sality | af111f0259fb25f5fb02805318544d01cc598f4e81a014d5aaba1a0cd747c330

General

Target

JaffaCakes118_91f1fb614fdc073485369fcc048cd035.exe
Size

229KB
MD5

91f1fb614fdc073485369fcc048cd035
SHA1

81fe830506722ee2403a9404b4598e79801360a8
SHA256

af111f0259fb25f5fb02805318544d01cc598f4e81a014d5aaba1a0cd747c330
SHA512

e02527253c7d5331396ca7e6c992b271148b36add026deacff0fbd560da3652a8405e388fd4d06c1bf06010177aea630ee0a33d7206c835883187922e529710b
SSDEEP

6144:Op/3xAz12ytsbRHVsZ8VPYNt5CD1uD5RZ+f/V:Op/incS+ICcDNSt

Score

10^/10

sality backdoor defense_evasion discovery trojan upx

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

Signatures

Modifies firewall policy service 3 TTPs 3 IoCs

defense_evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	JaffaCakes118_91f1fb614fdc073485369fcc048cd035.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	JaffaCakes118_91f1fb614fdc073485369fcc048cd035.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	JaffaCakes118_91f1fb614fdc073485369fcc048cd035.exe

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	JaffaCakes118_91f1fb614fdc073485369fcc048cd035.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	JaffaCakes118_91f1fb614fdc073485369fcc048cd035.exe

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality
Sality family
sality

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	JaffaCakes118_91f1fb614fdc073485369fcc048cd035.exe

Windows security bypass 2 TTPs 6 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	JaffaCakes118_91f1fb614fdc073485369fcc048cd035.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	JaffaCakes118_91f1fb614fdc073485369fcc048cd035.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	JaffaCakes118_91f1fb614fdc073485369fcc048cd035.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	JaffaCakes118_91f1fb614fdc073485369fcc048cd035.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	JaffaCakes118_91f1fb614fdc073485369fcc048cd035.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	JaffaCakes118_91f1fb614fdc073485369fcc048cd035.exe

Windows security modification 2 TTPs 7 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	JaffaCakes118_91f1fb614fdc073485369fcc048cd035.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	JaffaCakes118_91f1fb614fdc073485369fcc048cd035.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	JaffaCakes118_91f1fb614fdc073485369fcc048cd035.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	JaffaCakes118_91f1fb614fdc073485369fcc048cd035.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc	JaffaCakes118_91f1fb614fdc073485369fcc048cd035.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	JaffaCakes118_91f1fb614fdc073485369fcc048cd035.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	JaffaCakes118_91f1fb614fdc073485369fcc048cd035.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	JaffaCakes118_91f1fb614fdc073485369fcc048cd035.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\T:	JaffaCakes118_91f1fb614fdc073485369fcc048cd035.exe
File opened (read-only)	\??\R:	JaffaCakes118_91f1fb614fdc073485369fcc048cd035.exe
File opened (read-only)	\??\O:	JaffaCakes118_91f1fb614fdc073485369fcc048cd035.exe
File opened (read-only)	\??\I:	JaffaCakes118_91f1fb614fdc073485369fcc048cd035.exe
File opened (read-only)	\??\Z:	JaffaCakes118_91f1fb614fdc073485369fcc048cd035.exe
File opened (read-only)	\??\X:	JaffaCakes118_91f1fb614fdc073485369fcc048cd035.exe
File opened (read-only)	\??\U:	JaffaCakes118_91f1fb614fdc073485369fcc048cd035.exe
File opened (read-only)	\??\G:	JaffaCakes118_91f1fb614fdc073485369fcc048cd035.exe
File opened (read-only)	\??\S:	JaffaCakes118_91f1fb614fdc073485369fcc048cd035.exe
File opened (read-only)	\??\M:	JaffaCakes118_91f1fb614fdc073485369fcc048cd035.exe
File opened (read-only)	\??\H:	JaffaCakes118_91f1fb614fdc073485369fcc048cd035.exe
File opened (read-only)	\??\L:	JaffaCakes118_91f1fb614fdc073485369fcc048cd035.exe
File opened (read-only)	\??\K:	JaffaCakes118_91f1fb614fdc073485369fcc048cd035.exe
File opened (read-only)	\??\J:	JaffaCakes118_91f1fb614fdc073485369fcc048cd035.exe
File opened (read-only)	\??\W:	JaffaCakes118_91f1fb614fdc073485369fcc048cd035.exe
File opened (read-only)	\??\V:	JaffaCakes118_91f1fb614fdc073485369fcc048cd035.exe
File opened (read-only)	\??\N:	JaffaCakes118_91f1fb614fdc073485369fcc048cd035.exe
File opened (read-only)	\??\E:	JaffaCakes118_91f1fb614fdc073485369fcc048cd035.exe
File opened (read-only)	\??\Y:	JaffaCakes118_91f1fb614fdc073485369fcc048cd035.exe
File opened (read-only)	\??\Q:	JaffaCakes118_91f1fb614fdc073485369fcc048cd035.exe
File opened (read-only)	\??\P:	JaffaCakes118_91f1fb614fdc073485369fcc048cd035.exe

Drops autorun.inf file 1 TTPs 3 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	F:\autorun.inf	JaffaCakes118_91f1fb614fdc073485369fcc048cd035.exe
File opened for modification	C:\autorun.inf	JaffaCakes118_91f1fb614fdc073485369fcc048cd035.exe
File opened for modification	C:\Documents and Settings\Admin\Local Settings\Application Data\Microsoft\CD Burning\autorun.inf	JaffaCakes118_91f1fb614fdc073485369fcc048cd035.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2344-1-0x0000000001D40000-0x0000000002DCE000-memory.dmp	upx
behavioral1/memory/2344-8-0x0000000001D40000-0x0000000002DCE000-memory.dmp	upx
behavioral1/memory/2344-6-0x0000000001D40000-0x0000000002DCE000-memory.dmp	upx
behavioral1/memory/2344-5-0x0000000001D40000-0x0000000002DCE000-memory.dmp	upx
behavioral1/memory/2344-4-0x0000000001D40000-0x0000000002DCE000-memory.dmp	upx
behavioral1/memory/2344-3-0x0000000001D40000-0x0000000002DCE000-memory.dmp	upx
behavioral1/memory/2344-7-0x0000000001D40000-0x0000000002DCE000-memory.dmp	upx
behavioral1/memory/2344-27-0x0000000001D40000-0x0000000002DCE000-memory.dmp	upx
behavioral1/memory/2344-63-0x0000000001D40000-0x0000000002DCE000-memory.dmp	upx

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File opened for modification	C:\PROGRA~2\MICROS~1\OFFICE14\INFOPATH.EXE	JaffaCakes118_91f1fb614fdc073485369fcc048cd035.exe
File opened for modification	C:\PROGRA~2\MICROS~1\OFFICE14\MSACCESS.EXE	JaffaCakes118_91f1fb614fdc073485369fcc048cd035.exe
File opened for modification	C:\PROGRA~2\MICROS~1\OFFICE14\MSPUB.EXE	JaffaCakes118_91f1fb614fdc073485369fcc048cd035.exe
File opened for modification	C:\PROGRA~2\MICROS~1\OFFICE14\OIS.EXE	JaffaCakes118_91f1fb614fdc073485369fcc048cd035.exe
File opened for modification	C:\PROGRA~2\MICROS~1\OFFICE14\ONENOTE.EXE	JaffaCakes118_91f1fb614fdc073485369fcc048cd035.exe
File opened for modification	C:\PROGRA~2\MICROS~1\OFFICE14\OUTLOOK.EXE	JaffaCakes118_91f1fb614fdc073485369fcc048cd035.exe
File opened for modification	C:\PROGRA~2\MICROS~1\OFFICE14\EXCEL.EXE	JaffaCakes118_91f1fb614fdc073485369fcc048cd035.exe
File opened for modification	C:\PROGRA~2\MICROS~1\OFFICE14\GROOVE.EXE	JaffaCakes118_91f1fb614fdc073485369fcc048cd035.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SYSTEM.INI	JaffaCakes118_91f1fb614fdc073485369fcc048cd035.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_91f1fb614fdc073485369fcc048cd035.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2344	JaffaCakes118_91f1fb614fdc073485369fcc048cd035.exe
2344	JaffaCakes118_91f1fb614fdc073485369fcc048cd035.exe

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	2344	JaffaCakes118_91f1fb614fdc073485369fcc048cd035.exe
Token: SeDebugPrivilege	2344	JaffaCakes118_91f1fb614fdc073485369fcc048cd035.exe
Token: SeDebugPrivilege	2344	JaffaCakes118_91f1fb614fdc073485369fcc048cd035.exe
Token: SeDebugPrivilege	2344	JaffaCakes118_91f1fb614fdc073485369fcc048cd035.exe
Token: SeDebugPrivilege	2344	JaffaCakes118_91f1fb614fdc073485369fcc048cd035.exe
Token: SeDebugPrivilege	2344	JaffaCakes118_91f1fb614fdc073485369fcc048cd035.exe
Token: SeDebugPrivilege	2344	JaffaCakes118_91f1fb614fdc073485369fcc048cd035.exe
Token: SeDebugPrivilege	2344	JaffaCakes118_91f1fb614fdc073485369fcc048cd035.exe
Token: SeDebugPrivilege	2344	JaffaCakes118_91f1fb614fdc073485369fcc048cd035.exe
Token: SeDebugPrivilege	2344	JaffaCakes118_91f1fb614fdc073485369fcc048cd035.exe
Token: SeDebugPrivilege	2344	JaffaCakes118_91f1fb614fdc073485369fcc048cd035.exe
Token: SeDebugPrivilege	2344	JaffaCakes118_91f1fb614fdc073485369fcc048cd035.exe
Token: SeDebugPrivilege	2344	JaffaCakes118_91f1fb614fdc073485369fcc048cd035.exe
Token: SeDebugPrivilege	2344	JaffaCakes118_91f1fb614fdc073485369fcc048cd035.exe
Token: SeDebugPrivilege	2344	JaffaCakes118_91f1fb614fdc073485369fcc048cd035.exe
Token: SeDebugPrivilege	2344	JaffaCakes118_91f1fb614fdc073485369fcc048cd035.exe
Token: SeDebugPrivilege	2344	JaffaCakes118_91f1fb614fdc073485369fcc048cd035.exe
Token: SeDebugPrivilege	2344	JaffaCakes118_91f1fb614fdc073485369fcc048cd035.exe
Token: SeDebugPrivilege	2344	JaffaCakes118_91f1fb614fdc073485369fcc048cd035.exe
Token: SeDebugPrivilege	2344	JaffaCakes118_91f1fb614fdc073485369fcc048cd035.exe
Token: SeDebugPrivilege	2344	JaffaCakes118_91f1fb614fdc073485369fcc048cd035.exe
Token: SeDebugPrivilege	2344	JaffaCakes118_91f1fb614fdc073485369fcc048cd035.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2344 wrote to memory of 1048	2344	JaffaCakes118_91f1fb614fdc073485369fcc048cd035.exe	18
PID 2344 wrote to memory of 1124	2344	JaffaCakes118_91f1fb614fdc073485369fcc048cd035.exe	20
PID 2344 wrote to memory of 1164	2344	JaffaCakes118_91f1fb614fdc073485369fcc048cd035.exe	21
PID 2344 wrote to memory of 1948	2344	JaffaCakes118_91f1fb614fdc073485369fcc048cd035.exe	23

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	JaffaCakes118_91f1fb614fdc073485369fcc048cd035.exe

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1048

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1124

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1164
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_91f1fb614fdc073485369fcc048cd035.exe
  "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_91f1fb614fdc073485369fcc048cd035.exe"
  2⤵
  - Modifies firewall policy service
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - UAC bypass
  - Windows security bypass
  - Windows security modification
  - Checks whether UAC is enabled
  - Enumerates connected drives
  - Drops autorun.inf file
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:2344

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:1948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

1

T1091

Execution

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Hide Artifacts

2

T1564

Hidden Files and Directories

2

T1564.001

Impair Defenses

4

T1562

Disable or Modify System Firewall

1

T1562.004

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

3

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Replication Through Removable Media

1

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\autorun.inf

Filesize
126B

MD5
163e20cbccefcdd42f46e43a94173c46

SHA1
4c7b5048e8608e2a75799e00ecf1bbb4773279ae

SHA256
7780bee9df142a17e0457f3dcb2788b50fc2792370089335597d33719126fb7e

SHA512
e5ac0ff6b087857799ab70f68067c9dc73eeb93ccfcad87047052380b95ade3e6eb2a7d01a0f850d548a39f4b1ebb60e299d603dbe25c31b9a3585b34a0c65a8

Download Submit
C:\zPharaoh.exe

Filesize
157KB

MD5
d4ede080dafd4f75903dc84705a7eb64

SHA1
f6f23e9b9412f1f3a6d8d564ecb5cf8ca80a104d

SHA256
9b3d3a043757058f8bcf840add1aa45d067499ca8e79bd5bda279a769dd7fd0f

SHA512
a049b2d9056a37231f9609c9b0b4f22de8946a3fd75c237c9ad719f1c2afaabb8ffd6ff6060ef5b0d9073b8ab1a3177cdc82606c0905d57ca707ee6933bd7515

Download Submit
F:\zPharaoh.exe

Filesize
157KB

MD5
e5673e1dfd91501fafb73a2bbf5435eb

SHA1
799ad9e574fec722bf3240e2bdeed3b533572466

SHA256
3400680c33a069477fb65eadf7dd29e9a31672b5b29d18efdb4793a68ed6ec14

SHA512
c56fb2ca01b42b5c90b8bf0dd3b32b285414c607e5971287f6ff28c39e0cc96eead93c1f4d1abf8c4aacdbdbe0d2f9763fe4f43a77f47c427367ad466cf59b3f

Download Submit
memory/1048-9-0x0000000002010000-0x0000000002012000-memory.dmp

Filesize
8KB

Download
memory/2344-6-0x0000000001D40000-0x0000000002DCE000-memory.dmp

Filesize
16.6MB

Download
memory/2344-3-0x0000000001D40000-0x0000000002DCE000-memory.dmp

Filesize
16.6MB

Download
memory/2344-5-0x0000000001D40000-0x0000000002DCE000-memory.dmp

Filesize
16.6MB

Download
memory/2344-18-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/2344-17-0x0000000000240000-0x0000000000242000-memory.dmp

Filesize
8KB

Download
memory/2344-21-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/2344-4-0x0000000001D40000-0x0000000002DCE000-memory.dmp

Filesize
16.6MB

Download
memory/2344-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2344-7-0x0000000001D40000-0x0000000002DCE000-memory.dmp

Filesize
16.6MB

Download
memory/2344-23-0x0000000000240000-0x0000000000242000-memory.dmp

Filesize
8KB

Download
memory/2344-27-0x0000000001D40000-0x0000000002DCE000-memory.dmp

Filesize
16.6MB

Download
memory/2344-22-0x0000000000240000-0x0000000000242000-memory.dmp

Filesize
8KB

Download
memory/2344-8-0x0000000001D40000-0x0000000002DCE000-memory.dmp

Filesize
16.6MB

Download
memory/2344-1-0x0000000001D40000-0x0000000002DCE000-memory.dmp

Filesize
16.6MB

Download
memory/2344-73-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2344-63-0x0000000001D40000-0x0000000002DCE000-memory.dmp

Filesize
16.6MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads