General
-
Target
JaffaCakes118_b42daacd75f124416bfb97266693b9a3
-
Size
100KB
-
Sample
250207-hlq16strap
-
MD5
b42daacd75f124416bfb97266693b9a3
-
SHA1
8c507cdb658af85695f77928aadbcaf6abe6e2c9
-
SHA256
34baf0f32b2e5886e38c1bdba62c51fafb1f57c1706d5607f1d04927cf1edb29
-
SHA512
137ef50aaac829a147ee4fb55ad3e3b2e7c8e85589f8e082c0dd9a22429658d756dc84bfa372e57671933622f4d736e2fce40b8a2021b6bb658b29054ede6337
-
SSDEEP
1536:ynohagY0+IgE2nuRw4LaZDAwO4w+cxjlaN6xe1Tlg9NDtY7BmYuTfwGR6Iy+:6ohX+lE2nOGZDQIUmwcc8N+
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_b42daacd75f124416bfb97266693b9a3.exe
Resource
win7-20240729-en
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Targets
-
-
Target
JaffaCakes118_b42daacd75f124416bfb97266693b9a3
-
Size
100KB
-
MD5
b42daacd75f124416bfb97266693b9a3
-
SHA1
8c507cdb658af85695f77928aadbcaf6abe6e2c9
-
SHA256
34baf0f32b2e5886e38c1bdba62c51fafb1f57c1706d5607f1d04927cf1edb29
-
SHA512
137ef50aaac829a147ee4fb55ad3e3b2e7c8e85589f8e082c0dd9a22429658d756dc84bfa372e57671933622f4d736e2fce40b8a2021b6bb658b29054ede6337
-
SSDEEP
1536:ynohagY0+IgE2nuRw4LaZDAwO4w+cxjlaN6xe1Tlg9NDtY7BmYuTfwGR6Iy+:6ohX+lE2nOGZDQIUmwcc8N+
-
Modifies firewall policy service
-
Sality family
-
UAC bypass
-
Windows security bypass
-
Windows security modification
-
Checks whether UAC is enabled
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5