Overview

overview

10

Static

static

7

1dfcc6efa6...18.exe

windows7-x64

7

1dfcc6efa6...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1dfcc6efa62231c7e03a4c4a580acb17_JaffaCakes118

  • Size

    612KB

  • Sample

    240702-ezyrdszakm

  • MD5

    1dfcc6efa62231c7e03a4c4a580acb17

  • SHA1

    a3da94d517a842cefe9483210a65307bd78bc0cd

  • SHA256

    d2d62a7d6b43cc1536c318f8fe05dc9e615887f12ed2e564fc7485a945617667

  • SHA512

    805398310ec3b291daa8b7a1f5a35fcd3909b03910cf1b0cb8904ead8d951d22a3b92d99c4f639538f70d20c059449e8dcdbc03040e450d3d0b863f96bc6ac91

  • SSDEEP

    12288:YGcQhuDCRI5YlKZhyeLtHgTl2XtJ6suL1fIjQncllK9KNbN5e:FuDCeYlKKQgTGaIkcK9cPe

Score
10/10
salitybackdoorevasionpersistenceprivilege_escalationthemidatrojanupx

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Targets

    • Target

      1dfcc6efa62231c7e03a4c4a580acb17_JaffaCakes118

    • Size

      612KB

    • MD5

      1dfcc6efa62231c7e03a4c4a580acb17

    • SHA1

      a3da94d517a842cefe9483210a65307bd78bc0cd

    • SHA256

      d2d62a7d6b43cc1536c318f8fe05dc9e615887f12ed2e564fc7485a945617667

    • SHA512

      805398310ec3b291daa8b7a1f5a35fcd3909b03910cf1b0cb8904ead8d951d22a3b92d99c4f639538f70d20c059449e8dcdbc03040e450d3d0b863f96bc6ac91

    • SSDEEP

      12288:YGcQhuDCRI5YlKZhyeLtHgTl2XtJ6suL1fIjQncllK9KNbN5e:FuDCeYlKKQgTGaIkcK9cPe

    Score
    10/10
    upxsalitybackdoorevasionpersistenceprivilege_escalationtrojan

    • Sality

      Sality is backdoor written in C++, first discovered in 2003.

      backdoorsality

    • UAC bypass

      evasiontrojan

    • Windows security bypass

      evasiontrojan

    • Disables RegEdit via registry modification

      evasion

    • Disables Task Manager via registry modification

      evasion

    • Modifies Windows Firewall

      evasion

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Windows security modification

      evasiontrojan

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Privilege Escalation

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Defense Evasion

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Impair Defenses

4
T1562

Disable or Modify Tools

3
T1562.001

Disable or Modify System Firewall

1
T1562.004

Modify Registry

4
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks