Analysis
-
max time kernel
148s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20250129-en -
resource tags
-
submitted
07-02-2025 05:11
General
-
Target
JaffaCakes118_b358268c72e11b21236c4e804096f402.exe
-
Size
148KB
-
MD5
b358268c72e11b21236c4e804096f402
-
SHA1
ad9375e6fc6a90b2d96512b940bb9b0334727f08
-
SHA256
7ddca19b796238bede6b057d060bc7c3fb1d4a5e5af2d2b2138500fe3c3081df
-
SHA512
8d02b6dd4e38354852d1c390c87886cc33c50b840f9d9ae825c2f5d4429f1da065157ed1a543095489e1547c5eb0eb2dc9f385b5cb6b8193bcf715b7146cc8eb
-
SSDEEP
3072:BvXEDlr2riTbKd36KzmL4q6b5p0MEXEi2pgOyWEpjx7V:BvXEDF2ryb+Y4RvinnWE3V
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Sality
Sality is backdoor written in C++, first discovered in 2003.
-
Sality family
-
UAC bypass 3 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
UPX packed file 1 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
System policy modification 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b358268c72e11b21236c4e804096f402.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b358268c72e11b21236c4e804096f402.exe"1⤵
- UAC bypass
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- System policy modification
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152KB
-
Filesize
16.2MB
-
Filesize
152KB
-
Filesize
16.2MB