Analysis

  • max time kernel
    74s
  • max time network
    77s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    10-03-2023 13:29

General

  • Target

    Salwyrr Launcher Installer.exe

  • Size

    46KB

  • MD5

    38633bfef3c1fe505a39a688b5c31828

  • SHA1

    4e053e5ca9e8bfcf372b4331b18c36d637332bbc

  • SHA256

    413a460fae724b972ab9c52aeab029552245555c7df5b79eb2a6529e1dd7a090

  • SHA512

    812ebfa26ff63ade8ab4851230fe47c0ffb797b5a8c48d6ab7ad3293a4995c088bedb8ca7ad6c48a63b3c7f60cdf5b2b318b39dc232ef2096721aba7734ea8f7

  • SSDEEP

    768:PE55gC6d1VepljbMBMxECL67qtjMGF9TtgmAtugTtyKr:svh6dTepljLEf44u4mMuAyKr

Score
8/10

Malware Config

Signatures

  • Modifies Windows Firewall 1 TTPs 12 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Modifies registry class 9 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Salwyrr Launcher Installer.exe
    "C:\Users\Admin\AppData\Local\Temp\Salwyrr Launcher Installer.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1204
    • C:\Windows\SysWOW64\netsh.exe
      "netsh" advfirewall firewall show rule name="Salwyrr Client Java 1a"
      2⤵
      • Modifies Windows Firewall
      PID:588
    • C:\Windows\SysWOW64\netsh.exe
      "netsh" advfirewall firewall add rule name="Salwyrr Client Java 1a" dir=in action=allow protocol=any localip=any remoteip=any program="C:\Users\Admin\AppData\Roaming\.Salwyrr\launcher\bootstrap\jre\bin\javaw.exe"
      2⤵
      • Modifies Windows Firewall
      PID:868
    • C:\Windows\SysWOW64\netsh.exe
      "netsh" advfirewall firewall show rule name="Salwyrr Client Java 2a"
      2⤵
      • Modifies Windows Firewall
      PID:1476
    • C:\Windows\SysWOW64\netsh.exe
      "netsh" advfirewall firewall add rule name="Salwyrr Client Java 2a" dir=in action=allow protocol=any localip=any remoteip=any program="C:\Users\Admin\AppData\Roaming\.Salwyrr\launcher\jre\bin\javaw.exe"
      2⤵
      • Modifies Windows Firewall
      PID:620
    • C:\Windows\SysWOW64\netsh.exe
      "netsh" advfirewall firewall show rule name="Salwyrr Client Java 3a"
      2⤵
      • Modifies Windows Firewall
      PID:1864
    • C:\Windows\SysWOW64\netsh.exe
      "netsh" advfirewall firewall add rule name="Salwyrr Client Java 3a" dir=in action=allow protocol=any localip=any remoteip=any program="C:\Users\Admin\AppData\Roaming\.Salwyrr\launcher\java-runtime-alpha\bin\javaw.exe"
      2⤵
      • Modifies Windows Firewall
      PID:1792
    • C:\Windows\SysWOW64\netsh.exe
      "netsh" advfirewall firewall show rule name="Salwyrr Client Java 1b"
      2⤵
      • Modifies Windows Firewall
      PID:384
    • C:\Windows\SysWOW64\netsh.exe
      "netsh" advfirewall firewall add rule name="Salwyrr Client Java 1b" dir=in action=allow protocol=any localip=any remoteip=any program="C:\Users\Admin\AppData\Roaming\.Salwyrr\launcher\bootstrap\jre\bin\java.exe"
      2⤵
      • Modifies Windows Firewall
      PID:1336
    • C:\Windows\SysWOW64\netsh.exe
      "netsh" advfirewall firewall show rule name="Salwyrr Client Java 2b"
      2⤵
      • Modifies Windows Firewall
      PID:1176
    • C:\Windows\SysWOW64\netsh.exe
      "netsh" advfirewall firewall add rule name="Salwyrr Client Java 2b" dir=in action=allow protocol=any localip=any remoteip=any program="C:\Users\Admin\AppData\Roaming\.Salwyrr\launcher\jre\bin\java.exe"
      2⤵
      • Modifies Windows Firewall
      PID:1928
    • C:\Windows\SysWOW64\netsh.exe
      "netsh" advfirewall firewall show rule name="Salwyrr Client Java 3b"
      2⤵
      • Modifies Windows Firewall
      PID:1584
    • C:\Windows\SysWOW64\netsh.exe
      "netsh" advfirewall firewall add rule name="Salwyrr Client Java 3b" dir=in action=allow protocol=any localip=any remoteip=any program="C:\Users\Admin\AppData\Roaming\.Salwyrr\launcher\java-runtime-alpha\bin\java.exe"
      2⤵
      • Modifies Windows Firewall
      PID:1528
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1204 -s 2292
      2⤵
      • Program crash
      PID:1208
  • C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\Desktop\ReceiveStart.bin
    1⤵
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    PID:1956
    • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
      "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\Desktop\ReceiveStart.bin"
      2⤵
      • Suspicious use of SetWindowsHookEx
      PID:628

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\.Salwyrr\launcher\bootstrap\openlogic-openjdk-jre-8u332-b09-windows-64\lib\images\cursors\win32_LinkNoDrop32x32.gif

    Filesize

    153B

    MD5

    1e9d8f133a442da6b0c74d49bc84a341

    SHA1

    259edc45b4569427e8319895a444f4295d54348f

    SHA256

    1a1d3079d49583837662b84e11d8c0870698511d9110e710eb8e7eb20df7ae3b

    SHA512

    63d6f70c8cab9735f0f857f5bf99e319f6ae98238dc7829dd706b7d6855c70be206e32e3e55df884402483cf8bebad00d139283af5c0b85dc1c5bf8f253acd37

  • memory/1204-54-0x0000000000CD0000-0x0000000000CDE000-memory.dmp

    Filesize

    56KB

  • memory/1204-55-0x0000000004B80000-0x0000000004BC0000-memory.dmp

    Filesize

    256KB

  • memory/1204-56-0x0000000000410000-0x000000000041A000-memory.dmp

    Filesize

    40KB

  • memory/1204-57-0x0000000000410000-0x000000000041A000-memory.dmp

    Filesize

    40KB

  • memory/1204-58-0x0000000004B80000-0x0000000004BC0000-memory.dmp

    Filesize

    256KB

  • memory/1204-62-0x0000000000410000-0x000000000041A000-memory.dmp

    Filesize

    40KB

  • memory/1204-63-0x0000000000410000-0x000000000041A000-memory.dmp

    Filesize

    40KB

  • memory/1204-61-0x0000000004B80000-0x0000000004BC0000-memory.dmp

    Filesize

    256KB

  • memory/1204-64-0x0000000004B80000-0x0000000004BC0000-memory.dmp

    Filesize

    256KB