Analysis
- max time kernel
120s - max time network
124s - platform
windows7_x64 - resource
win7-20231215-en - resource tags
- submitted
21/02/2024, 07:34
General
- Target f55b4ad27fd94b0aaa08dd111af7f6c0b49086b756fb216ca5662d4dc733ddb5.exe
- Size 4.0MB
- Sample240221-jd83fsdd57
- SHA256 f55b4ad27fd94b0aaa08dd111af7f6c0b49086b756fb216ca5662d4dc733ddb5
Malware Config
Extracted
-
sality
-
http://89.119.67.154/testo5/
-
http://kukutrustnet777.info/home.gif
-
http://kukutrustnet888.info/home.gif
-
http://kukutrustnet987.info/home.gif
Signatures
- Modifies firewall policy service 2 TTPs 3 IoCs
- Sality
Sality is backdoor written in C++, first discovered in 2003.
- UAC bypass 3 TTPs 1 IoCs
- Windows security bypass 2 TTPs 6 IoCs
- UPX packed file 15 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Windows security modification 2 TTPs 7 IoCs
- Checks whether UAC is enabled 1 TTPs 2 IoCs
- Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- Drops file in Windows directory 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies Internet Explorer settings 1 TTPs 2 IoCs
- Suspicious behavior: EnumeratesProcesses 10 IoCs
- Suspicious use of AdjustPrivilegeToken 20 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
- System policy modification 1 TTPs 1 IoCs
Processes
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\f55b4ad27fd94b0aaa08dd111af7f6c0b49086b756fb216ca5662d4dc733ddb5.exe"C:\Users\Admin\AppData\Local\Temp\f55b4ad27fd94b0aaa08dd111af7f6c0b49086b756fb216ca5662d4dc733ddb5.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Create or Modify System Process
1Windows Service
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
memory/1160-5-0x0000000001DE0000-0x0000000001DE2000-memory.dmp
memory/2000-18-0x00000000021A0000-0x00000000021A1000-memory.dmp
memory/2000-21-0x0000000002210000-0x00000000032CA000-memory.dmp
memory/2000-1-0x0000000002210000-0x00000000032CA000-memory.dmp
memory/2000-4-0x0000000002210000-0x00000000032CA000-memory.dmp
memory/2000-9-0x0000000002210000-0x00000000032CA000-memory.dmp
memory/2000-14-0x0000000002010000-0x0000000002012000-memory.dmp
memory/2000-15-0x00000000021A0000-0x00000000021A1000-memory.dmp
memory/2000-13-0x0000000002210000-0x00000000032CA000-memory.dmp
memory/2000-20-0x0000000002010000-0x0000000002012000-memory.dmp
memory/2000-22-0x0000000002210000-0x00000000032CA000-memory.dmp
memory/2000-3-0x0000000002210000-0x00000000032CA000-memory.dmp
memory/2000-17-0x0000000002210000-0x00000000032CA000-memory.dmp
memory/2000-0-0x0000000000400000-0x00000000005EC000-memory.dmp
memory/2000-24-0x0000000002210000-0x00000000032CA000-memory.dmp
memory/2000-25-0x0000000002210000-0x00000000032CA000-memory.dmp
memory/2000-30-0x0000000002210000-0x00000000032CA000-memory.dmp
memory/2000-31-0x0000000002210000-0x00000000032CA000-memory.dmp
memory/2000-32-0x0000000002210000-0x00000000032CA000-memory.dmp
memory/2000-33-0x0000000002210000-0x00000000032CA000-memory.dmp
memory/2000-40-0x0000000002010000-0x0000000002012000-memory.dmp
memory/2000-46-0x0000000002210000-0x00000000032CA000-memory.dmp
memory/2000-51-0x0000000000400000-0x00000000005EC000-memory.dmp