Analysis
-
max time kernel
149s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
25-01-2024 17:16
Static task
static1
Behavioral task
behavioral1
Sample
AD58B25945745C24819493A24B4EB139.exe
Resource
win7-20231129-en
General
-
Target
AD58B25945745C24819493A24B4EB139.exe
-
Size
1.8MB
-
MD5
ad58b25945745c24819493a24b4eb139
-
SHA1
37df601266d4e8757c0018e091838378514524e5
-
SHA256
b1af59115af9cab0ec6b115ff5398c9979fd6e63b162d2c31b9004bc0bbde2f7
-
SHA512
ac2b87c7207abe2da0f1c096c64a118001f9c29dbfed4142b35665818738e187182d68accc9eec02fef3238c87263d913d48edeb463555577e45433cabbc9c32
-
SSDEEP
49152:qcbzAQvx5odIOhfAizfT0WTb+w7jVViMpbG90dkw:qcbfSdIKf7LdOE2We0n
Malware Config
Signatures
-
Modifies Windows Firewall 2 TTPs 1 IoCs
Processes:
netsh.exepid process 840 netsh.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
AD58B25945745C24819493A24B4EB139.exesakura_protected.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Control Panel\International\Geo\Nation AD58B25945745C24819493A24B4EB139.exe Key value queried \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Control Panel\International\Geo\Nation sakura_protected.exe -
Drops startup file 2 IoCs
Processes:
svchost.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\325ed1ae2a47f27cdcc228f42fff7da3.exe svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\325ed1ae2a47f27cdcc228f42fff7da3.exe svchost.exe -
Executes dropped EXE 2 IoCs
Processes:
sakura_protected.exesvchost.exepid process 4320 sakura_protected.exe 4036 svchost.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\325ed1ae2a47f27cdcc228f42fff7da3 = "\"C:\\Windows\\svchost.exe\" .." svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\325ed1ae2a47f27cdcc228f42fff7da3 = "\"C:\\Windows\\svchost.exe\" .." svchost.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
-
Drops autorun.inf file 1 TTPs 5 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
Processes:
svchost.exedescription ioc process File created C:\autorun.inf svchost.exe File opened for modification C:\autorun.inf svchost.exe File created D:\autorun.inf svchost.exe File created F:\autorun.inf svchost.exe File opened for modification F:\autorun.inf svchost.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 16 IoCs
Processes:
sakura_protected.exesvchost.exepid process 4320 sakura_protected.exe 4036 svchost.exe 4036 svchost.exe 4036 svchost.exe 4036 svchost.exe 4036 svchost.exe 4036 svchost.exe 4036 svchost.exe 4036 svchost.exe 4036 svchost.exe 4036 svchost.exe 4036 svchost.exe 4036 svchost.exe 4036 svchost.exe 4036 svchost.exe 4036 svchost.exe -
Drops file in Windows directory 3 IoCs
Processes:
sakura_protected.exesvchost.exedescription ioc process File created C:\Windows\svchost.exe sakura_protected.exe File opened for modification C:\Windows\svchost.exe sakura_protected.exe File opened for modification C:\Windows\svchost.exe svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
sakura_protected.exesvchost.exepid process 4320 sakura_protected.exe 4320 sakura_protected.exe 4036 svchost.exe 4036 svchost.exe -
Suspicious use of AdjustPrivilegeToken 35 IoCs
Processes:
svchost.exedescription pid process Token: SeDebugPrivilege 4036 svchost.exe Token: 33 4036 svchost.exe Token: SeIncBasePriorityPrivilege 4036 svchost.exe Token: 33 4036 svchost.exe Token: SeIncBasePriorityPrivilege 4036 svchost.exe Token: 33 4036 svchost.exe Token: SeIncBasePriorityPrivilege 4036 svchost.exe Token: 33 4036 svchost.exe Token: SeIncBasePriorityPrivilege 4036 svchost.exe Token: 33 4036 svchost.exe Token: SeIncBasePriorityPrivilege 4036 svchost.exe Token: 33 4036 svchost.exe Token: SeIncBasePriorityPrivilege 4036 svchost.exe Token: 33 4036 svchost.exe Token: SeIncBasePriorityPrivilege 4036 svchost.exe Token: 33 4036 svchost.exe Token: SeIncBasePriorityPrivilege 4036 svchost.exe Token: 33 4036 svchost.exe Token: SeIncBasePriorityPrivilege 4036 svchost.exe Token: 33 4036 svchost.exe Token: SeIncBasePriorityPrivilege 4036 svchost.exe Token: 33 4036 svchost.exe Token: SeIncBasePriorityPrivilege 4036 svchost.exe Token: 33 4036 svchost.exe Token: SeIncBasePriorityPrivilege 4036 svchost.exe Token: 33 4036 svchost.exe Token: SeIncBasePriorityPrivilege 4036 svchost.exe Token: 33 4036 svchost.exe Token: SeIncBasePriorityPrivilege 4036 svchost.exe Token: 33 4036 svchost.exe Token: SeIncBasePriorityPrivilege 4036 svchost.exe Token: 33 4036 svchost.exe Token: SeIncBasePriorityPrivilege 4036 svchost.exe Token: 33 4036 svchost.exe Token: SeIncBasePriorityPrivilege 4036 svchost.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
sakura_protected.exesvchost.exepid process 4320 sakura_protected.exe 4036 svchost.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
AD58B25945745C24819493A24B4EB139.exesakura_protected.exesvchost.exedescription pid process target process PID 4876 wrote to memory of 4320 4876 AD58B25945745C24819493A24B4EB139.exe sakura_protected.exe PID 4876 wrote to memory of 4320 4876 AD58B25945745C24819493A24B4EB139.exe sakura_protected.exe PID 4876 wrote to memory of 4320 4876 AD58B25945745C24819493A24B4EB139.exe sakura_protected.exe PID 4320 wrote to memory of 4036 4320 sakura_protected.exe svchost.exe PID 4320 wrote to memory of 4036 4320 sakura_protected.exe svchost.exe PID 4320 wrote to memory of 4036 4320 sakura_protected.exe svchost.exe PID 4036 wrote to memory of 840 4036 svchost.exe netsh.exe PID 4036 wrote to memory of 840 4036 svchost.exe netsh.exe PID 4036 wrote to memory of 840 4036 svchost.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\AD58B25945745C24819493A24B4EB139.exe"C:\Users\Admin\AppData\Local\Temp\AD58B25945745C24819493A24B4EB139.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\sakura_protected.exe"C:\Users\Admin\AppData\Local\Temp\sakura_protected.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4320 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe"3⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4036 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Windows\svchost.exe" "svchost.exe" ENABLE4⤵
- Modifies Windows Firewall
PID:840
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\sakura_protected.exeFilesize
1.1MB
MD5ecb25b8adf7f999fba6245d362153fdb
SHA1b406b28ea8c548d9456704075f0eca1cae069d65
SHA256ebe160919d1646d96694de6a38b7ac570f1827dedb163174bee9253a7475dd54
SHA512168d62846ff9416c150e2606843b48353afba8dd4096a0b020d3fdf04b06b61d9ebd932c81474d75cd8ef27adbb6e68aa09357b552bef764fc4c3a4eef6ac9d0
-
memory/4036-33-0x0000000000210000-0x0000000000586000-memory.dmpFilesize
3.5MB
-
memory/4036-37-0x0000000073A50000-0x0000000074001000-memory.dmpFilesize
5.7MB
-
memory/4036-50-0x0000000000210000-0x0000000000586000-memory.dmpFilesize
3.5MB
-
memory/4036-51-0x0000000073A50000-0x0000000074001000-memory.dmpFilesize
5.7MB
-
memory/4320-21-0x0000000000A30000-0x0000000000DA6000-memory.dmpFilesize
3.5MB
-
memory/4320-22-0x0000000073A50000-0x0000000074001000-memory.dmpFilesize
5.7MB
-
memory/4320-24-0x0000000003200000-0x0000000003210000-memory.dmpFilesize
64KB
-
memory/4320-23-0x0000000073A50000-0x0000000074001000-memory.dmpFilesize
5.7MB
-
memory/4320-36-0x0000000000A30000-0x0000000000DA6000-memory.dmpFilesize
3.5MB
-
memory/4320-38-0x0000000073A50000-0x0000000074001000-memory.dmpFilesize
5.7MB