Overview
overview
10Static
static
3JaffaCakes...23.exe
windows7-x64
3JaffaCakes...23.exe
windows10-2004-x64
10$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3UKHook40.dll
windows7-x64
3UKHook40.dll
windows10-2004-x64
3UniKey.exe
windows7-x64
3UniKey.exe
windows10-2004-x64
3ukfaq.htm
windows7-x64
3ukfaq.htm
windows10-2004-x64
3ukmanual.htm
windows7-x64
3ukmanual.htm
windows10-2004-x64
3uninst.exe
windows7-x64
3uninst.exe
windows10-2004-x64
10Analysis
-
max time kernel
141s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20250129-en -
resource tags
arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system -
submitted
06-02-2025 18:28
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_ae2e1cbf8477077d682a9e7882e80023.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral2
Sample
JaffaCakes118_ae2e1cbf8477077d682a9e7882e80023.exe
Resource
win10v2004-20250129-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral4
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20250129-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
UKHook40.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral6
Sample
UKHook40.dll
Resource
win10v2004-20250129-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
UniKey.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral8
Sample
UniKey.exe
Resource
win10v2004-20250129-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
ukfaq.htm
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral10
Sample
ukfaq.htm
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
ukmanual.htm
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral12
Sample
ukmanual.htm
Resource
win10v2004-20250129-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
uninst.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral14
Sample
uninst.exe
Resource
win10v2004-20250129-en
windows10-2004-x64
General
-
Target
uninst.exe
-
Size
115KB
-
MD5
193069df52ef63227279954dc84fa950
-
SHA1
f58b2dad8a53851441f12713db6bbaaf9bc30a5f
-
SHA256
5d361ff49eee93d54b0fbef78fc7caf5f84e76be8e253ab6795a347a05cf2f01
-
SHA512
2a468df39d6c18f8c1edfbf631293659d578412e9915fcda8b3dbd8a4ccda09ed06ebc570245c0dd7f17617e98c67e5b2c49b8234127349f8181fef60430b924
-
SSDEEP
3072:ODRXTx4jCI8JzAI0hq19dKg5DnLpI2YKE2t/0ZXS:Ueh9mKg5TlU2iZXS
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Sality family
-
UAC bypass 3 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" uninst.exe -
Windows security bypass 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" uninst.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" uninst.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" uninst.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" uninst.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" uninst.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" uninst.exe -
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2211717155-842865201-3404093980-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system\DisableRegistryTools = "1" uninst.exe -
Disables Task Manager via registry modification
-
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 1744 netsh.exe -
Windows security modification 2 TTPs 7 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" uninst.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" uninst.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc uninst.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" uninst.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" uninst.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" uninst.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" uninst.exe -
Checks whether UAC is enabled 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" uninst.exe -
resource yara_rule behavioral14/memory/3540-1-0x00000000022A0000-0x00000000032D3000-memory.dmp upx behavioral14/memory/3540-3-0x00000000022A0000-0x00000000032D3000-memory.dmp upx behavioral14/memory/3540-6-0x00000000022A0000-0x00000000032D3000-memory.dmp upx -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI uninst.exe -
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language uninst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3540 uninst.exe 3540 uninst.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3540 uninst.exe Token: SeDebugPrivilege 3540 uninst.exe Token: SeDebugPrivilege 3540 uninst.exe Token: SeDebugPrivilege 3540 uninst.exe Token: SeDebugPrivilege 3540 uninst.exe Token: SeDebugPrivilege 3540 uninst.exe Token: SeDebugPrivilege 3540 uninst.exe Token: SeDebugPrivilege 3540 uninst.exe Token: SeDebugPrivilege 3540 uninst.exe Token: SeDebugPrivilege 3540 uninst.exe Token: SeDebugPrivilege 3540 uninst.exe Token: SeDebugPrivilege 3540 uninst.exe Token: SeDebugPrivilege 3540 uninst.exe Token: SeDebugPrivilege 3540 uninst.exe Token: SeDebugPrivilege 3540 uninst.exe Token: SeDebugPrivilege 3540 uninst.exe Token: SeDebugPrivilege 3540 uninst.exe Token: SeDebugPrivilege 3540 uninst.exe Token: SeDebugPrivilege 3540 uninst.exe Token: SeDebugPrivilege 3540 uninst.exe Token: SeDebugPrivilege 3540 uninst.exe Token: SeDebugPrivilege 3540 uninst.exe Token: SeDebugPrivilege 3540 uninst.exe Token: SeDebugPrivilege 3540 uninst.exe Token: SeDebugPrivilege 3540 uninst.exe Token: SeDebugPrivilege 3540 uninst.exe Token: SeDebugPrivilege 3540 uninst.exe Token: SeDebugPrivilege 3540 uninst.exe Token: SeDebugPrivilege 3540 uninst.exe Token: SeDebugPrivilege 3540 uninst.exe Token: SeDebugPrivilege 3540 uninst.exe Token: SeDebugPrivilege 3540 uninst.exe Token: SeDebugPrivilege 3540 uninst.exe Token: SeDebugPrivilege 3540 uninst.exe Token: SeDebugPrivilege 3540 uninst.exe Token: SeDebugPrivilege 3540 uninst.exe Token: SeDebugPrivilege 3540 uninst.exe Token: SeDebugPrivilege 3540 uninst.exe Token: SeDebugPrivilege 3540 uninst.exe Token: SeDebugPrivilege 3540 uninst.exe Token: SeDebugPrivilege 3540 uninst.exe Token: SeDebugPrivilege 3540 uninst.exe Token: SeDebugPrivilege 3540 uninst.exe Token: SeDebugPrivilege 3540 uninst.exe Token: SeDebugPrivilege 3540 uninst.exe Token: SeDebugPrivilege 3540 uninst.exe Token: SeDebugPrivilege 3540 uninst.exe Token: SeDebugPrivilege 3540 uninst.exe Token: SeDebugPrivilege 3540 uninst.exe Token: SeDebugPrivilege 3540 uninst.exe Token: SeDebugPrivilege 3540 uninst.exe Token: SeDebugPrivilege 3540 uninst.exe Token: SeDebugPrivilege 3540 uninst.exe Token: SeDebugPrivilege 3540 uninst.exe Token: SeDebugPrivilege 3540 uninst.exe Token: SeDebugPrivilege 3540 uninst.exe Token: SeDebugPrivilege 3540 uninst.exe Token: SeDebugPrivilege 3540 uninst.exe Token: SeDebugPrivilege 3540 uninst.exe Token: SeDebugPrivilege 3540 uninst.exe Token: SeDebugPrivilege 3540 uninst.exe Token: SeDebugPrivilege 3540 uninst.exe Token: SeDebugPrivilege 3540 uninst.exe Token: SeDebugPrivilege 3540 uninst.exe -
Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 3540 wrote to memory of 1744 3540 uninst.exe 84 PID 3540 wrote to memory of 1744 3540 uninst.exe 84 PID 3540 wrote to memory of 1744 3540 uninst.exe 84 PID 3540 wrote to memory of 780 3540 uninst.exe 8 PID 3540 wrote to memory of 784 3540 uninst.exe 9 PID 3540 wrote to memory of 316 3540 uninst.exe 13 PID 3540 wrote to memory of 2548 3540 uninst.exe 42 PID 3540 wrote to memory of 2580 3540 uninst.exe 45 PID 3540 wrote to memory of 2768 3540 uninst.exe 47 PID 3540 wrote to memory of 3480 3540 uninst.exe 56 PID 3540 wrote to memory of 3660 3540 uninst.exe 57 PID 3540 wrote to memory of 3844 3540 uninst.exe 58 PID 3540 wrote to memory of 3940 3540 uninst.exe 59 PID 3540 wrote to memory of 4008 3540 uninst.exe 60 PID 3540 wrote to memory of 1244 3540 uninst.exe 61 PID 3540 wrote to memory of 4200 3540 uninst.exe 62 PID 3540 wrote to memory of 3800 3540 uninst.exe 75 PID 3540 wrote to memory of 2544 3540 uninst.exe 76 PID 3540 wrote to memory of 4988 3540 uninst.exe 81 PID 3540 wrote to memory of 5004 3540 uninst.exe 82 PID 3540 wrote to memory of 1744 3540 uninst.exe 84 PID 3540 wrote to memory of 1744 3540 uninst.exe 84 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" uninst.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:780
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:784
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:316
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2548
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2580
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2768
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3480
-
C:\Users\Admin\AppData\Local\Temp\uninst.exe"C:\Users\Admin\AppData\Local\Temp\uninst.exe"2⤵
- UAC bypass
- Windows security bypass
- Disables RegEdit via registry modification
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3540 -
C:\Windows\SysWOW64\netsh.exenetsh firewall set opmode disable3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:1744
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3660
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3844
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3940
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4008
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:1244
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4200
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:3800
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:2544
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵PID:4988
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:5004
Network
MITRE ATT&CK Enterprise v15
Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
4