Analysis
-
max time kernel
26s -
max time network
39s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
01-03-2024 09:08
Static task
static1
Behavioral task
behavioral1
Sample
Trojan-Ransom.Win32.Satan.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Trojan-Ransom.Win32.Satan.exe
Resource
win10v2004-20240226-en
General
-
Target
Trojan-Ransom.Win32.Satan.exe
-
Size
49KB
-
MD5
46bfd4f1d581d7c0121d2b19a005d3df
-
SHA1
5b063298bbd1670b4d39e1baef67f854b8dcba9d
-
SHA256
683a09da219918258c58a7f61f7dc4161a3a7a377cf82a31b840baabfb9a4a96
-
SHA512
b52aa090f689765d099689700be7e18922137e7a860a00113e3f72aa6553e94a870bbb741e52de9617506a236a2a59198fb224fcd128576d76642eec9d715df5
-
SSDEEP
768:AbFw10RFnAwJM7MiqwecUaX5h4IuCdYa+XLXTGY1idL2WYiwtDj:Apw10vnAOIUaJh4IXdWXLXTWLfuFj
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Temp\!satana!.txt
Signatures
-
Satana
Ransomware family which also encrypts the system's Master Boot Record (MBR).
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Deletes itself 1 IoCs
pid Process 2864 vsmxp.exe -
Executes dropped EXE 2 IoCs
pid Process 2636 vsmxp.exe 2864 vsmxp.exe -
Loads dropped DLL 5 IoCs
pid Process 2736 Trojan-Ransom.Win32.Satan.exe 2736 Trojan-Ransom.Win32.Satan.exe 2736 Trojan-Ransom.Win32.Satan.exe 2736 Trojan-Ransom.Win32.Satan.exe 2636 vsmxp.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\zftui = "C:\\Users\\Admin\\AppData\\Local\\Temp\\!satana!.txt" Trojan-Ransom.Win32.Satan.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PHYSICALDRIVE0 vsmxp.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2612 set thread context of 2736 2612 Trojan-Ransom.Win32.Satan.exe 28 PID 2636 set thread context of 2864 2636 vsmxp.exe 32 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 568 VSSADMIN.EXE -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2864 vsmxp.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 2612 wrote to memory of 2736 2612 Trojan-Ransom.Win32.Satan.exe 28 PID 2612 wrote to memory of 2736 2612 Trojan-Ransom.Win32.Satan.exe 28 PID 2612 wrote to memory of 2736 2612 Trojan-Ransom.Win32.Satan.exe 28 PID 2612 wrote to memory of 2736 2612 Trojan-Ransom.Win32.Satan.exe 28 PID 2612 wrote to memory of 2736 2612 Trojan-Ransom.Win32.Satan.exe 28 PID 2612 wrote to memory of 2736 2612 Trojan-Ransom.Win32.Satan.exe 28 PID 2612 wrote to memory of 2736 2612 Trojan-Ransom.Win32.Satan.exe 28 PID 2612 wrote to memory of 2736 2612 Trojan-Ransom.Win32.Satan.exe 28 PID 2612 wrote to memory of 2736 2612 Trojan-Ransom.Win32.Satan.exe 28 PID 2612 wrote to memory of 2736 2612 Trojan-Ransom.Win32.Satan.exe 28 PID 2736 wrote to memory of 2636 2736 Trojan-Ransom.Win32.Satan.exe 31 PID 2736 wrote to memory of 2636 2736 Trojan-Ransom.Win32.Satan.exe 31 PID 2736 wrote to memory of 2636 2736 Trojan-Ransom.Win32.Satan.exe 31 PID 2736 wrote to memory of 2636 2736 Trojan-Ransom.Win32.Satan.exe 31 PID 2636 wrote to memory of 2864 2636 vsmxp.exe 32 PID 2636 wrote to memory of 2864 2636 vsmxp.exe 32 PID 2636 wrote to memory of 2864 2636 vsmxp.exe 32 PID 2636 wrote to memory of 2864 2636 vsmxp.exe 32 PID 2636 wrote to memory of 2864 2636 vsmxp.exe 32 PID 2636 wrote to memory of 2864 2636 vsmxp.exe 32 PID 2636 wrote to memory of 2864 2636 vsmxp.exe 32 PID 2636 wrote to memory of 2864 2636 vsmxp.exe 32 PID 2636 wrote to memory of 2864 2636 vsmxp.exe 32 PID 2636 wrote to memory of 2864 2636 vsmxp.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\Trojan-Ransom.Win32.Satan.exe"C:\Users\Admin\AppData\Local\Temp\Trojan-Ransom.Win32.Satan.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\Trojan-Ransom.Win32.Satan.exe"C:\Users\Admin\AppData\Local\Temp\Trojan-Ransom.Win32.Satan.exe"2⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\vsmxp.exe"C:\Users\Admin\AppData\Local\Temp\vsmxp.exe" {846ee340-7039-11de-9d20-806e6f6e6963} "C:\Users\Admin\AppData\Local\Temp\TROJAN~1.EXE"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\vsmxp.exe"C:\Users\Admin\AppData\Local\Temp\vsmxp.exe" {846ee340-7039-11de-9d20-806e6f6e6963} "C:\Users\Admin\AppData\Local\Temp\TROJAN~1.EXE"4⤵
- Deletes itself
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of AdjustPrivilegeToken
PID:2864 -
C:\Windows\SysWOW64\VSSADMIN.EXE"C:\Windows\system32\VSSADMIN.EXE" Delete Shadows /All /Quiet5⤵
- Interacts with shadow copies
PID:568
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5140fd6bfea741c8ab5438c5135199c1e
SHA19184366f3f4ac3f21a5d19dff0b2f1cf82e3fd8f
SHA256c8eedfd90731d26af5b766b31882c250216302203753d7a53efc3c90e9d1a74b
SHA512b38e6d5f2261b2ce14feb1979a06d7aa9cb390a7aa72340e8c9e152e1804b0e1c347531391f6933ee6d59992d1fec0bd85c28c2f4c6a7ee50a778b8d3c59bde5
-
Filesize
49KB
MD546bfd4f1d581d7c0121d2b19a005d3df
SHA15b063298bbd1670b4d39e1baef67f854b8dcba9d
SHA256683a09da219918258c58a7f61f7dc4161a3a7a377cf82a31b840baabfb9a4a96
SHA512b52aa090f689765d099689700be7e18922137e7a860a00113e3f72aa6553e94a870bbb741e52de9617506a236a2a59198fb224fcd128576d76642eec9d715df5