Overview

overview

10

Static

static

5

JaffaCakes...e4.exe

windows7-x64

5

JaffaCakes...e4.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_9faa47ac4825a9616f1e5ec7371210e4

  • Size

    85KB

  • Sample

    250205-prvd4sxqhm

  • MD5

    9faa47ac4825a9616f1e5ec7371210e4

  • SHA1

    b5273b99717597b7d9c7d2659a1a846e7abcb5eb

  • SHA256

    aedbc65b485c2edada93b3701d3fd9778eac975e5a957d8d06b3dced5c99330f

  • SHA512

    70c15f6b4e3d052b00a4161ec73778c963705175efd8df9db318bd1100ea0d9658171b6fd44a61299be7e6d47b641ee66e8a6f73a3e8dc8e5fa9681e3b5ab0d6

  • SSDEEP

    1536:wJ6JCvNG6kn/QQkR2/GVrZYiyfkt8st52YoneYipHWXiqj3zimwUHku/m:wJsscRHx8rZNGkOs3TYvHi7KF/m

Score
10/10
salitybackdoordefense_evasiondiscoverypersistenceprivilege_escalationtrojanupx

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Targets

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Privilege Escalation

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Defense Evasion

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Impair Defenses

4
T1562

Disable or Modify System Firewall

1
T1562.004

Disable or Modify Tools

3
T1562.001

Modify Registry

4
T1112

Credential Access

Discovery

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks