Analysis

  • max time kernel
    93s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/02/2025, 22:27

General

  • Target

    JaffaCakes118_764c68cc55891b7abdd68c768e5cdfc2.exe

  • Size

    776KB

  • MD5

    764c68cc55891b7abdd68c768e5cdfc2

  • SHA1

    b11965e1403bb088406f531322e8a847601d2905

  • SHA256

    5a283c7d6a5eeacaad0a28780ec39037a2baac74dfdd1c2d7a372560b03e6833

  • SHA512

    6c813c0d0c0b6ddffe6757ec532088ea1649740a602913a89e6e23937585c51c2715c15626ddd847fba0359dc7c8eaf0fa327bd86e81e3c64312048ad9478f84

  • SSDEEP

    12288:jQCjbTv7BdOmF1FHYSqZTSuXHoeaWjezQC6Q8D8IwSec5F2XZdJ/+g:XjbT/UZpojzxZ8DSO8XZr+g

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Signatures

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

  • Sality family
  • UAC bypass 3 TTPs 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 5 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • NSIS installer 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs
  • System policy modification 1 TTPs 1 IoCs

Processes

  • C:\Windows\system32\fontdrvhost.exe
    "fontdrvhost.exe"
    1⤵
      PID:764
    • C:\Windows\system32\fontdrvhost.exe
      "fontdrvhost.exe"
      1⤵
        PID:772
      • C:\Windows\system32\dwm.exe
        "dwm.exe"
        1⤵
          PID:1020
        • C:\Windows\system32\sihost.exe
          sihost.exe
          1⤵
            PID:2960
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
            1⤵
              PID:3036
            • C:\Windows\system32\taskhostw.exe
              taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
              1⤵
                PID:992
              • C:\Windows\Explorer.EXE
                C:\Windows\Explorer.EXE
                1⤵
                  PID:3440
                  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_764c68cc55891b7abdd68c768e5cdfc2.exe
                    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_764c68cc55891b7abdd68c768e5cdfc2.exe"
                    2⤵
                    • UAC bypass
                    • Checks whether UAC is enabled
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of WriteProcessMemory
                    • System policy modification
                    PID:1988
                    • C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
                      "C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\
                      3⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • System Location Discovery: System Language Discovery
                      PID:2136
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
                  1⤵
                    PID:3556
                  • C:\Windows\system32\DllHost.exe
                    C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                    1⤵
                      PID:3744
                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                      1⤵
                        PID:3888
                      • C:\Windows\System32\RuntimeBroker.exe
                        C:\Windows\System32\RuntimeBroker.exe -Embedding
                        1⤵
                          PID:3952
                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                          1⤵
                            PID:4044
                          • C:\Windows\System32\RuntimeBroker.exe
                            C:\Windows\System32\RuntimeBroker.exe -Embedding
                            1⤵
                              PID:4144
                            • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
                              "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
                              1⤵
                                PID:4000
                              • C:\Windows\System32\RuntimeBroker.exe
                                C:\Windows\System32\RuntimeBroker.exe -Embedding
                                1⤵
                                  PID:3532

                                Network

                                MITRE ATT&CK Enterprise v15

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                • C:\Users\Admin\AppData\Local\Temp\0E578C81_Rar\Au_.exe

                                  Filesize

                                  700KB

                                  MD5

                                  e1f22a3796634f2bdea37475a2395688

                                  SHA1

                                  42ddb668573c99a705c64d65f07d067e66b8a87e

                                  SHA256

                                  915443a20943cbaf624c10af639f883ae10e7ffe29723adfe8f1a7807a33e157

                                  SHA512

                                  a43d29a643a7b9a45b3f7b1fd8ac52acd157163bfb8af36852324279e6fe0f24f06cf62bdf6aff7f39bf3bd1543d04cb6a62ed78724fb797740b69344208d0c9

                                • C:\Users\Admin\AppData\Local\Temp\nsn8D1F.tmp\System.dll

                                  Filesize

                                  9KB

                                  MD5

                                  a68834422939ba1823fb1f5ac9bee312

                                  SHA1

                                  09ae60e23f7748bf7c05e34dcc707f4283836806

                                  SHA256

                                  39c10b2d8b0811e4e94867f1e7fa00e429bd4f89bf86ad2d8cc41da597ea70c2

                                  SHA512

                                  f87d59584096a73235ebfd581a804c4f97f689a9c39b3d7ce01740a7a10a4bdf7283a062c1d4bb2f97789642d1fe515372706ce0c56d0c10a6ee5e9e3e46c4c2

                                • C:\Users\Admin\AppData\Local\Temp\nsn8D1F.tmp\UserInfo.dll

                                  Filesize

                                  3KB

                                  MD5

                                  987adfbe3c777b9fa35875302eac8d22

                                  SHA1

                                  def74308b0c7ae2036d9d0e1306d4c7158bdb6c7

                                  SHA256

                                  3925ee3235f1acb0acfac6bcc71a311de75792ff81e7b55bc9124319198f7bd6

                                  SHA512

                                  9b3b1b2ef1dabba63b91dd6a8879f1137c3b3e7394afc99f92a6cacd74b1eda286e33b3817d0634e489425f031961b5a647aaee4efecc99e4057a7fde01cb8ad

                                • C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe

                                  Filesize

                                  776KB

                                  MD5

                                  764c68cc55891b7abdd68c768e5cdfc2

                                  SHA1

                                  b11965e1403bb088406f531322e8a847601d2905

                                  SHA256

                                  5a283c7d6a5eeacaad0a28780ec39037a2baac74dfdd1c2d7a372560b03e6833

                                  SHA512

                                  6c813c0d0c0b6ddffe6757ec532088ea1649740a602913a89e6e23937585c51c2715c15626ddd847fba0359dc7c8eaf0fa327bd86e81e3c64312048ad9478f84

                                • memory/1988-5-0x00000000023E0000-0x0000000003410000-memory.dmp

                                  Filesize

                                  16.2MB

                                • memory/1988-8-0x0000000000540000-0x0000000000542000-memory.dmp

                                  Filesize

                                  8KB

                                • memory/1988-4-0x00000000023E0000-0x0000000003410000-memory.dmp

                                  Filesize

                                  16.2MB

                                • memory/1988-12-0x0000000000540000-0x0000000000542000-memory.dmp

                                  Filesize

                                  8KB

                                • memory/1988-20-0x0000000000540000-0x0000000000542000-memory.dmp

                                  Filesize

                                  8KB

                                • memory/1988-0-0x0000000000400000-0x000000000045F000-memory.dmp

                                  Filesize

                                  380KB

                                • memory/1988-32-0x0000000000400000-0x000000000045F000-memory.dmp

                                  Filesize

                                  380KB

                                • memory/1988-11-0x0000000000540000-0x0000000000542000-memory.dmp

                                  Filesize

                                  8KB

                                • memory/1988-9-0x00000000022B0000-0x00000000022B1000-memory.dmp

                                  Filesize

                                  4KB

                                • memory/1988-1-0x00000000023E0000-0x0000000003410000-memory.dmp

                                  Filesize

                                  16.2MB

                                • memory/2136-31-0x0000000000400000-0x000000000045F000-memory.dmp

                                  Filesize

                                  380KB

                                • memory/2136-72-0x0000000000400000-0x000000000045F000-memory.dmp

                                  Filesize

                                  380KB