Analysis

  • max time kernel
    172s
  • max time network
    193s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-11-2022 21:29

General

  • Target

    bfdd9924903e1a3b2a0308337ba25f6424e771a035d9e023e3bccd42dd0fff91.exe

  • Size

    94KB

  • MD5

    005b2faf68d6b9e97eaba809186d4775

  • SHA1

    6314e59f4fdb064f84a3852523882764173787b2

  • SHA256

    bfdd9924903e1a3b2a0308337ba25f6424e771a035d9e023e3bccd42dd0fff91

  • SHA512

    bda9fcf2df23b51667a301eff42094143ba20cea2375de84fc522dc6af736ab0aa9c835daa1d501f7b5f83cb1c131e8010060e6daec6b1816d0b371c5324a096

  • SSDEEP

    1536:gynSYl5chODHrGeCSXzljb4gkCPqm4AYPCRTdF0J47x6+hosXJo2+jO+ZDS:gavl5chmjXzlThymRY8rosXcjjZ

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

Signatures

  • Modifies firewall policy service 2 TTPs 3 IoCs
  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

  • UAC bypass 3 TTPs 1 IoCs
  • Windows security bypass 2 TTPs 6 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Windows security modification 2 TTPs 7 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 11 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs
  • System policy modification 1 TTPs 1 IoCs

Processes

  • C:\Windows\system32\fontdrvhost.exe
    "fontdrvhost.exe"
    1⤵
      PID:792
    • C:\Windows\system32\sihost.exe
      sihost.exe
      1⤵
        PID:2356
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
        1⤵
          PID:2408
        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
          1⤵
            PID:3352
          • C:\Windows\system32\DllHost.exe
            C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
            1⤵
              PID:3264
            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
              1⤵
                PID:3504
              • C:\Windows\system32\backgroundTaskHost.exe
                "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca
                1⤵
                  PID:4856
                • C:\Windows\System32\RuntimeBroker.exe
                  C:\Windows\System32\RuntimeBroker.exe -Embedding
                  1⤵
                    PID:692
                  • C:\Windows\system32\backgroundTaskHost.exe
                    "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
                    1⤵
                      PID:3404
                    • C:\Windows\System32\RuntimeBroker.exe
                      C:\Windows\System32\RuntimeBroker.exe -Embedding
                      1⤵
                        PID:3768
                      • C:\Windows\System32\RuntimeBroker.exe
                        C:\Windows\System32\RuntimeBroker.exe -Embedding
                        1⤵
                          PID:3424
                        • C:\Windows\system32\svchost.exe
                          C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
                          1⤵
                            PID:2980
                          • C:\Windows\Explorer.EXE
                            C:\Windows\Explorer.EXE
                            1⤵
                              PID:2184
                              • C:\Users\Admin\AppData\Local\Temp\bfdd9924903e1a3b2a0308337ba25f6424e771a035d9e023e3bccd42dd0fff91.exe
                                "C:\Users\Admin\AppData\Local\Temp\bfdd9924903e1a3b2a0308337ba25f6424e771a035d9e023e3bccd42dd0fff91.exe"
                                2⤵
                                • Modifies firewall policy service
                                • UAC bypass
                                • Windows security bypass
                                • Windows security modification
                                • Adds Run key to start application
                                • Checks whether UAC is enabled
                                • Drops file in Windows directory
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of AdjustPrivilegeToken
                                • Suspicious use of WriteProcessMemory
                                • System policy modification
                                PID:1288
                            • C:\Windows\system32\taskhostw.exe
                              taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
                              1⤵
                                PID:2532
                              • C:\Windows\system32\dwm.exe
                                "dwm.exe"
                                1⤵
                                  PID:312
                                • C:\Windows\system32\fontdrvhost.exe
                                  "fontdrvhost.exe"
                                  1⤵
                                    PID:800

                                  Network

                                  MITRE ATT&CK Enterprise v6

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads

                                  • memory/1288-132-0x0000000002250000-0x00000000032DE000-memory.dmp

                                    Filesize

                                    16.6MB

                                  • memory/1288-133-0x0000000031420000-0x000000003143D000-memory.dmp

                                    Filesize

                                    116KB

                                  • memory/1288-134-0x0000000002250000-0x00000000032DE000-memory.dmp

                                    Filesize

                                    16.6MB

                                  • memory/1288-135-0x0000000002250000-0x00000000032DE000-memory.dmp

                                    Filesize

                                    16.6MB