Overview

overview

10

Static

static

d70fe2be98...32.exe

windows7-x64

10

d70fe2be98...32.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    47s
  • platform
    windows7_x64
  • resource
    win7-20220718-en
  • resource tags

    arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system
  • submitted
    24-07-2022 13:38

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    d70fe2be98249d3eae1bb2826aa6f71205e40bd40442481c3ea92b0e8fbbc232.exe

  • Size

    1.1MB

  • MD5

    52b6bdaa9639ae7c4364b447a792da59

  • SHA1

    f2ecf16b4eaf6b05f90c41238beac45d8201bbb9

  • SHA256

    d70fe2be98249d3eae1bb2826aa6f71205e40bd40442481c3ea92b0e8fbbc232

  • SHA512

    28604f93bb2d1132cb5ae9820c7ef63cb2f1de1f159bdd978b8c71d9a6f068c00ae1843c78210a873e7e6be21ccbc72a86626e009df34480c9e19b621453a5ba

Score
10/10
salitybackdoorevasiontrojanupx

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

Signatures

  • Modifies firewall policy service 2 TTPs 3 IoCs
    evasion
  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality
  • UAC bypass 3 TTPs 1 IoCs
    evasiontrojan
  • Windows security bypass 2 TTPs 6 IoCs
    evasiontrojan
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Loads dropped DLL 2 IoCs
  • Windows security modification 2 TTPs 7 IoCs
    evasiontrojan
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Enumerates connected drives 3 TTPs 22 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file 1 TTPs 1 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 14 IoCs
  • Drops file in Program Files directory 5 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies registry class 64 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious use of AdjustPrivilegeToken 21 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 1 IoCs
    evasion

Processes

  • C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    1⤵
      PID:1120
    • C:\Windows\Explorer.EXE
      C:\Windows\Explorer.EXE
      1⤵
        PID:1188
        • C:\Users\Admin\AppData\Local\Temp\d70fe2be98249d3eae1bb2826aa6f71205e40bd40442481c3ea92b0e8fbbc232.exe
          "C:\Users\Admin\AppData\Local\Temp\d70fe2be98249d3eae1bb2826aa6f71205e40bd40442481c3ea92b0e8fbbc232.exe"
          2⤵
          • Modifies firewall policy service
          • UAC bypass
          • Windows security bypass
          • Windows security modification
          • Checks whether UAC is enabled
          • Enumerates connected drives
          • Drops autorun.inf file
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:904
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\setup.bat" "
            3⤵
            • Drops file in System32 directory
            • Suspicious use of WriteProcessMemory
            PID:1208
            • C:\Windows\SysWOW64\regsvr32.exe
              regsvr32 C:\Windows\System32\ecologyplugin\iWebOffice\iWebOffice2003.ocx /s
              4⤵
              • Loads dropped DLL
              • Modifies registry class
              PID:240
            • C:\Windows\SysWOW64\regsvr32.exe
              regsvr32 C:\Windows\System32\ecologyplugin\iWebOffice\PDF417Manager.dll /s
              4⤵
              • Loads dropped DLL
              • Modifies registry class
              PID:524
            • C:\Windows\SysWOW64\NOTEPAD.EXE
              "C:\Windows\system32\NOTEPAD.EXE" C:\Windows\System32\ecologyplugin\iWebOffice\readme.txt
              4⤵
              • Opens file in notepad (likely ransom note)
              PID:960
      • C:\Windows\system32\Dwm.exe
        "C:\Windows\system32\Dwm.exe"
        1⤵
          PID:1164
        • C:\Windows\system32\conhost.exe
          \??\C:\Windows\system32\conhost.exe "1517026120-284113391-18648207503601887681421646208-89683538-212758149-1297953913"
          1⤵
            PID:2040

          Network

          MITRE ATT&CK Matrix ATT&CK v6

          Initial Access

          Replication Through Removable Media

          1
          T1091

          Execution

          Persistence

          Modify Existing Service

          1
          T1031

          Privilege Escalation

          Bypass User Account Control

          1
          T1088

          Defense Evasion

          Modify Registry

          5
          T1112

          Bypass User Account Control

          1
          T1088

          Disabling Security Tools

          3
          T1089

          Credential Access

          Discovery

          System Information Discovery

          3
          T1082

          Query Registry

          1
          T1012

          Peripheral Device Discovery

          1
          T1120

          Lateral Movement

          Replication Through Removable Media

          1
          T1091

          Collection

          Exfiltration

          Command and Control

          Impact

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\RarSFX0\LOGO.ico
            Filesize

            2KB

            MD5

            41eca7a9245394106a09b2534d8030df

            SHA1

            b38e19173aea521d2fb00ef706abb0df7d076b0c

            SHA256

            f1a9670d5b4ee0fed36b7370193e4aa052f916ee038d91b6fd041cbc4dbb3683

            SHA512

            cd2fdc7b063e986278e463af34d040d5bd6851bfa1893841df6fadf428e740cf3555950186e98e533038d3588b97a66933c3f1564d9afec14750bd442c2dfdfe

            Download Submit
          • C:\Users\Admin\AppData\Local\Temp\RarSFX0\PDF417Manager.dll
            Filesize

            325KB

            MD5

            57025bb5e54588020b62dc2245bb286c

            SHA1

            a1da892174ffc7441be22531a939b82a69083ee9

            SHA256

            15214e339a330d0b0779bb700a099a84d5b6179a9280b776fd198fbc1450e093

            SHA512

            4ed75c96cb0d56fe50e7f8a8ee1a011b907f39605a9f9f6af733c29a75ace0820a52dc1ccdea5978de3500ff5fc7b3ec249c195b73b47dc2d435c50ccb2729ad

            Download Submit
          • C:\Users\Admin\AppData\Local\Temp\RarSFX0\iWebOffice2003.ocx
            Filesize

            2.2MB

            MD5

            476e64ed0990e6175f2f175fa1c28c0e

            SHA1

            3a72b83d53032385974dfe37abaf1ce3e29ffa2e

            SHA256

            fdbabe1f81cdc87d23e67e94ad5e81852ea31eee75169a5f3e98b1ee4308b2bf

            SHA512

            0ffe70c91b6a6770f147c938448f916d2f359c467a7b769d4a5dabb7ad90422416dfe2814d54fc8a25099b992ab9090d678237666eba5cb902f067da2b0f07f9

            Download Submit
          • C:\Users\Admin\AppData\Local\Temp\RarSFX0\rar.bmp
            Filesize

            2KB

            MD5

            a9fabad349a7121db3c799ede8f74d6e

            SHA1

            d13448fc14fa6a1e0ab7c995f319faa84750dff4

            SHA256

            6647c05a05cf81458ab13bbfaf98a78ea30171d8497d0b79b6dbcece8af6d993

            SHA512

            269b95c2ed60f65998e7a2aa0b18e3ffb08dbdb05f2bdce2070a5731bdf23b911f9a812c06879c999fee25d0dd72cac04b5026165b34fe3093414fffac641e2b

            Download Submit
          • C:\Users\Admin\AppData\Local\Temp\RarSFX0\readme.txt
            Filesize

            322B

            MD5

            4aacb7ccfd4d8149e49c4b52aa2a2a81

            SHA1

            62cd6181d6fa376027416bcf2d9cc2d63da2fdb5

            SHA256

            a9b2f74367f34691ae4e2e413a5a3abcb8fa532db441be4aa809cb52f0f7b7cb

            SHA512

            9391655e17ed2c764ee34c6214379686e4fbf7d6cd0b697a3d90321781194adfeb610f67eff793744cb766163c0c6b2b953653b75ab71ffff5c763db06796860

            Download Submit
          • C:\Users\Admin\AppData\Local\Temp\RarSFX0\setup.bat
            Filesize

            679B

            MD5

            901cb2b3ccce248eb9808b97bd2a67c5

            SHA1

            7fa6acca13720226cf6c281ca5887d3be78bde78

            SHA256

            3ccd147481258b2e81e17b02ae79bd76e73e0c8a7f6a90109cd357248dc0228c

            SHA512

            fca803eb79a1e895221405e518114c6538a7fc4c0429853165c9bebf64c6fa3b8c15ead66809372402c6e896c8f307f9130d9e270d40cff10ff30748aae7a27a

            Download Submit
          • C:\Users\Admin\AppData\Local\Temp\RarSFX0\uninstall.bat
            Filesize

            431B

            MD5

            415feabca35ebef1a5c3f3863b1d3e39

            SHA1

            8116cc1f0733012da9da940bff842d44ae52b725

            SHA256

            d6bfa605d38b20fdf5ce042956afdd4e8fc3822897f99140a60f6b5581b3224d

            SHA512

            1910e6b3f6928cde188cfcc59e791f725b70bda0c731d322f53581d41f1afc267a5630dfdbbf67f34cbff2ba35d0f75fd2d9bf126f36d0b0ab5624db798cef2b

            Download Submit
          • C:\Windows\SysWOW64\ecologyplugin\iWebOffice\PDF417Manager.dll
            Filesize

            325KB

            MD5

            57025bb5e54588020b62dc2245bb286c

            SHA1

            a1da892174ffc7441be22531a939b82a69083ee9

            SHA256

            15214e339a330d0b0779bb700a099a84d5b6179a9280b776fd198fbc1450e093

            SHA512

            4ed75c96cb0d56fe50e7f8a8ee1a011b907f39605a9f9f6af733c29a75ace0820a52dc1ccdea5978de3500ff5fc7b3ec249c195b73b47dc2d435c50ccb2729ad

            Download Submit
          • C:\Windows\SysWOW64\ecologyplugin\iWebOffice\iWebOffice2003.ocx
            Filesize

            2.2MB

            MD5

            476e64ed0990e6175f2f175fa1c28c0e

            SHA1

            3a72b83d53032385974dfe37abaf1ce3e29ffa2e

            SHA256

            fdbabe1f81cdc87d23e67e94ad5e81852ea31eee75169a5f3e98b1ee4308b2bf

            SHA512

            0ffe70c91b6a6770f147c938448f916d2f359c467a7b769d4a5dabb7ad90422416dfe2814d54fc8a25099b992ab9090d678237666eba5cb902f067da2b0f07f9

            Download Submit
          • C:\Windows\SysWOW64\ecologyplugin\iWebOffice\readme.txt
            Filesize

            322B

            MD5

            4aacb7ccfd4d8149e49c4b52aa2a2a81

            SHA1

            62cd6181d6fa376027416bcf2d9cc2d63da2fdb5

            SHA256

            a9b2f74367f34691ae4e2e413a5a3abcb8fa532db441be4aa809cb52f0f7b7cb

            SHA512

            9391655e17ed2c764ee34c6214379686e4fbf7d6cd0b697a3d90321781194adfeb610f67eff793744cb766163c0c6b2b953653b75ab71ffff5c763db06796860

            Download Submit
          • \Windows\SysWOW64\ecologyplugin\iWebOffice\PDF417Manager.dll
            Filesize

            325KB

            MD5

            57025bb5e54588020b62dc2245bb286c

            SHA1

            a1da892174ffc7441be22531a939b82a69083ee9

            SHA256

            15214e339a330d0b0779bb700a099a84d5b6179a9280b776fd198fbc1450e093

            SHA512

            4ed75c96cb0d56fe50e7f8a8ee1a011b907f39605a9f9f6af733c29a75ace0820a52dc1ccdea5978de3500ff5fc7b3ec249c195b73b47dc2d435c50ccb2729ad

            Download Submit
          • \Windows\SysWOW64\ecologyplugin\iWebOffice\iWebOffice2003.ocx
            Filesize

            2.2MB

            MD5

            476e64ed0990e6175f2f175fa1c28c0e

            SHA1

            3a72b83d53032385974dfe37abaf1ce3e29ffa2e

            SHA256

            fdbabe1f81cdc87d23e67e94ad5e81852ea31eee75169a5f3e98b1ee4308b2bf

            SHA512

            0ffe70c91b6a6770f147c938448f916d2f359c467a7b769d4a5dabb7ad90422416dfe2814d54fc8a25099b992ab9090d678237666eba5cb902f067da2b0f07f9

            Download Submit
          • memory/240-67-0x0000000000000000-mapping.dmp
            Download
          • memory/240-71-0x0000000001FF0000-0x0000000002220000-memory.dmp
            Filesize

            2.2MB

            Download
          • memory/524-72-0x0000000000000000-mapping.dmp
            Download
          • memory/904-54-0x00000000769D1000-0x00000000769D3000-memory.dmp
            Filesize

            8KB

            Download
          • memory/904-80-0x0000000004B80000-0x00000000057CA000-memory.dmp
            Filesize

            12.3MB

            Download
          • memory/904-56-0x0000000000400000-0x0000000000469000-memory.dmp
            Filesize

            420KB

            Download
          • memory/904-55-0x00000000006A0000-0x000000000172E000-memory.dmp
            Filesize

            16.6MB

            Download
          • memory/904-57-0x00000000006A0000-0x000000000172E000-memory.dmp
            Filesize

            16.6MB

            Download
          • memory/904-87-0x0000000000400000-0x0000000000469000-memory.dmp
            Filesize

            420KB

            Download
          • memory/904-58-0x00000000003F0000-0x00000000003F2000-memory.dmp
            Filesize

            8KB

            Download
          • memory/904-85-0x0000000004B80000-0x00000000057CA000-memory.dmp
            Filesize

            12.3MB

            Download
          • memory/904-84-0x00000000003F0000-0x00000000003F2000-memory.dmp
            Filesize

            8KB

            Download
          • memory/904-83-0x00000000006A0000-0x000000000172E000-memory.dmp
            Filesize

            16.6MB

            Download
          • memory/960-82-0x0000000000260000-0x0000000000262000-memory.dmp
            Filesize

            8KB

            Download
          • memory/960-77-0x0000000000000000-mapping.dmp
            Download
          • memory/1208-81-0x0000000000200000-0x0000000000202000-memory.dmp
            Filesize

            8KB

            Download
          • memory/1208-59-0x0000000000000000-mapping.dmp
            Download
          • memory/1208-86-0x0000000000200000-0x0000000000202000-memory.dmp
            Filesize

            8KB

            Download