Analysis
-
max time kernel
74s -
max time network
77s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
10-03-2023 13:29
Static task
static1
Behavioral task
behavioral1
Sample
Salwyrr Launcher Installer.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
Salwyrr Launcher Installer.exe
Resource
win10v2004-20230220-en
General
-
Target
Salwyrr Launcher Installer.exe
-
Size
46KB
-
MD5
38633bfef3c1fe505a39a688b5c31828
-
SHA1
4e053e5ca9e8bfcf372b4331b18c36d637332bbc
-
SHA256
413a460fae724b972ab9c52aeab029552245555c7df5b79eb2a6529e1dd7a090
-
SHA512
812ebfa26ff63ade8ab4851230fe47c0ffb797b5a8c48d6ab7ad3293a4995c088bedb8ca7ad6c48a63b3c7f60cdf5b2b318b39dc232ef2096721aba7734ea8f7
-
SSDEEP
768:PE55gC6d1VepljbMBMxECL67qtjMGF9TtgmAtugTtyKr:svh6dTepljLEf44u4mMuAyKr
Malware Config
Signatures
-
Modifies Windows Firewall 1 TTPs 12 IoCs
pid Process 1528 netsh.exe 588 netsh.exe 868 netsh.exe 1476 netsh.exe 620 netsh.exe 1792 netsh.exe 384 netsh.exe 1584 netsh.exe 1864 netsh.exe 1336 netsh.exe 1176 netsh.exe 1928 netsh.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
pid pid_target Process procid_target 1208 1204 WerFault.exe 27 -
Modifies registry class 9 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\bin_auto_file\shell\Read rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\bin_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\.bin rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\.bin\ = "bin_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\bin_auto_file\shell rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\bin_auto_file\shell\Read\command rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\bin_auto_file rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\bin_auto_file\ rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1956 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1204 Salwyrr Launcher Installer.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 628 AcroRd32.exe 628 AcroRd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1204 wrote to memory of 588 1204 Salwyrr Launcher Installer.exe 28 PID 1204 wrote to memory of 588 1204 Salwyrr Launcher Installer.exe 28 PID 1204 wrote to memory of 588 1204 Salwyrr Launcher Installer.exe 28 PID 1204 wrote to memory of 588 1204 Salwyrr Launcher Installer.exe 28 PID 1204 wrote to memory of 588 1204 Salwyrr Launcher Installer.exe 28 PID 1204 wrote to memory of 588 1204 Salwyrr Launcher Installer.exe 28 PID 1204 wrote to memory of 588 1204 Salwyrr Launcher Installer.exe 28 PID 1204 wrote to memory of 868 1204 Salwyrr Launcher Installer.exe 30 PID 1204 wrote to memory of 868 1204 Salwyrr Launcher Installer.exe 30 PID 1204 wrote to memory of 868 1204 Salwyrr Launcher Installer.exe 30 PID 1204 wrote to memory of 868 1204 Salwyrr Launcher Installer.exe 30 PID 1204 wrote to memory of 868 1204 Salwyrr Launcher Installer.exe 30 PID 1204 wrote to memory of 868 1204 Salwyrr Launcher Installer.exe 30 PID 1204 wrote to memory of 868 1204 Salwyrr Launcher Installer.exe 30 PID 1204 wrote to memory of 1476 1204 Salwyrr Launcher Installer.exe 32 PID 1204 wrote to memory of 1476 1204 Salwyrr Launcher Installer.exe 32 PID 1204 wrote to memory of 1476 1204 Salwyrr Launcher Installer.exe 32 PID 1204 wrote to memory of 1476 1204 Salwyrr Launcher Installer.exe 32 PID 1204 wrote to memory of 1476 1204 Salwyrr Launcher Installer.exe 32 PID 1204 wrote to memory of 1476 1204 Salwyrr Launcher Installer.exe 32 PID 1204 wrote to memory of 1476 1204 Salwyrr Launcher Installer.exe 32 PID 1204 wrote to memory of 620 1204 Salwyrr Launcher Installer.exe 34 PID 1204 wrote to memory of 620 1204 Salwyrr Launcher Installer.exe 34 PID 1204 wrote to memory of 620 1204 Salwyrr Launcher Installer.exe 34 PID 1204 wrote to memory of 620 1204 Salwyrr Launcher Installer.exe 34 PID 1204 wrote to memory of 620 1204 Salwyrr Launcher Installer.exe 34 PID 1204 wrote to memory of 620 1204 Salwyrr Launcher Installer.exe 34 PID 1204 wrote to memory of 620 1204 Salwyrr Launcher Installer.exe 34 PID 1204 wrote to memory of 1864 1204 Salwyrr Launcher Installer.exe 36 PID 1204 wrote to memory of 1864 1204 Salwyrr Launcher Installer.exe 36 PID 1204 wrote to memory of 1864 1204 Salwyrr Launcher Installer.exe 36 PID 1204 wrote to memory of 1864 1204 Salwyrr Launcher Installer.exe 36 PID 1204 wrote to memory of 1864 1204 Salwyrr Launcher Installer.exe 36 PID 1204 wrote to memory of 1864 1204 Salwyrr Launcher Installer.exe 36 PID 1204 wrote to memory of 1864 1204 Salwyrr Launcher Installer.exe 36 PID 1204 wrote to memory of 1792 1204 Salwyrr Launcher Installer.exe 38 PID 1204 wrote to memory of 1792 1204 Salwyrr Launcher Installer.exe 38 PID 1204 wrote to memory of 1792 1204 Salwyrr Launcher Installer.exe 38 PID 1204 wrote to memory of 1792 1204 Salwyrr Launcher Installer.exe 38 PID 1204 wrote to memory of 1792 1204 Salwyrr Launcher Installer.exe 38 PID 1204 wrote to memory of 1792 1204 Salwyrr Launcher Installer.exe 38 PID 1204 wrote to memory of 1792 1204 Salwyrr Launcher Installer.exe 38 PID 1204 wrote to memory of 384 1204 Salwyrr Launcher Installer.exe 40 PID 1204 wrote to memory of 384 1204 Salwyrr Launcher Installer.exe 40 PID 1204 wrote to memory of 384 1204 Salwyrr Launcher Installer.exe 40 PID 1204 wrote to memory of 384 1204 Salwyrr Launcher Installer.exe 40 PID 1204 wrote to memory of 384 1204 Salwyrr Launcher Installer.exe 40 PID 1204 wrote to memory of 384 1204 Salwyrr Launcher Installer.exe 40 PID 1204 wrote to memory of 384 1204 Salwyrr Launcher Installer.exe 40 PID 1204 wrote to memory of 1336 1204 Salwyrr Launcher Installer.exe 42 PID 1204 wrote to memory of 1336 1204 Salwyrr Launcher Installer.exe 42 PID 1204 wrote to memory of 1336 1204 Salwyrr Launcher Installer.exe 42 PID 1204 wrote to memory of 1336 1204 Salwyrr Launcher Installer.exe 42 PID 1204 wrote to memory of 1336 1204 Salwyrr Launcher Installer.exe 42 PID 1204 wrote to memory of 1336 1204 Salwyrr Launcher Installer.exe 42 PID 1204 wrote to memory of 1336 1204 Salwyrr Launcher Installer.exe 42 PID 1204 wrote to memory of 1176 1204 Salwyrr Launcher Installer.exe 44 PID 1204 wrote to memory of 1176 1204 Salwyrr Launcher Installer.exe 44 PID 1204 wrote to memory of 1176 1204 Salwyrr Launcher Installer.exe 44 PID 1204 wrote to memory of 1176 1204 Salwyrr Launcher Installer.exe 44 PID 1204 wrote to memory of 1176 1204 Salwyrr Launcher Installer.exe 44 PID 1204 wrote to memory of 1176 1204 Salwyrr Launcher Installer.exe 44 PID 1204 wrote to memory of 1176 1204 Salwyrr Launcher Installer.exe 44 PID 1204 wrote to memory of 1928 1204 Salwyrr Launcher Installer.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\Salwyrr Launcher Installer.exe"C:\Users\Admin\AppData\Local\Temp\Salwyrr Launcher Installer.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\Windows\SysWOW64\netsh.exe"netsh" advfirewall firewall show rule name="Salwyrr Client Java 1a"2⤵
- Modifies Windows Firewall
PID:588
-
-
C:\Windows\SysWOW64\netsh.exe"netsh" advfirewall firewall add rule name="Salwyrr Client Java 1a" dir=in action=allow protocol=any localip=any remoteip=any program="C:\Users\Admin\AppData\Roaming\.Salwyrr\launcher\bootstrap\jre\bin\javaw.exe"2⤵
- Modifies Windows Firewall
PID:868
-
-
C:\Windows\SysWOW64\netsh.exe"netsh" advfirewall firewall show rule name="Salwyrr Client Java 2a"2⤵
- Modifies Windows Firewall
PID:1476
-
-
C:\Windows\SysWOW64\netsh.exe"netsh" advfirewall firewall add rule name="Salwyrr Client Java 2a" dir=in action=allow protocol=any localip=any remoteip=any program="C:\Users\Admin\AppData\Roaming\.Salwyrr\launcher\jre\bin\javaw.exe"2⤵
- Modifies Windows Firewall
PID:620
-
-
C:\Windows\SysWOW64\netsh.exe"netsh" advfirewall firewall show rule name="Salwyrr Client Java 3a"2⤵
- Modifies Windows Firewall
PID:1864
-
-
C:\Windows\SysWOW64\netsh.exe"netsh" advfirewall firewall add rule name="Salwyrr Client Java 3a" dir=in action=allow protocol=any localip=any remoteip=any program="C:\Users\Admin\AppData\Roaming\.Salwyrr\launcher\java-runtime-alpha\bin\javaw.exe"2⤵
- Modifies Windows Firewall
PID:1792
-
-
C:\Windows\SysWOW64\netsh.exe"netsh" advfirewall firewall show rule name="Salwyrr Client Java 1b"2⤵
- Modifies Windows Firewall
PID:384
-
-
C:\Windows\SysWOW64\netsh.exe"netsh" advfirewall firewall add rule name="Salwyrr Client Java 1b" dir=in action=allow protocol=any localip=any remoteip=any program="C:\Users\Admin\AppData\Roaming\.Salwyrr\launcher\bootstrap\jre\bin\java.exe"2⤵
- Modifies Windows Firewall
PID:1336
-
-
C:\Windows\SysWOW64\netsh.exe"netsh" advfirewall firewall show rule name="Salwyrr Client Java 2b"2⤵
- Modifies Windows Firewall
PID:1176
-
-
C:\Windows\SysWOW64\netsh.exe"netsh" advfirewall firewall add rule name="Salwyrr Client Java 2b" dir=in action=allow protocol=any localip=any remoteip=any program="C:\Users\Admin\AppData\Roaming\.Salwyrr\launcher\jre\bin\java.exe"2⤵
- Modifies Windows Firewall
PID:1928
-
-
C:\Windows\SysWOW64\netsh.exe"netsh" advfirewall firewall show rule name="Salwyrr Client Java 3b"2⤵
- Modifies Windows Firewall
PID:1584
-
-
C:\Windows\SysWOW64\netsh.exe"netsh" advfirewall firewall add rule name="Salwyrr Client Java 3b" dir=in action=allow protocol=any localip=any remoteip=any program="C:\Users\Admin\AppData\Roaming\.Salwyrr\launcher\java-runtime-alpha\bin\java.exe"2⤵
- Modifies Windows Firewall
PID:1528
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1204 -s 22922⤵
- Program crash
PID:1208
-
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\Desktop\ReceiveStart.bin1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:1956 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\Desktop\ReceiveStart.bin"2⤵
- Suspicious use of SetWindowsHookEx
PID:628
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\.Salwyrr\launcher\bootstrap\openlogic-openjdk-jre-8u332-b09-windows-64\lib\images\cursors\win32_LinkNoDrop32x32.gif
Filesize153B
MD51e9d8f133a442da6b0c74d49bc84a341
SHA1259edc45b4569427e8319895a444f4295d54348f
SHA2561a1d3079d49583837662b84e11d8c0870698511d9110e710eb8e7eb20df7ae3b
SHA51263d6f70c8cab9735f0f857f5bf99e319f6ae98238dc7829dd706b7d6855c70be206e32e3e55df884402483cf8bebad00d139283af5c0b85dc1c5bf8f253acd37