Analysis
-
max time kernel
149s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25-01-2024 17:16
Static task
static1
Behavioral task
behavioral1
Sample
AD58B25945745C24819493A24B4EB139.exe
Resource
win7-20231215-en
General
-
Target
AD58B25945745C24819493A24B4EB139.exe
-
Size
1.8MB
-
MD5
ad58b25945745c24819493a24b4eb139
-
SHA1
37df601266d4e8757c0018e091838378514524e5
-
SHA256
b1af59115af9cab0ec6b115ff5398c9979fd6e63b162d2c31b9004bc0bbde2f7
-
SHA512
ac2b87c7207abe2da0f1c096c64a118001f9c29dbfed4142b35665818738e187182d68accc9eec02fef3238c87263d913d48edeb463555577e45433cabbc9c32
-
SSDEEP
49152:qcbzAQvx5odIOhfAizfT0WTb+w7jVViMpbG90dkw:qcbfSdIKf7LdOE2We0n
Malware Config
Signatures
-
Modifies Windows Firewall 2 TTPs 1 IoCs
Processes:
netsh.exepid process 2660 netsh.exe -
Drops startup file 2 IoCs
Processes:
svchost.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\325ed1ae2a47f27cdcc228f42fff7da3.exe svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\325ed1ae2a47f27cdcc228f42fff7da3.exe svchost.exe -
Executes dropped EXE 2 IoCs
Processes:
sakura_protected.exesvchost.exepid process 2864 sakura_protected.exe 2612 svchost.exe -
Loads dropped DLL 3 IoCs
Processes:
AD58B25945745C24819493A24B4EB139.exepid process 2668 AD58B25945745C24819493A24B4EB139.exe 2668 AD58B25945745C24819493A24B4EB139.exe 2668 AD58B25945745C24819493A24B4EB139.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\325ed1ae2a47f27cdcc228f42fff7da3 = "\"C:\\Windows\\svchost.exe\" .." svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\325ed1ae2a47f27cdcc228f42fff7da3 = "\"C:\\Windows\\svchost.exe\" .." svchost.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
-
Drops autorun.inf file 1 TTPs 5 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
Processes:
svchost.exedescription ioc process File opened for modification C:\autorun.inf svchost.exe File created D:\autorun.inf svchost.exe File created F:\autorun.inf svchost.exe File opened for modification F:\autorun.inf svchost.exe File created C:\autorun.inf svchost.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 17 IoCs
Processes:
sakura_protected.exesvchost.exepid process 2864 sakura_protected.exe 2864 sakura_protected.exe 2612 svchost.exe 2612 svchost.exe 2612 svchost.exe 2612 svchost.exe 2612 svchost.exe 2612 svchost.exe 2612 svchost.exe 2612 svchost.exe 2612 svchost.exe 2612 svchost.exe 2612 svchost.exe 2612 svchost.exe 2612 svchost.exe 2612 svchost.exe 2612 svchost.exe -
Drops file in Windows directory 3 IoCs
Processes:
sakura_protected.exesvchost.exedescription ioc process File created C:\Windows\svchost.exe sakura_protected.exe File opened for modification C:\Windows\svchost.exe sakura_protected.exe File opened for modification C:\Windows\svchost.exe svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
sakura_protected.exesvchost.exepid process 2864 sakura_protected.exe 2612 svchost.exe -
Suspicious use of AdjustPrivilegeToken 35 IoCs
Processes:
svchost.exedescription pid process Token: SeDebugPrivilege 2612 svchost.exe Token: 33 2612 svchost.exe Token: SeIncBasePriorityPrivilege 2612 svchost.exe Token: 33 2612 svchost.exe Token: SeIncBasePriorityPrivilege 2612 svchost.exe Token: 33 2612 svchost.exe Token: SeIncBasePriorityPrivilege 2612 svchost.exe Token: 33 2612 svchost.exe Token: SeIncBasePriorityPrivilege 2612 svchost.exe Token: 33 2612 svchost.exe Token: SeIncBasePriorityPrivilege 2612 svchost.exe Token: 33 2612 svchost.exe Token: SeIncBasePriorityPrivilege 2612 svchost.exe Token: 33 2612 svchost.exe Token: SeIncBasePriorityPrivilege 2612 svchost.exe Token: 33 2612 svchost.exe Token: SeIncBasePriorityPrivilege 2612 svchost.exe Token: 33 2612 svchost.exe Token: SeIncBasePriorityPrivilege 2612 svchost.exe Token: 33 2612 svchost.exe Token: SeIncBasePriorityPrivilege 2612 svchost.exe Token: 33 2612 svchost.exe Token: SeIncBasePriorityPrivilege 2612 svchost.exe Token: 33 2612 svchost.exe Token: SeIncBasePriorityPrivilege 2612 svchost.exe Token: 33 2612 svchost.exe Token: SeIncBasePriorityPrivilege 2612 svchost.exe Token: 33 2612 svchost.exe Token: SeIncBasePriorityPrivilege 2612 svchost.exe Token: 33 2612 svchost.exe Token: SeIncBasePriorityPrivilege 2612 svchost.exe Token: 33 2612 svchost.exe Token: SeIncBasePriorityPrivilege 2612 svchost.exe Token: 33 2612 svchost.exe Token: SeIncBasePriorityPrivilege 2612 svchost.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
sakura_protected.exesvchost.exepid process 2864 sakura_protected.exe 2612 svchost.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
AD58B25945745C24819493A24B4EB139.exesakura_protected.exesvchost.exedescription pid process target process PID 2668 wrote to memory of 2864 2668 AD58B25945745C24819493A24B4EB139.exe sakura_protected.exe PID 2668 wrote to memory of 2864 2668 AD58B25945745C24819493A24B4EB139.exe sakura_protected.exe PID 2668 wrote to memory of 2864 2668 AD58B25945745C24819493A24B4EB139.exe sakura_protected.exe PID 2668 wrote to memory of 2864 2668 AD58B25945745C24819493A24B4EB139.exe sakura_protected.exe PID 2864 wrote to memory of 2612 2864 sakura_protected.exe svchost.exe PID 2864 wrote to memory of 2612 2864 sakura_protected.exe svchost.exe PID 2864 wrote to memory of 2612 2864 sakura_protected.exe svchost.exe PID 2864 wrote to memory of 2612 2864 sakura_protected.exe svchost.exe PID 2612 wrote to memory of 2660 2612 svchost.exe netsh.exe PID 2612 wrote to memory of 2660 2612 svchost.exe netsh.exe PID 2612 wrote to memory of 2660 2612 svchost.exe netsh.exe PID 2612 wrote to memory of 2660 2612 svchost.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\AD58B25945745C24819493A24B4EB139.exe"C:\Users\Admin\AppData\Local\Temp\AD58B25945745C24819493A24B4EB139.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\sakura_protected.exe"C:\Users\Admin\AppData\Local\Temp\sakura_protected.exe"2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe"3⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Windows\svchost.exe" "svchost.exe" ENABLE4⤵
- Modifies Windows Firewall
PID:2660
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\sakura_protected.exeFilesize
76KB
MD5e4a3b4e440dc8085cbfba006f49c45a8
SHA18dbdc6af00a27917e5a0ad00e97e610a119ef2fb
SHA256fd859101c9f7a105f94cdbee54f86df5d72ed2402020597dad7897e7fd6ba909
SHA512d8bc79abcd7384f2d6ea28b6e019b9cb9dc0a0750ae5ac8e32443eecf0abd18d445d7510178152fd385459f338ded34354e9043b5ed76cbe47116cff857a3ab5
-
\Users\Admin\AppData\Local\Temp\sakura_protected.exeFilesize
33KB
MD578f8803221ec9fab2c6909f0599b80b6
SHA1c672645afdbd7f8eba2a5b12b6ffc4621ccaa4ac
SHA256dc448145a5ce1c440c2ac0df6a611826ffc94415c6f179103e3dcb7230591276
SHA51226bf76980efcc74b5124423800f796f7e4424c11f163a2390ffbba329d7febbd44716df0f9892cc9b37f5854da6465626fb2d511d3c6cd744729076a4efe28da
-
\Users\Admin\AppData\Local\Temp\sakura_protected.exeFilesize
1.1MB
MD5ecb25b8adf7f999fba6245d362153fdb
SHA1b406b28ea8c548d9456704075f0eca1cae069d65
SHA256ebe160919d1646d96694de6a38b7ac570f1827dedb163174bee9253a7475dd54
SHA512168d62846ff9416c150e2606843b48353afba8dd4096a0b020d3fdf04b06b61d9ebd932c81474d75cd8ef27adbb6e68aa09357b552bef764fc4c3a4eef6ac9d0
-
memory/2612-37-0x0000000000CE0000-0x0000000001056000-memory.dmpFilesize
3.5MB
-
memory/2612-54-0x0000000000C90000-0x0000000000CD0000-memory.dmpFilesize
256KB
-
memory/2612-53-0x0000000074750000-0x0000000074CFB000-memory.dmpFilesize
5.7MB
-
memory/2612-40-0x0000000074750000-0x0000000074CFB000-memory.dmpFilesize
5.7MB
-
memory/2668-25-0x00000000035A0000-0x0000000003916000-memory.dmpFilesize
3.5MB
-
memory/2864-26-0x0000000000250000-0x00000000005C6000-memory.dmpFilesize
3.5MB
-
memory/2864-29-0x0000000074750000-0x0000000074CFB000-memory.dmpFilesize
5.7MB
-
memory/2864-41-0x0000000074750000-0x0000000074CFB000-memory.dmpFilesize
5.7MB
-
memory/2864-39-0x0000000000250000-0x00000000005C6000-memory.dmpFilesize
3.5MB
-
memory/2864-30-0x0000000002FA0000-0x0000000002FE0000-memory.dmpFilesize
256KB
-
memory/2864-28-0x0000000074750000-0x0000000074CFB000-memory.dmpFilesize
5.7MB