Analysis
-
max time kernel
128s -
max time network
131s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
04-02-2024 14:41
Static task
static1
Behavioral task
behavioral1
Sample
unpacked.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
unpacked.exe
Resource
win10v2004-20231215-en
Errors
General
-
Target
unpacked.exe
-
Size
72KB
-
MD5
108756f41d114eb93e136ba2feb838d0
-
SHA1
8c6b51923ee7da2f4642c7717db95fbb77d96164
-
SHA256
b38b4c1dcf6d6ecd1bbfc236b43c37c18044c2f42f11e5088384f4bd0751929c
-
SHA512
d13183e8ba4689475b0cb3f5cc7acbfba34a1ba661eb5988984647c2bd3e561cfa03f6267f60ae9fb2ca0783f26c105cdbcfc89def598c48968febef23c21aaa
-
SSDEEP
768:F9NJK3qZRhxXHIQBsLL16BKc+bBQZ/UMc2:rXzXol6cc+lQZMMc2
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Temp\!satana!.txt
Signatures
-
Satana
Ransomware family which also encrypts the system's Master Boot Record (MBR).
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Deletes itself 1 IoCs
Processes:
fukps.exepid process 2768 fukps.exe -
Executes dropped EXE 1 IoCs
Processes:
fukps.exepid process 2768 fukps.exe -
Loads dropped DLL 5 IoCs
Processes:
unpacked.exefukps.exepid process 2288 unpacked.exe 2288 unpacked.exe 2288 unpacked.exe 2288 unpacked.exe 2768 fukps.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
unpacked.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\cxpk = "C:\\Users\\Admin\\AppData\\Local\\Temp\\!satana!.txt" unpacked.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
fukps.exedescription ioc process File opened for modification \??\PHYSICALDRIVE0 fukps.exe -
Drops file in Program Files directory 64 IoCs
Processes:
fukps.exedescription ioc process File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\NextMenuButtonIcon.png fukps.exe File created C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\TTS20\it-IT\!satana!.txt fukps.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\tile_bezel.png fukps.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Extensions\!satana!.txt fukps.exe File created C:\Program Files\VideoLAN\VLC\locale\ast\LC_MESSAGES\!satana!.txt fukps.exe File created C:\Program Files\VideoLAN\VLC\locale\az\!satana!.txt fukps.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SONORA\!satana!.txt fukps.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\en-US\!satana!.txt fukps.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\!satana!.txt fukps.exe File created C:\Program Files\VideoLAN\VLC\locale\ro\LC_MESSAGES\!satana!.txt fukps.exe File created C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\js\!satana!.txt fukps.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\!satana!.txt fukps.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\!satana!.txt fukps.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl\tab_on.gif fukps.exe File created C:\Program Files\Microsoft Games\Mahjong\it-IT\!satana!.txt fukps.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\divider-horizontal.png fukps.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\Calendar\CalendarViewButtonImages.jpg fukps.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\button_left_disable.gif fukps.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_gray_foggy.png fukps.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-waxing-gibbous.png fukps.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\gadget.xml fukps.exe File created C:\Program Files\Common Files\System\Ole DB\it-IT\!satana!.txt fukps.exe File created C:\Program Files\VideoLAN\VLC\locale\ru\LC_MESSAGES\!satana!.txt fukps.exe File created C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\it-IT\!satana!.txt fukps.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Trek.xml fukps.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\!satana!.txt fukps.exe File opened for modification C:\Program Files (x86)\Windows Media Player\Media Renderer\DMR_120.jpg fukps.exe File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\css\!satana!.txt fukps.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\!satana!.txt fukps.exe File created C:\Program Files\VideoLAN\!satana!.txt fukps.exe File created C:\Program Files\Windows NT\Accessories\es-ES\!satana!.txt fukps.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_corner_top_right.png fukps.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\css\!satana!.txt fukps.exe File opened for modification C:\Program Files\7-Zip\Lang\fur.txt fukps.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationLeft_SelectionSubpicture.png fukps.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-attach.xml fukps.exe File created C:\Program Files\Windows Sidebar\!satana!.txt fukps.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\[email protected]___button_left_disable.gif fukps.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\drag.png fukps.exe File created C:\Program Files\Java\jre7\bin\!satana!.txt fukps.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\modern.png fukps.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.es\!satana!.txt fukps.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Office Classic 2.xml fukps.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Library\Analysis\!satana!.txt fukps.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\!satana!.txt fukps.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-host-remote.xml fukps.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Help\1028\!satana!.txt fukps.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\images\!satana!.txt fukps.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\js\!satana!.txt fukps.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\3.png fukps.exe File created C:\Program Files\Windows Media Player\Network Sharing\!satana!.txt fukps.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_right_hover.png fukps.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\rssBackBlue_Undocked.png fukps.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\!satana!.txt fukps.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\InfoPathOM\InfoPathOMFormServices\Microsoft.Office.InfoPath.xml fukps.exe File created C:\Program Files\Microsoft Games\Multiplayer\Spades\fr-FR\!satana!.txt fukps.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\gadget.xml fukps.exe File created C:\Program Files (x86)\Windows Sidebar\ja-JP\!satana!.txt fukps.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\css\!satana!.txt fukps.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\novelty_h.png fukps.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\rssBackBlue_Undocked.png fukps.exe File created C:\Program Files\VideoLAN\VLC\locale\hy\!satana!.txt fukps.exe File created C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\FREN\!satana!.txt fukps.exe File created C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\1033\!satana!.txt fukps.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
VSSADMIN.EXEpid process 2740 VSSADMIN.EXE -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
fukps.exevssvc.exedescription pid process Token: SeIncBasePriorityPrivilege 2768 fukps.exe Token: SeBackupPrivilege 560 vssvc.exe Token: SeRestorePrivilege 560 vssvc.exe Token: SeAuditPrivilege 560 vssvc.exe Token: SeShutdownPrivilege 2768 fukps.exe -
Suspicious use of WriteProcessMemory 39 IoCs
Processes:
unpacked.exefukps.exedescription pid process target process PID 2288 wrote to memory of 2768 2288 unpacked.exe fukps.exe PID 2288 wrote to memory of 2768 2288 unpacked.exe fukps.exe PID 2288 wrote to memory of 2768 2288 unpacked.exe fukps.exe PID 2288 wrote to memory of 2768 2288 unpacked.exe fukps.exe PID 2768 wrote to memory of 2740 2768 fukps.exe VSSADMIN.EXE PID 2768 wrote to memory of 2740 2768 fukps.exe VSSADMIN.EXE PID 2768 wrote to memory of 2740 2768 fukps.exe VSSADMIN.EXE PID 2768 wrote to memory of 2740 2768 fukps.exe VSSADMIN.EXE PID 2768 wrote to memory of 13304 2768 fukps.exe NOTEPAD.EXE PID 2768 wrote to memory of 13304 2768 fukps.exe NOTEPAD.EXE PID 2768 wrote to memory of 13304 2768 fukps.exe NOTEPAD.EXE PID 2768 wrote to memory of 13304 2768 fukps.exe NOTEPAD.EXE PID 2768 wrote to memory of 11348 2768 fukps.exe rundll32.exe PID 2768 wrote to memory of 11348 2768 fukps.exe rundll32.exe PID 2768 wrote to memory of 11348 2768 fukps.exe rundll32.exe PID 2768 wrote to memory of 11348 2768 fukps.exe rundll32.exe PID 2768 wrote to memory of 11348 2768 fukps.exe rundll32.exe PID 2768 wrote to memory of 11348 2768 fukps.exe rundll32.exe PID 2768 wrote to memory of 11348 2768 fukps.exe rundll32.exe PID 2768 wrote to memory of 11348 2768 fukps.exe rundll32.exe PID 2768 wrote to memory of 11348 2768 fukps.exe rundll32.exe PID 2768 wrote to memory of 11580 2768 fukps.exe rundll32.exe PID 2768 wrote to memory of 11580 2768 fukps.exe rundll32.exe PID 2768 wrote to memory of 11580 2768 fukps.exe rundll32.exe PID 2768 wrote to memory of 11580 2768 fukps.exe rundll32.exe PID 2768 wrote to memory of 11580 2768 fukps.exe rundll32.exe PID 2768 wrote to memory of 11580 2768 fukps.exe rundll32.exe PID 2768 wrote to memory of 11580 2768 fukps.exe rundll32.exe PID 2768 wrote to memory of 11580 2768 fukps.exe rundll32.exe PID 2768 wrote to memory of 11580 2768 fukps.exe rundll32.exe PID 2768 wrote to memory of 11716 2768 fukps.exe rundll32.exe PID 2768 wrote to memory of 11716 2768 fukps.exe rundll32.exe PID 2768 wrote to memory of 11716 2768 fukps.exe rundll32.exe PID 2768 wrote to memory of 11716 2768 fukps.exe rundll32.exe PID 2768 wrote to memory of 11716 2768 fukps.exe rundll32.exe PID 2768 wrote to memory of 11716 2768 fukps.exe rundll32.exe PID 2768 wrote to memory of 11716 2768 fukps.exe rundll32.exe PID 2768 wrote to memory of 11716 2768 fukps.exe rundll32.exe PID 2768 wrote to memory of 11716 2768 fukps.exe rundll32.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\unpacked.exe"C:\Users\Admin\AppData\Local\Temp\unpacked.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\fukps.exe"C:\Users\Admin\AppData\Local\Temp\fukps.exe" {846ee340-7039-11de-9d20-806e6f6e6963} "C:\Users\Admin\AppData\Local\Temp\unpacked.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Windows\SysWOW64\VSSADMIN.EXE"C:\Windows\system32\VSSADMIN.EXE" Delete Shadows /All /Quiet3⤵
- Interacts with shadow copies
PID:2740
-
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\!satana!.txt3⤵PID:13304
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe3⤵PID:11348
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe3⤵PID:11580
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe3⤵PID:11716
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:560
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x01⤵PID:11544
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x11⤵PID:12184
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD50358f505efb72d130f68cdb8d7ebfd21
SHA170bee72a355db5143a44e8de77e5b7b34dc1775f
SHA2569f429c3625766d5720a3e62a058e2700e0a667e7b94adbabe2d1f1cb909d2bb4
SHA512ea2a10a7f3853b8861f688f653d7e2e5b6db8ac83d0db44017d5ac64bcb65f1402b42849aca3f432a1e3b0ac2ded3f1af7fc77886110abf4bfdfc0fd3876d880
-
Filesize
72KB
MD5108756f41d114eb93e136ba2feb838d0
SHA18c6b51923ee7da2f4642c7717db95fbb77d96164
SHA256b38b4c1dcf6d6ecd1bbfc236b43c37c18044c2f42f11e5088384f4bd0751929c
SHA512d13183e8ba4689475b0cb3f5cc7acbfba34a1ba661eb5988984647c2bd3e561cfa03f6267f60ae9fb2ca0783f26c105cdbcfc89def598c48968febef23c21aaa