c309d96b2441ae3e3.exe
-
Size
984KB
-
MD5
4cdf6d282861677c309d96b2441ae3e3
-
SHA1
4835dec84f5508b2df0de81e6038cf17bd145264
-
SHA256
ef4f716f836c643c0f24f1478618d4d83a9dfddde7eadabdf076b5cabb776fd5
-
SHA512
c1f5c37cadc1b01632b412635a698f6e3e261fdc0ddfcb3fdbeb583e1f69f30ee5d1f8ca61f1f29a8f9516e57d9d0444c76d75f79fb86e23ff72755ee043c363
-
SSDEEP
12288:WFeOkxOVGeOG6gCpu/14Gl6fRvxOl+p647fZXZxk:WFeOkxOVr16/0N2fRvxu/qY
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
-
Sality
Sality is backdoor written in C++, first discovered in 2003.
-
Sality family
-
UAC bypass 3 TTPs 2 IoCs
-
Windows security bypass 2 TTPs 12 IoCs
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 6 IoCs
-
Windows security modification 2 TTPs 14 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Checks whether UAC is enabled 1 TTPs 2 IoCs
-
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory 1 IoCs
-
UPX packed file 19 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 45 IoCs
-
Suspicious use of SetWindowsHookEx 6 IoCs
-
Suspicious use of WriteProcessMemory 22 IoCs
-
System policy modification 1 TTPs 2 IoCs
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4cdf6d282861677c309d96b2441ae3e3.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4cdf6d282861677c309d96b2441ae3e3.exe"2⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Newbie Cleaner V.5.exe"C:\Users\Admin\AppData\Local\Temp\Newbie Cleaner V.5.exe"3⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
-
C:\Windows\SysWOW64\SYSTEM99RUNNER.exe"C:\Windows\SYSTEM32\SYSTEM99RUNNER.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Newbie Cleaner V.5.exe"C:\Users\Admin\AppData\Local\Temp\Newbie Cleaner V.5.exe"4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
292KB
MD5c9d264149952ab440fd3c26c1a049baa
SHA1a39b83d27277cefc1e4a38976411c617ced51328
SHA2569f62eafaa20d26673858796dfd999840e995620de0403adb209f62bef0ba5c87
SHA51268b3c67ff90d9905c757bfc127773995316943860ce6a07bad852b7f16143cb839298912e266322961c29da0ed7f5fae05f90271ccd2d3e4517d8ab2f9f9e0ea
-
Filesize
257B
MD57a4b8ff4f117dd3423ced7fd72a5729c
SHA144a7d72b7764460641fe3168dac3c215055a29e9
SHA256824bc7cd03423b1f854eca66f052f41ff8bedab6ec4bd3a194e8070401387003
SHA51226f900b5490f557bbc5ecaf347232d96f2b3f2dd2ee718738cee435e2d5acacc5809caa4c1d47df713a8daad74da30473ae9adf6e117600569dfee8fa5f52813
-
Filesize
984KB
MD54cdf6d282861677c309d96b2441ae3e3
SHA14835dec84f5508b2df0de81e6038cf17bd145264
SHA256ef4f716f836c643c0f24f1478618d4d83a9dfddde7eadabdf076b5cabb776fd5
SHA512c1f5c37cadc1b01632b412635a698f6e3e261fdc0ddfcb3fdbeb583e1f69f30ee5d1f8ca61f1f29a8f9516e57d9d0444c76d75f79fb86e23ff72755ee043c363
-
Filesize
8KB
-
Filesize
300KB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
300KB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
300KB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
300KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
300KB
-
Filesize
4KB
-
Filesize
8KB