Analysis
-
max time kernel
2s -
max time network
1s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
14/03/2024, 08:56
Static task
static1
Behavioral task
behavioral1
Sample
c83683f39811843d21d6e0549a719319.exe
Resource
win7-20240215-en
Errors
General
-
Target
c83683f39811843d21d6e0549a719319.exe
-
Size
213KB
-
MD5
c83683f39811843d21d6e0549a719319
-
SHA1
eea12a2cba5cbc096dbbbe1bcfe961303c2d1a71
-
SHA256
819f1b73883c0269751c89fc361a2041e78b03e890b9db1aecacedf56db38245
-
SHA512
219148f585b9651e4d28b5092c895a5daa9aafd40f8bbb773bad7ea1480463712548a956ddfe03fdbd0195dc43bf5272bd213ea495ec57df8f8483b22799095f
-
SSDEEP
3072:OYcud7rA8ds8s3qIwfOZYp4btmQyjl1c/swFJ27kwkvrW33uvtI2HuaOyx/ztmCp:bE8djxOZxbM5rcRFJ27UvsI5txbtp
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,,C:\\Users\\Admin\\AppData\\Local\\kysnbqrn\\sfkaltbb.exe" c83683f39811843d21d6e0549a719319.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,C:\\Users\\Admin\\AppData\\Local\\kysnbqrn\\sfkaltbb.exe" c83683f39811843d21d6e0549a719319.exe -
Modifies firewall policy service 2 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" c83683f39811843d21d6e0549a719319.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" c83683f39811843d21d6e0549a719319.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" c83683f39811843d21d6e0549a719319.exe -
Modifies security service 2 TTPs 4 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" c83683f39811843d21d6e0549a719319.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Start = "4" c83683f39811843d21d6e0549a719319.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\Start = "4" c83683f39811843d21d6e0549a719319.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4" c83683f39811843d21d6e0549a719319.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" c83683f39811843d21d6e0549a719319.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" c83683f39811843d21d6e0549a719319.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" c83683f39811843d21d6e0549a719319.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" c83683f39811843d21d6e0549a719319.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" c83683f39811843d21d6e0549a719319.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" c83683f39811843d21d6e0549a719319.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" c83683f39811843d21d6e0549a719319.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sfkaltbb.exe c83683f39811843d21d6e0549a719319.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sfkaltbb.exe c83683f39811843d21d6e0549a719319.exe -
resource yara_rule behavioral1/memory/2316-1-0x0000000015190000-0x00000000151FD000-memory.dmp upx behavioral1/memory/2316-6-0x0000000015190000-0x00000000151FD000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" c83683f39811843d21d6e0549a719319.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" c83683f39811843d21d6e0549a719319.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" c83683f39811843d21d6e0549a719319.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" c83683f39811843d21d6e0549a719319.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" c83683f39811843d21d6e0549a719319.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" c83683f39811843d21d6e0549a719319.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\SfkAltbb = "C:\\Users\\Admin\\AppData\\Local\\kysnbqrn\\sfkaltbb.exe" c83683f39811843d21d6e0549a719319.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" c83683f39811843d21d6e0549a719319.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2316 c83683f39811843d21d6e0549a719319.exe 2316 c83683f39811843d21d6e0549a719319.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeSecurityPrivilege 2316 c83683f39811843d21d6e0549a719319.exe Token: SeRestorePrivilege 2316 c83683f39811843d21d6e0549a719319.exe Token: SeBackupPrivilege 2316 c83683f39811843d21d6e0549a719319.exe Token: SeShutdownPrivilege 2316 c83683f39811843d21d6e0549a719319.exe -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" c83683f39811843d21d6e0549a719319.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c83683f39811843d21d6e0549a719319.exe"C:\Users\Admin\AppData\Local\Temp\c83683f39811843d21d6e0549a719319.exe"1⤵
- Modifies WinLogon for persistence
- Modifies firewall policy service
- Modifies security service
- UAC bypass
- Windows security bypass
- Drops startup file
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:2316
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2