Analysis
-
max time kernel
0s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
01-02-2025 20:30
General
-
Target
JaffaCakes118_757839be7d20eef30809a52a774df7ab.exe
-
Size
6.1MB
-
MD5
757839be7d20eef30809a52a774df7ab
-
SHA1
992a32971b84eb6b9db71ba22e70fef4c635b8ad
-
SHA256
27c6086a75d379eda91fdc5c3212c7e8ea7b4f668efb9873aaa639ccaf9b3c74
-
SHA512
68a0469c0d98468a542fda3d4e65fb8064f5c2202120d06de9b1bdea0deeb999280badf5fe42e2b2fd7fec91f8c68726d3b007afbbb070f78b52bdc158da35f8
-
SSDEEP
196608:FhMYfTWXjB33vQgUMW2TNW7bRnpySPHnlRyXyKEe5wO:F8nU8WtnpySHnlA0O
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Modifies firewall policy service 3 TTPs 3 IoCs
-
Sality
Sality is backdoor written in C++, first discovered in 2003.
-
Sality family
-
UAC bypass 3 TTPs 1 IoCs
-
Windows security bypass 2 TTPs 6 IoCs
-
Disables RegEdit via registry modification 1 IoCs
-
Disables Task Manager via registry modification
-
Windows security modification 2 TTPs 7 IoCs
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
UPX packed file 46 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
System policy modification 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_757839be7d20eef30809a52a774df7ab.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_757839be7d20eef30809a52a774df7ab.exe"1⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Disables RegEdit via registry modification
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\HssInstaller.exe"C:\Users\Admin\AppData\Local\Temp\HssInstaller.exe" -iswow642⤵
-
-
C:\Users\Admin\AppData\Local\Temp\HssInstaller.exe"C:\Users\Admin\AppData\Local\Temp\HssInstaller.exe" -vmcheck2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\HssInstaller64.exe"C:\Users\Admin\AppData\Local\Temp\HssInstaller64.exe" -installdriver -c2⤵
-
-
C:\Program Files (x86)\Hotspot Shield\bin\HssInstaller.exe"C:\Program Files (x86)\Hotspot Shield\bin\HssInstaller.exe" -installhssie "C:\Program Files (x86)\Hotspot Shield\HssIE" "C:\Users\Admin\AppData\Local\Temp\nsyB1C3.tmp\HssIE.dll" "C:\Users\Admin\AppData\Local\Temp\nsyB1C3.tmp\HssIE_64.dll" -product hss2⤵
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /s "C:\Program Files (x86)\Hotspot Shield\HssIE\HssIE_64.dll"3⤵
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Hotspot Shield\HssIE\HssIE_64.dll"4⤵
-
-
-
-
C:\Program Files (x86)\Hotspot Shield\HssWPR\HssInstaller64.exe"C:\Program Files (x86)\Hotspot Shield\HssWPR\HssInstaller64.exe" -installdriver -i "C:\Program Files (x86)\Hotspot Shield\HssWPR"2⤵
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{7af05c77-7b6b-30af-2a37-690a10ab7734}\nethss.inf" "9" "6b33badeb" "0000000000000578" "WinSta0\Default" "00000000000005B0" "208" "C:\Program Files (x86)\Hotspot Shield\HssWPR"1⤵
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Windows\system32\pnpui.dll,InstallSecurityPromptRunDllW 20 Global\{2cc8e36b-f7fc-0702-b5f6-9d30623bd115} Global\{305812d3-e6fc-6ba7-6584-d9407979da0c} C:\Windows\System32\DriverStore\Temp\{25e2bb02-d1d5-55b7-ca8d-3964ecec0912}\nethss.inf C:\Windows\System32\DriverStore\Temp\{25e2bb02-d1d5-55b7-ca8d-3964ecec0912}\hssdrv.cat2⤵
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000005E4" "00000000000005DC"1⤵
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "4" "C:\Users\Admin\AppData\Local\Temp\{4650c379-5237-13a9-a26f-8f2935f62223}\nethss_m.inf" "9" "6b33badeb" "00000000000005B0" "WinSta0\Default" "00000000000005B8" "208" "C:\Program Files (x86)\Hotspot Shield\HssWPR"1⤵
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Windows\system32\pnpui.dll,InstallSecurityPromptRunDllW 20 Global\{31d63a61-9550-57b9-f2c7-7539689cf378} Global\{06b9b537-1aa7-61ca-6d9e-b02f0bdf8f63} C:\Windows\System32\DriverStore\Temp\{3b6fc558-2626-1b35-de8a-b02775a47052}\nethss_m.inf C:\Windows\System32\DriverStore\Temp\{3b6fc558-2626-1b35-de8a-b02775a47052}\hssdrv_m.cat2⤵
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7KB
MD51828771e6372c925b7c71db92e1b2138
SHA133ee1d52ab808d62c5e4d03a62f045954a7b3605
SHA256bc295cc5c8a08bfed3635205bf24d15cdd2697b58436bbb089077711155a0412
SHA512dabd9398f38951a15889d64cf9789db0002b6c00463c405771fc9e533d2c6c3eeefa2128f59660e16eb7e7ac0a781a508a414ec7324a9d287d26de2069676d4b
-
Filesize
55KB
MD5a60c877e1cd3aa2e4e5ccd8af305c0f1
SHA14e10e1332566fe04ff0cee89322d80099577a0a0
SHA256f7a673d88ed00cfe31db18d4f57d1c451fac12e86a95594d16a0d3d32bc410e0
SHA51203d0a6754fd39ad1c2689b42fb117f3210fbf247a6afaeaa9826f8bbd97fe5c6b69d7d742e538b087b59ea148e87afa46fc5978ba301f472e335bcccfd1229d6
-
Filesize
3KB
MD50d5e54d843689606b66159003839c203
SHA17ed49f6956d0c0272b9cf4964d45e5b12276c1bd
SHA25621a9b623a4b19916a53c6212cca8704cc790722797f90eca94e9abb735151259
SHA512386cdeec3cb76b97284bb200abacabbf0488466f73d8cb3866861141fcd7fb4d49c240bbb81d22a966a93665d4fefc61151a9310346a8887e2ae626ee8913644
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
59B
MD594080d4f8be4287cb51453096a94e523
SHA1ab63fdb0221857a0a42ddcf4991192ef272ead10
SHA2564f024bb22aa7179ebd87f52c5efefbf82a0986dbc01152cd4c3d7d1afbdb5b79
SHA51233b15418ae44e68485a1aa0395ab3721bb6639349b558394e865b272f472bd1078226cfefd66198cc67cc876fab070cf2aedaea095caa555d64fdc4320bad772
-
Filesize
212B
MD576653c9e2e71e87722385241f577afd0
SHA1d0d87d3ea552f571117f1da10ee917fc4e62def2
SHA2567246361826ca0231e61f3980851794aef9d417a949f687775fb6623eb5e69a71
SHA512f3854d81ff2ef7b8ac49a824d1faf8027a05bc06b6a3d291c89e722c9d517b9f38899c74784890b85655ac985fffc309831286685e89f0b8261bae8d0bd61458
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
49KB
MD50c9390ca38208327a25c7fa485e3418c
SHA178a35a8dcc4a766ba1b4adcde0d7618a1c4b80a2
SHA2566b0a82bc25e9fee4e9aedf2f449722406660e06cee223e60a5376c04ffe7ac39
SHA51269014f45fa85420fa4df7df7320b2582be1e5cf572fd6a6abd2d84527f1cab685e0a2d348fb986fcf3d4127f7ae59c36949ae312f40ee7c9b9c1318b8049c285
-
Filesize
11KB
MD577856a02074076ce80b75d196bafb73a
SHA16e098a79322376651b6b4474f2f443a213fbb373
SHA2560980dafe7f9723fe4c8254b597a76c399c8209985fc28c4e5ba85f82926c69dd
SHA51251aae4300fc27283073e4901d34158ae20c565837ace388710e8a9b240de92c8ea67b1e50b7bc32cc39fd4b950ad320f45e6dc1c50f239227521d9744f2bfd56
-
Filesize
227KB
MD5dd56e3271d8d63d655454b3f5c0f5c01
SHA1e9202a26011bf8e67a7702bc70ba5c8457a363d1
SHA256eeff4f2c3e3c3d5e7dbabcbb0d937a13b21cedd9a55cfaa4bc754cfade6ab276
SHA512c894196706e3236aeb963d0db6cac08cb023695461ebe5abb9be11c05f89b4f53e7b365487ec9a2d225f0269dbbe2f6475a507cbc7feecabc2986b0461813b76
-
Filesize
280KB
MD523f78fc0e3ab2623db282b3f14160e8a
SHA133fbec363f86b6c8d300fcb7a38fb3ce5236b302
SHA256fb77712b092fa130a78fc79796da774b843da7bd3c395fb9df247b0ea538ac30
SHA512058ad19f777b962502458750ed80dab047d9f0c23ce0e260374770c490de893a8936e45fb56d6be0ea96d9c625ed14ddcf5d6eddc29a09f1792b3cff276e4434
-
Filesize
7KB
MD58eadc8445e2fc1b5abb5f1eff87db6b0
SHA18e474e4756605fdbad2e17bff30c69641348ab32
SHA2569e471b68a93a7e9ee6cd7fcc339c6198fcd69b14f8a0b91adb718f77bad297ca
SHA5124cc40bcb872fe60fb0253fc319cff5e0c3773f8c227ed22550850ccde68ea2db36a1ebbf53c4d454fae1533ad591b0aac3583f79b2dd32f3d36b43a9430414ea
-
Filesize
6KB
MD50e6c1ad211cfb3457f05c3dbb1380aa3
SHA1184f1facf805d39a966b2413b71133261905b119
SHA25626b731b78a7d49ac039dd205d71067ac7f7dd668492f21df7668ce1e118df32c
SHA5122c79e97a646281ce90f73da576682f080495fc2eabc578db565d8502fd4af66d084048706dbceea46c2e11584507ad6678c6fbdc4b0285a02163e3ddfd66e00b
-
Filesize
1.4MB
MD56d290eaf62c558ae66166ebb8c149bf9
SHA1d6ce88c4f31df59e6f28c48a3dea82f4e3a026c4
SHA2562830185a1cb0370deb22ef57d62c713e2c7d0a0dafdf35fd5987756c3ce23d60
SHA51217506159a2d2ab3abca80620fae3d8797377621e5962467a3051b0a390a4349a8b8249b46e2229583abee82a0316338a7f01efc9da97fa92fdfc65b056034e9c
-
Filesize
1.4MB
MD5e3deb17ead8968f04204bb6af4d2cb17
SHA1fe0e89280121a8a9d7c5d6145486fbd78fc65a97
SHA25639c00cb1c96dd59e7ba95093c1fb3365eb9af926f4cf71484a8ae8c971ad2821
SHA512971057ae1a079a7c925cbe3f121e58944fa1da9f52a3397b1f1556bbe72dbd959e0b23d81d408959a39e2ddde7a3abe94250a1c9c5e14a8274ac00d4dbe7ad3f
-
Filesize
7KB
MD5d19b0d6cca146ffc43352d17508c3105
SHA1f57c9c7b03685c4a783530d49347c7b6443c77c2
SHA256c9dc089906b9bf37c10f4041aa545f520118c703e44b70edf3b678692ca6d9b7
SHA512650e8d278a64bdbee5379b295125b3be32f682aca9cda739b67cccc96d16ce678fbe86fbad9e810bf9698a70ff34e7a8fbe586f49748461fa5cfd32f14fcd722
-
Filesize
1KB
MD5779b00c222d8e41afe217cf0fa1cac51
SHA1b34fe746e4a37d6fcb05a75f075b27765d38e296
SHA256e5788162857db5cba89123686163931face249eabbe004f108651c7f7c2977ea
SHA5124d996eff46beae0d90ba79ad5d0986d887527aede3dc9958ad6f8113258ade8cc5c08de5551f9111b21959a3a12cd8a104869d5788c842dae8fd5bf0ef8a3cdf
-
Filesize
29KB
MD5d59a6b36c5a94916241a3ead50222b6f
SHA1e274e9486d318c383bc4b9812844ba56f0cff3c6
SHA256a38d01d3f024e626d579cf052ac3bd4260bb00c34bc6085977a5f4135ab09b53
SHA51217012307955fef045e7c13bf0613bd40df27c29778ba6572640b76c18d379e02dc478e855c9276737363d0ad09b9a94f2adaa85da9c77ebb3c2d427aa68e2489
-
Filesize
81KB
MD5b13f51572f55a2d31ed9f266d581e9ea
SHA17eef3111b878e159e520f34410ad87adecf0ca92
SHA256725980edc240c928bec5a5f743fdabeee1692144da7091cf836dc7d0997cef15
SHA512f437202723b2817f2fef64b53d4eb67f782bdc61884c0c1890b46deca7ca63313ee2ad093428481f94edfcecd9c77da6e72b604998f7d551af959dbd6915809c
-
Filesize
6KB
MD5962496d64ba8532aac6c78d574c8532b
SHA108403e62ead419643a0ba24ace54251559b8f074
SHA256ff0fdad584f914227a6311df5649e88494546c9fdb50479f7b3c337d40aed66e
SHA512c8452d70168ec9b87d41b4fa0ab82e1b96a326180b9f4bae2f6f4e10fb7458c868f41c9d6601ab0c8993fd7d7cd8efc9d02eab1e449837cd5a9d7856f00b6ad6
-
Filesize
222KB
MD5c8d4ee07811bdf6234eb6635e5b757fb
SHA132f629e9e77f8f28db2596cd4c1496c16bbbda5f
SHA256015265448e561aec92bf62fad633095707f833b7a3a3fa590b8cca4fd2f5ee27
SHA512dd6f6fb032b78224f0f2899b22688d131298ad1fdd6db2e3b9f45b924087e0d33d2a699c20876b90bd9ec4c68404229550fa1012410e4257b08a9215ff049993
-
Filesize
260KB
MD581e26824375b8c917d867c0e8ee65b01
SHA1f1eec07de42970a9e7419d0236ca3bdea9b59407
SHA256bbe452e43630298fc35c9d0a11e59ec0563b7edf3a68c208fabd17c1a2357d74
SHA512e1312372e9513017119372c17309e613c462c595f626813f26194f29064b7e466f5a28b6b2655ff87cead433a612f38a6d2f9d93fe9ffddeb0b7f2e7cc42bc93
-
Filesize
20KB
MD53cfe82b578587b0a4b42f6349769317d
SHA12bac488c226192af9f5f2e75a2ad16ba686dcb44
SHA2568b5a0403484876588f40c8af10abb977abffe56008886f9d1f081eb1727c2309
SHA5124b5420e6c9bca0fc74a5ca039b34d557a5d756a272d20732d0a83103965a431e1534ada5440aa1876d4f5e13e8abe53e74315a244ee0459d07a22a6c925135d4
-
Filesize
11KB
MD5b9f430f71c7144d8ff4ab94be2785aa6
SHA1c5c1e153caff7ad1d221a9acc8bbb831f05ccb05
SHA256b496e81a74ce871236abcd096fb9a6b210b456bebaa7464fa844b3241e51a655
SHA512c7ce431b6a1493fd7d1fe1b1c823ad22b582c43c8eb2fb6a471c648dd9df9953277c89932c66afd598d43ea36f4a8602e84cd175115266943071cbc8ce204099
-
Filesize
4KB
MD5351b802508ee5462cbf7f35454a9dca6
SHA17b9a1bc758e10af02124143680f636853b421da1
SHA25639275ee1767aac3ae0929a3e67a84a921610b45d5cfff3db1641893504d5c78d
SHA5126b0a4a500597fefaceb5eab79737d4f8dd253bb6bf8c263699314deda417763857b4407457d877b28f7a9c1f40a241d378ccae80c68541ff3f102eac8a6ff8d2
-
Filesize
9KB
MD57823fc560926dcd8741de6f0b900083f
SHA193dc0a704bc0b8f90668548e36daf459be0ae10a
SHA256ca869d6c6752aa4a8a6c874a694b543442992d7e854d0c48a1b60bca01a8c8c6
SHA512c79509cd306638ea9badec64ed9f7d0690e46fcab7ac77f25134065b628e76d2812f2d874ea2cc4283685c567b613a39d27b9fc4a6de2d4b9d30131f3161c4e9
-
Filesize
7KB
MD59625309a9aa1109cfd3dd2fd10f37a3c
SHA16e19ca9e47f762d54b85f4d180887533206ffe9d
SHA256d19101fc059662010b527feac6f996d4752da27c26747be0a1cafaee109b9afc
SHA5126cc3c99d7fd923d100804822b0e7cb7ee29d8f67adc2c84df2fbaedb07938ab020f724f3278cb39e843eebb23f3de04c9912319c7e9a777c82a40cefb6e66ccd
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
64KB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
8KB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
16.6MB
-
Filesize
8KB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
7.1MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
4KB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
4KB
-
Filesize
16.6MB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
7.1MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
8KB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
64KB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
16.6MB
-
Filesize
8KB
-
Filesize
100KB
-
Filesize
100KB
-
Filesize
100KB
-
Filesize
100KB