Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
05-02-2025 15:50
General
-
Target
JaffaCakes118_a137494b14dfa35738c5080946fd96e4.exe
-
Size
196KB
-
MD5
a137494b14dfa35738c5080946fd96e4
-
SHA1
247909cddbd95bd2c1871f0b9b3557ccf918c24e
-
SHA256
42c5571233d079f1c2b93ac3c927dd5ad27c63c46c234c0bd926f6daa5566cc5
-
SHA512
01da4d43b672aa963947e566228aed8efd9ca6ab16d4d23be854b632df63e05db40f5938d9b7bdfc1fd1ab836dbe16ace3ba2d277388fb2c90f00d2b65a24df4
-
SSDEEP
3072:16gO1jloupt1R/GsnO3D6cIIIIIPIIIIITkcRtxXZdFEOkIcSBUPHZCAuAUUeguS:16g46SGsnrOVRtxXjF0eUvZIguS
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Modifies firewall policy service 3 TTPs 3 IoCs
-
Sality
Sality is backdoor written in C++, first discovered in 2003.
-
Sality family
-
UAC bypass 3 TTPs 1 IoCs
-
Windows security bypass 2 TTPs 6 IoCs
-
Windows security modification 2 TTPs 7 IoCs
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
UPX packed file 12 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 22 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
-
System policy modification 1 TTPs 1 IoCs
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_a137494b14dfa35738c5080946fd96e4.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_a137494b14dfa35738c5080946fd96e4.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
257B
MD566bf22d9dcbc0c98a1519b04f7c68e6b
SHA14601f23cca064d57bf0a635bcc44960d8a33f590
SHA25633080713e652fc7e8e9f5429fbb457014dbe1c4e8b3702423f7fcf452f200add
SHA512a5d96baea81b96b8af916e846858f08c7b95742c642ea04f967d875d5396ea70d63e57c53439648e298c695f3ad629d135d72e378331efb18b04c1a24e1e4152
-
Filesize
8KB
-
Filesize
16.6MB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
196KB
-
Filesize
16.6MB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
8KB
-
Filesize
16.6MB
-
Filesize
196KB