Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
05-02-2025 07:26
General
-
Target
JaffaCakes118_9d27b974105b5d15e21af1012b775b99.exe
-
Size
227KB
-
MD5
9d27b974105b5d15e21af1012b775b99
-
SHA1
74406714c804f4737140ec992c42995b812dd40d
-
SHA256
9b1c867c351010dccc505ce24272ea2a1a0c0f13152b2feeaa44b3d1ebd09676
-
SHA512
b76e41c164e302edc27cbf8eb0d299fde2d731eaafe397a284a0a577af5bb469f0a972d951e8bccf3a30daa1d53000941fe45863f39358e9c298eb194278e2b0
-
SSDEEP
3072:8gGH3f0gRJaZTEOFzeoZo/7Aa2vFZ9BD1C9Am0P4poLcuyLnxqRBDPjReCHmR:VpMKTZY/Ma8Ra0P4poULxqRPy
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Modifies firewall policy service 3 TTPs 3 IoCs
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
-
Sality
Sality is backdoor written in C++, first discovered in 2003.
-
Sality family
-
UAC bypass 3 TTPs 1 IoCs
-
Windows security bypass 2 TTPs 6 IoCs
-
Windows security modification 2 TTPs 7 IoCs
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops autorun.inf file 1 TTPs 3 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
-
UPX packed file 12 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Program Files directory 8 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 23 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
System policy modification 1 TTPs 1 IoCs
Processes
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9d27b974105b5d15e21af1012b775b99.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9d27b974105b5d15e21af1012b775b99.exe"2⤵
- Modifies firewall policy service
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Program Files (x86)\Microsoft Office\Office14\winword.exe"C:\Program Files (x86)\Microsoft Office\Office14\winword.exe"3⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122884⤵
-
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
7Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
126B
MD5163e20cbccefcdd42f46e43a94173c46
SHA14c7b5048e8608e2a75799e00ecf1bbb4773279ae
SHA2567780bee9df142a17e0457f3dcb2788b50fc2792370089335597d33719126fb7e
SHA512e5ac0ff6b087857799ab70f68067c9dc73eeb93ccfcad87047052380b95ade3e6eb2a7d01a0f850d548a39f4b1ebb60e299d603dbe25c31b9a3585b34a0c65a8
-
Filesize
151KB
MD5de9111fbc09b0ac7798cad1103c300eb
SHA13df61103a7fc866a473ff4e50aa902d7a68d15c0
SHA256fae0d33c0221f5822e811b3cca884e90625b0892030bef54fe23392d248d2b35
SHA512fbffb331f2cc415aeb8305b590168446c022fea4dff6e2e217cad0bb1932f9c7122f63590af22cb488e21a885f032b29970d0aa1d4da532b955cdd56d72dc762
-
Filesize
151KB
MD5d4d7521e2cca7503aed98526af37df01
SHA1a2d5520eabe332115f01c5e1eb6baed86d2d1224
SHA256f610d58fdc7caacb80862575434540a6d1d673739a1a488add5edda43f3db401
SHA512cb5ed8e87bf46b534e23088157b7238a0389937ce08ea42eb7308aa7fe15ce467158aac954371611e272e0e5767acce5f24638d8d31c1089ada45180b8754a5f
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
8KB
-
Filesize
16.6MB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
164KB
-
Filesize
16.6MB
-
Filesize
8KB
-
Filesize
164KB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB