Analysis
-
max time kernel
26s -
max time network
40s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
19-02-2024 13:48
Static task
static1
Behavioral task
behavioral1
Sample
Satana.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
Satana.exe
Resource
win10v2004-20231215-en
General
-
Target
Satana.exe
-
Size
49KB
-
MD5
46bfd4f1d581d7c0121d2b19a005d3df
-
SHA1
5b063298bbd1670b4d39e1baef67f854b8dcba9d
-
SHA256
683a09da219918258c58a7f61f7dc4161a3a7a377cf82a31b840baabfb9a4a96
-
SHA512
b52aa090f689765d099689700be7e18922137e7a860a00113e3f72aa6553e94a870bbb741e52de9617506a236a2a59198fb224fcd128576d76642eec9d715df5
-
SSDEEP
768:AbFw10RFnAwJM7MiqwecUaX5h4IuCdYa+XLXTGY1idL2WYiwtDj:Apw10vnAOIUaJh4IXdWXLXTWLfuFj
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Temp\!satana!.txt
Signatures
-
Satana
Ransomware family which also encrypts the system's Master Boot Record (MBR).
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Deletes itself 1 IoCs
pid Process 2584 nupvpf.exe -
Executes dropped EXE 2 IoCs
pid Process 2764 nupvpf.exe 2584 nupvpf.exe -
Loads dropped DLL 5 IoCs
pid Process 2360 Satana.exe 2360 Satana.exe 2360 Satana.exe 2360 Satana.exe 2764 nupvpf.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\vbenkjf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\!satana!.txt" Satana.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PHYSICALDRIVE0 nupvpf.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 3028 set thread context of 2360 3028 Satana.exe 28 PID 2764 set thread context of 2584 2764 nupvpf.exe 30 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 2132 VSSADMIN.EXE -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2584 nupvpf.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 3028 wrote to memory of 2360 3028 Satana.exe 28 PID 3028 wrote to memory of 2360 3028 Satana.exe 28 PID 3028 wrote to memory of 2360 3028 Satana.exe 28 PID 3028 wrote to memory of 2360 3028 Satana.exe 28 PID 3028 wrote to memory of 2360 3028 Satana.exe 28 PID 3028 wrote to memory of 2360 3028 Satana.exe 28 PID 3028 wrote to memory of 2360 3028 Satana.exe 28 PID 3028 wrote to memory of 2360 3028 Satana.exe 28 PID 3028 wrote to memory of 2360 3028 Satana.exe 28 PID 3028 wrote to memory of 2360 3028 Satana.exe 28 PID 2360 wrote to memory of 2764 2360 Satana.exe 29 PID 2360 wrote to memory of 2764 2360 Satana.exe 29 PID 2360 wrote to memory of 2764 2360 Satana.exe 29 PID 2360 wrote to memory of 2764 2360 Satana.exe 29 PID 2764 wrote to memory of 2584 2764 nupvpf.exe 30 PID 2764 wrote to memory of 2584 2764 nupvpf.exe 30 PID 2764 wrote to memory of 2584 2764 nupvpf.exe 30 PID 2764 wrote to memory of 2584 2764 nupvpf.exe 30 PID 2764 wrote to memory of 2584 2764 nupvpf.exe 30 PID 2764 wrote to memory of 2584 2764 nupvpf.exe 30 PID 2764 wrote to memory of 2584 2764 nupvpf.exe 30 PID 2764 wrote to memory of 2584 2764 nupvpf.exe 30 PID 2764 wrote to memory of 2584 2764 nupvpf.exe 30 PID 2764 wrote to memory of 2584 2764 nupvpf.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\Satana.exe"C:\Users\Admin\AppData\Local\Temp\Satana.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\Satana.exe"C:\Users\Admin\AppData\Local\Temp\Satana.exe"2⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\nupvpf.exe"C:\Users\Admin\AppData\Local\Temp\nupvpf.exe" {846ee340-7039-11de-9d20-806e6f6e6963} "C:\Users\Admin\AppData\Local\Temp\Satana.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\nupvpf.exe"C:\Users\Admin\AppData\Local\Temp\nupvpf.exe" {846ee340-7039-11de-9d20-806e6f6e6963} "C:\Users\Admin\AppData\Local\Temp\Satana.exe"4⤵
- Deletes itself
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of AdjustPrivilegeToken
PID:2584 -
C:\Windows\SysWOW64\VSSADMIN.EXE"C:\Windows\system32\VSSADMIN.EXE" Delete Shadows /All /Quiet5⤵
- Interacts with shadow copies
PID:2132
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD549ff97468d18a2a6d09ab0470780bcf0
SHA132ffc90e525a90ebdb79b07e4c4bec1d910c5559
SHA25682889f0f8bf79d0d8ae0f26d61f600d9396ad2bc460b727219e4386bec2c16ce
SHA51292ce13aa5add02366749dd065899fe490a5cb15e222df5b4d8e3cce06fce5430445521729aaaded19942a968e1eeb7b081e2f7ab6e8265a0409811bc7f11d494
-
Filesize
49KB
MD546bfd4f1d581d7c0121d2b19a005d3df
SHA15b063298bbd1670b4d39e1baef67f854b8dcba9d
SHA256683a09da219918258c58a7f61f7dc4161a3a7a377cf82a31b840baabfb9a4a96
SHA512b52aa090f689765d099689700be7e18922137e7a860a00113e3f72aa6553e94a870bbb741e52de9617506a236a2a59198fb224fcd128576d76642eec9d715df5