Analysis
-
max time kernel
15s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
05-02-2025 11:20
General
-
Target
JaffaCakes118_9f1c7c844ef3fd8c846c90f59c89120e.exe
-
Size
223KB
-
MD5
9f1c7c844ef3fd8c846c90f59c89120e
-
SHA1
edf1fe132c310ca4eb1e8a2f3475f49e2f38d4b8
-
SHA256
56f948f1714d171326ca89ec3c5d50a3392b16e77909b223ff48d74299bec0a3
-
SHA512
b99b1e96dbf4ae092715170bf7d617928c5344d946b81b76195cae51ab2aaf5cf0446004fc6eefe6d78c141685ee2d873ae1a0f65d4afd4ef8bc87f30edeea8c
-
SSDEEP
6144:35Grd28lR1yD34S1mzQzSaCZRHwA76oz5q9obHW6zzCX:pGrd5r1yD3717zSTRHD76ehN6
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Modifies firewall policy service 3 TTPs 3 IoCs
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
-
Sality
Sality is backdoor written in C++, first discovered in 2003.
-
Sality family
-
UAC bypass 3 TTPs 1 IoCs
-
Windows security bypass 2 TTPs 6 IoCs
-
Windows security modification 2 TTPs 7 IoCs
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops autorun.inf file 1 TTPs 3 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
-
UPX packed file 11 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 22 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
-
System policy modification 1 TTPs 1 IoCs
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9f1c7c844ef3fd8c846c90f59c89120e.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9f1c7c844ef3fd8c846c90f59c89120e.exe"2⤵
- Modifies firewall policy service
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
7Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
126B
MD5163e20cbccefcdd42f46e43a94173c46
SHA14c7b5048e8608e2a75799e00ecf1bbb4773279ae
SHA2567780bee9df142a17e0457f3dcb2788b50fc2792370089335597d33719126fb7e
SHA512e5ac0ff6b087857799ab70f68067c9dc73eeb93ccfcad87047052380b95ade3e6eb2a7d01a0f850d548a39f4b1ebb60e299d603dbe25c31b9a3585b34a0c65a8
-
Filesize
151KB
MD5c79a7aa916f6c31435c5981294583e94
SHA1639a34bfd37193b489713f6be1899aa275c6be12
SHA256befb4f333166c5b1774e0057f975d1c76b58df80a8f8cc4f455752de5585da4f
SHA512578bbe53a5235b6c19a082cc67776f7c6b0085b4936585e854773f7676eb2cd74ad4908f694ae9b4b1498976c799c2ff20644ff5a1a4b1daa4080f96a6850f94
-
Filesize
151KB
MD5e8d2ad758a77010f19876b04949aca3a
SHA1a519b27955d35625f9e82995c746cf4cc039ea4b
SHA2568386ad47c8c1bed4015a5804f950c2bbf9ce68c60638d1fe9f4d1d6fef75d276
SHA51230ff4bc65a433c549e20c9aaa62d68157d7771f63496b99afff13343e395e31d6a800df79f7cd90c46db81d749b268d22d39e2a295fe8327644db35dab29fd4a
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
160KB
-
Filesize
8KB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
160KB
-
Filesize
8KB
-
Filesize
16.6MB