Analysis
-
max time kernel
150s -
max time network
104s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
-
submitted
23-11-2022 18:53
General
-
Target
e07e15b58842f709e023b0bbf4d3b932283e21377d72cc4347712bba74a69563.exe
-
Size
243KB
-
MD5
474e6cf3450bfe79631eb1aa0365db7c
-
SHA1
b42b1fd4a02f74018fbf3ae97d04e1a96e93d426
-
SHA256
e07e15b58842f709e023b0bbf4d3b932283e21377d72cc4347712bba74a69563
-
SHA512
f61b105edca3499f5eee9619bf3b6ee5e3a2914a9e17990002fb3085fd553a384eb099e791b0383d1611a6f0ffdc7c37a8af764a6c14568093ea7004281f3564
-
SSDEEP
6144:Aiv0A7NvO+K0l0mvoZELgDBYeSfq9a34/8MRWt6e:ZFNjK0zvov9VSfqQKRWt6e
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 2 TTPs 6 IoCs
-
Sality
Sality is backdoor written in C++, first discovered in 2003.
-
UAC bypass 3 TTPs 2 IoCs
-
Windows security bypass 2 TTPs 12 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Deletes itself 1 IoCs
-
Loads dropped DLL 4 IoCs
-
Windows security modification 2 TTPs 14 IoCs
-
Checks whether UAC is enabled 1 TTPs 2 IoCs
-
Enumerates connected drives 3 TTPs 20 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops autorun.inf file 1 TTPs 1 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in Program Files directory 1 IoCs
-
Drops file in Windows directory 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
NSIS installer 8 IoCs
-
Suspicious behavior: EnumeratesProcesses 15 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 42 IoCs
-
Suspicious use of WriteProcessMemory 49 IoCs
-
System policy modification 1 TTPs 2 IoCs
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\e07e15b58842f709e023b0bbf4d3b932283e21377d72cc4347712bba74a69563.exe"C:\Users\Admin\AppData\Local\Temp\e07e15b58842f709e023b0bbf4d3b932283e21377d72cc4347712bba74a69563.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Loads dropped DLL
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe"C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\3⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Deletes itself
- Loads dropped DLL
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
175KB
MD598a340c720df3a50e4549a0b755096ab
SHA1800c259789099e7cb01b54b9858b2e2f7a90d1c5
SHA25640620458f14b2b8b79af2796613a4a2367192a1563d2e732d245989f3499d228
SHA512c1c40edfb4ed1ed3e7f8f6486f42400aed9d241dd74b510e11f424fbc9578c262e10733cede4857af82009a64cc1b01a2b706092b7c7add83a2a8f887a237ae8
-
Filesize
243KB
MD5474e6cf3450bfe79631eb1aa0365db7c
SHA1b42b1fd4a02f74018fbf3ae97d04e1a96e93d426
SHA256e07e15b58842f709e023b0bbf4d3b932283e21377d72cc4347712bba74a69563
SHA512f61b105edca3499f5eee9619bf3b6ee5e3a2914a9e17990002fb3085fd553a384eb099e791b0383d1611a6f0ffdc7c37a8af764a6c14568093ea7004281f3564
-
Filesize
243KB
MD5474e6cf3450bfe79631eb1aa0365db7c
SHA1b42b1fd4a02f74018fbf3ae97d04e1a96e93d426
SHA256e07e15b58842f709e023b0bbf4d3b932283e21377d72cc4347712bba74a69563
SHA512f61b105edca3499f5eee9619bf3b6ee5e3a2914a9e17990002fb3085fd553a384eb099e791b0383d1611a6f0ffdc7c37a8af764a6c14568093ea7004281f3564
-
Filesize
255B
MD58912cc9b989f021ebf33dfe939d5d6e4
SHA1a7dd1f3d89e96dc0e7f28d5e6e197a782601c574
SHA256bf8bc24ef34a3609c3fe1e279029d4b58226df0bd3aa8f845bf864cb44c076d1
SHA5120fccbaf55b96b7789bdc85069aa5dd9527b57ba7f322e1020c72cb25b83b941e5562c438aa524c1b9d31bb6c3fdbba394eb79ed36d36dd02628662cbe5ce2375
-
Filesize
14KB
MD53809b1424d53ccb427c88cabab8b5f94
SHA1bc74d911216f32a9ca05c0d9b61a2aecfc0d1c0e
SHA256426efd56da4014f12ec8ee2e268f86b848bbca776333d55482cb3eb71c744088
SHA512626a1c5edd86a71579e42bac8df479184515e6796fa21cb4fad6731bb775641d25f8eb8e86b939b9db9099453e85c572c9ea7897339a3879a1b672bc9226fcee
-
Filesize
10KB
MD532465a07028b927b22c38e642c2cb836
SHA1309cac412b2ecf6a36f6e989c828afcdd8c7a6e4
SHA256eda545d4dcb37098a90fce9692d5094bb56897f04eff6d40e3dedd122a4d1292
SHA5129d886a722bbbb5d8d77e97d256057fe685f1932042257a8382e13548fe835d01c64de65e2b5ad2c2ff99692b14c924e6ddb84797f6224f1772e8699b421e6aff
-
Filesize
120KB
MD55fa1d819dd6a34dd409482a5911267a0
SHA1f8a2509dfe6dfa4a9aec99033478892609eab70c
SHA256ecb3f1745770b6a0ab9e6d4255651ce5812b46713f45790f1f98ba811c67a518
SHA512369361b3752dd8ada9b06fa0388f2c7b4553d102d7d2cc8eb7d061055dab56b5bbb8e9615e8bada57121157ddbd557977c7ab5985d4ec8df0eb9a69b5d5c252e
-
Filesize
243KB
MD5474e6cf3450bfe79631eb1aa0365db7c
SHA1b42b1fd4a02f74018fbf3ae97d04e1a96e93d426
SHA256e07e15b58842f709e023b0bbf4d3b932283e21377d72cc4347712bba74a69563
SHA512f61b105edca3499f5eee9619bf3b6ee5e3a2914a9e17990002fb3085fd553a384eb099e791b0383d1611a6f0ffdc7c37a8af764a6c14568093ea7004281f3564
-
Filesize
16.7MB
-
Filesize
16.7MB
-
-
Filesize
332KB
-
Filesize
24KB
-
Filesize
16.7MB
-
Filesize
332KB
-
Filesize
16.7MB
-
Filesize
332KB
-
Filesize
332KB
-
Filesize
8KB
-
Filesize
16.7MB
-
Filesize
16.7MB