Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
25-01-2024 17:16
Static task
static1
Behavioral task
behavioral1
Sample
AD58B25945745C24819493A24B4EB139.exe
Resource
win7-20231215-en
General
-
Target
AD58B25945745C24819493A24B4EB139.exe
-
Size
1.8MB
-
MD5
ad58b25945745c24819493a24b4eb139
-
SHA1
37df601266d4e8757c0018e091838378514524e5
-
SHA256
b1af59115af9cab0ec6b115ff5398c9979fd6e63b162d2c31b9004bc0bbde2f7
-
SHA512
ac2b87c7207abe2da0f1c096c64a118001f9c29dbfed4142b35665818738e187182d68accc9eec02fef3238c87263d913d48edeb463555577e45433cabbc9c32
-
SSDEEP
49152:qcbzAQvx5odIOhfAizfT0WTb+w7jVViMpbG90dkw:qcbfSdIKf7LdOE2We0n
Malware Config
Signatures
-
Modifies Windows Firewall 2 TTPs 1 IoCs
Processes:
netsh.exepid process 412 netsh.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
AD58B25945745C24819493A24B4EB139.exesakura_protected.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\Control Panel\International\Geo\Nation AD58B25945745C24819493A24B4EB139.exe Key value queried \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\Control Panel\International\Geo\Nation sakura_protected.exe -
Drops startup file 2 IoCs
Processes:
svchost.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\325ed1ae2a47f27cdcc228f42fff7da3.exe svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\325ed1ae2a47f27cdcc228f42fff7da3.exe svchost.exe -
Executes dropped EXE 2 IoCs
Processes:
sakura_protected.exesvchost.exepid process 4712 sakura_protected.exe 4632 svchost.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\325ed1ae2a47f27cdcc228f42fff7da3 = "\"C:\\Windows\\svchost.exe\" .." svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\325ed1ae2a47f27cdcc228f42fff7da3 = "\"C:\\Windows\\svchost.exe\" .." svchost.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
-
Drops autorun.inf file 1 TTPs 5 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
Processes:
svchost.exedescription ioc process File created D:\autorun.inf svchost.exe File created F:\autorun.inf svchost.exe File opened for modification F:\autorun.inf svchost.exe File created C:\autorun.inf svchost.exe File opened for modification C:\autorun.inf svchost.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 17 IoCs
Processes:
sakura_protected.exesvchost.exepid process 4712 sakura_protected.exe 4712 sakura_protected.exe 4632 svchost.exe 4632 svchost.exe 4632 svchost.exe 4632 svchost.exe 4632 svchost.exe 4632 svchost.exe 4632 svchost.exe 4632 svchost.exe 4632 svchost.exe 4632 svchost.exe 4632 svchost.exe 4632 svchost.exe 4632 svchost.exe 4632 svchost.exe 4632 svchost.exe -
Drops file in Windows directory 3 IoCs
Processes:
sakura_protected.exesvchost.exedescription ioc process File created C:\Windows\svchost.exe sakura_protected.exe File opened for modification C:\Windows\svchost.exe sakura_protected.exe File opened for modification C:\Windows\svchost.exe svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
sakura_protected.exesvchost.exepid process 4712 sakura_protected.exe 4712 sakura_protected.exe 4632 svchost.exe 4632 svchost.exe -
Suspicious use of AdjustPrivilegeToken 33 IoCs
Processes:
svchost.exedescription pid process Token: SeDebugPrivilege 4632 svchost.exe Token: 33 4632 svchost.exe Token: SeIncBasePriorityPrivilege 4632 svchost.exe Token: 33 4632 svchost.exe Token: SeIncBasePriorityPrivilege 4632 svchost.exe Token: 33 4632 svchost.exe Token: SeIncBasePriorityPrivilege 4632 svchost.exe Token: 33 4632 svchost.exe Token: SeIncBasePriorityPrivilege 4632 svchost.exe Token: 33 4632 svchost.exe Token: SeIncBasePriorityPrivilege 4632 svchost.exe Token: 33 4632 svchost.exe Token: SeIncBasePriorityPrivilege 4632 svchost.exe Token: 33 4632 svchost.exe Token: SeIncBasePriorityPrivilege 4632 svchost.exe Token: 33 4632 svchost.exe Token: SeIncBasePriorityPrivilege 4632 svchost.exe Token: 33 4632 svchost.exe Token: SeIncBasePriorityPrivilege 4632 svchost.exe Token: 33 4632 svchost.exe Token: SeIncBasePriorityPrivilege 4632 svchost.exe Token: 33 4632 svchost.exe Token: SeIncBasePriorityPrivilege 4632 svchost.exe Token: 33 4632 svchost.exe Token: SeIncBasePriorityPrivilege 4632 svchost.exe Token: 33 4632 svchost.exe Token: SeIncBasePriorityPrivilege 4632 svchost.exe Token: 33 4632 svchost.exe Token: SeIncBasePriorityPrivilege 4632 svchost.exe Token: 33 4632 svchost.exe Token: SeIncBasePriorityPrivilege 4632 svchost.exe Token: 33 4632 svchost.exe Token: SeIncBasePriorityPrivilege 4632 svchost.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
sakura_protected.exesvchost.exepid process 4712 sakura_protected.exe 4632 svchost.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
AD58B25945745C24819493A24B4EB139.exesakura_protected.exesvchost.exedescription pid process target process PID 2160 wrote to memory of 4712 2160 AD58B25945745C24819493A24B4EB139.exe sakura_protected.exe PID 2160 wrote to memory of 4712 2160 AD58B25945745C24819493A24B4EB139.exe sakura_protected.exe PID 2160 wrote to memory of 4712 2160 AD58B25945745C24819493A24B4EB139.exe sakura_protected.exe PID 4712 wrote to memory of 4632 4712 sakura_protected.exe svchost.exe PID 4712 wrote to memory of 4632 4712 sakura_protected.exe svchost.exe PID 4712 wrote to memory of 4632 4712 sakura_protected.exe svchost.exe PID 4632 wrote to memory of 412 4632 svchost.exe netsh.exe PID 4632 wrote to memory of 412 4632 svchost.exe netsh.exe PID 4632 wrote to memory of 412 4632 svchost.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\AD58B25945745C24819493A24B4EB139.exe"C:\Users\Admin\AppData\Local\Temp\AD58B25945745C24819493A24B4EB139.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\sakura_protected.exe"C:\Users\Admin\AppData\Local\Temp\sakura_protected.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe"3⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Windows\svchost.exe" "svchost.exe" ENABLE4⤵
- Modifies Windows Firewall
PID:412
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\sakura_protected.exeFilesize
81KB
MD56c1b66e6671154bfabd750437c71fc8f
SHA1a74e0971fc8edbdcf9ac0b9af50fb87fce44174f
SHA2560582af23c1f4ff011afdb698d81e82245b81921acaffca79909d9991fcf61237
SHA51251b9ff6b7b244bbb7e3ae66c2d9b487e7993b658b3c8c93bfc87d0ee5a9b26d00b0470be214fb9235c5f3273317891321e54297df79c39c84f53082ddbed8435
-
C:\Users\Admin\AppData\Local\Temp\sakura_protected.exeFilesize
1.1MB
MD5ecb25b8adf7f999fba6245d362153fdb
SHA1b406b28ea8c548d9456704075f0eca1cae069d65
SHA256ebe160919d1646d96694de6a38b7ac570f1827dedb163174bee9253a7475dd54
SHA512168d62846ff9416c150e2606843b48353afba8dd4096a0b020d3fdf04b06b61d9ebd932c81474d75cd8ef27adbb6e68aa09357b552bef764fc4c3a4eef6ac9d0
-
C:\Windows\svchost.exeFilesize
975KB
MD538e3d7a592b8c1f12a3fb3db79b50e3c
SHA156710fd6788cbb670ded569cafae4d52bcf7780b
SHA25610fecbc7bfe31fa2d2bd27107d5a1fadfb96311a15f8562d4bc6a2e6e2d5f83f
SHA512b9da649ee5c8ff6efcc0eace960161b985e028900f464d96ee752b104c8bd0e15218c11c0b3e459e60d837e1d5a80b5ac62e0d5b36baeb7193a2edc3424aa94a
-
C:\Windows\svchost.exeFilesize
841KB
MD5d2fc7de02aee88e5375f66edbde4b01b
SHA18eee6ffeaa7200342125a9dfbcd1b5b7ff03e0ab
SHA256d22b9e5ce8540c2333c95addd84225241b46709b495b42651835a48be160cff4
SHA5125bae9c9671e08d1d8149b723efef3273fc8dc5b4c02a96e2eacf0d136045f14c596ea58558ccdd09ac47451361de70743cb317a74dbbbc216ed5596d74ea3fd9
-
memory/4632-38-0x0000000074270000-0x0000000074821000-memory.dmpFilesize
5.7MB
-
memory/4632-52-0x0000000074270000-0x0000000074821000-memory.dmpFilesize
5.7MB
-
memory/4632-51-0x0000000000F80000-0x00000000012F6000-memory.dmpFilesize
3.5MB
-
memory/4632-39-0x0000000074270000-0x0000000074821000-memory.dmpFilesize
5.7MB
-
memory/4632-33-0x0000000000F80000-0x00000000012F6000-memory.dmpFilesize
3.5MB
-
memory/4712-22-0x0000000074270000-0x0000000074821000-memory.dmpFilesize
5.7MB
-
memory/4712-37-0x0000000000440000-0x00000000007B6000-memory.dmpFilesize
3.5MB
-
memory/4712-36-0x0000000074270000-0x0000000074821000-memory.dmpFilesize
5.7MB
-
memory/4712-24-0x0000000074270000-0x0000000074821000-memory.dmpFilesize
5.7MB
-
memory/4712-23-0x0000000002F40000-0x0000000002F50000-memory.dmpFilesize
64KB
-
memory/4712-21-0x0000000000440000-0x00000000007B6000-memory.dmpFilesize
3.5MB