Analysis
-
max time kernel
25s -
max time network
37s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
29-03-2024 23:23
Static task
static1
Behavioral task
behavioral1
Sample
Trojan.Ransom.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Trojan.Ransom.exe
Resource
win10-20240221-en
Behavioral task
behavioral3
Sample
Trojan.Ransom.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral4
Sample
Trojan.Ransom.exe
Resource
win11-20240221-en
General
-
Target
Trojan.Ransom.exe
-
Size
49KB
-
MD5
46bfd4f1d581d7c0121d2b19a005d3df
-
SHA1
5b063298bbd1670b4d39e1baef67f854b8dcba9d
-
SHA256
683a09da219918258c58a7f61f7dc4161a3a7a377cf82a31b840baabfb9a4a96
-
SHA512
b52aa090f689765d099689700be7e18922137e7a860a00113e3f72aa6553e94a870bbb741e52de9617506a236a2a59198fb224fcd128576d76642eec9d715df5
-
SSDEEP
768:AbFw10RFnAwJM7MiqwecUaX5h4IuCdYa+XLXTGY1idL2WYiwtDj:Apw10vnAOIUaJh4IXdWXLXTWLfuFj
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Temp\!satana!.txt
Signatures
-
Satana
Ransomware family which also encrypts the system's Master Boot Record (MBR).
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Deletes itself 1 IoCs
Processes:
dtt.exepid process 2680 dtt.exe -
Executes dropped EXE 2 IoCs
Processes:
dtt.exedtt.exepid process 2652 dtt.exe 2680 dtt.exe -
Loads dropped DLL 5 IoCs
Processes:
Trojan.Ransom.exedtt.exepid process 2108 Trojan.Ransom.exe 2108 Trojan.Ransom.exe 2108 Trojan.Ransom.exe 2108 Trojan.Ransom.exe 2652 dtt.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
Trojan.Ransom.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Windows\CurrentVersion\Run\bdqo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\!satana!.txt" Trojan.Ransom.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
dtt.exedescription ioc process File opened for modification \??\PHYSICALDRIVE0 dtt.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
Trojan.Ransom.exedtt.exedescription pid process target process PID 2012 set thread context of 2108 2012 Trojan.Ransom.exe Trojan.Ransom.exe PID 2652 set thread context of 2680 2652 dtt.exe dtt.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
VSSADMIN.EXEpid process 2460 VSSADMIN.EXE -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
dtt.exedescription pid process Token: SeIncBasePriorityPrivilege 2680 dtt.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
Trojan.Ransom.exeTrojan.Ransom.exedtt.exedescription pid process target process PID 2012 wrote to memory of 2108 2012 Trojan.Ransom.exe Trojan.Ransom.exe PID 2012 wrote to memory of 2108 2012 Trojan.Ransom.exe Trojan.Ransom.exe PID 2012 wrote to memory of 2108 2012 Trojan.Ransom.exe Trojan.Ransom.exe PID 2012 wrote to memory of 2108 2012 Trojan.Ransom.exe Trojan.Ransom.exe PID 2012 wrote to memory of 2108 2012 Trojan.Ransom.exe Trojan.Ransom.exe PID 2012 wrote to memory of 2108 2012 Trojan.Ransom.exe Trojan.Ransom.exe PID 2012 wrote to memory of 2108 2012 Trojan.Ransom.exe Trojan.Ransom.exe PID 2012 wrote to memory of 2108 2012 Trojan.Ransom.exe Trojan.Ransom.exe PID 2012 wrote to memory of 2108 2012 Trojan.Ransom.exe Trojan.Ransom.exe PID 2012 wrote to memory of 2108 2012 Trojan.Ransom.exe Trojan.Ransom.exe PID 2108 wrote to memory of 2652 2108 Trojan.Ransom.exe dtt.exe PID 2108 wrote to memory of 2652 2108 Trojan.Ransom.exe dtt.exe PID 2108 wrote to memory of 2652 2108 Trojan.Ransom.exe dtt.exe PID 2108 wrote to memory of 2652 2108 Trojan.Ransom.exe dtt.exe PID 2652 wrote to memory of 2680 2652 dtt.exe dtt.exe PID 2652 wrote to memory of 2680 2652 dtt.exe dtt.exe PID 2652 wrote to memory of 2680 2652 dtt.exe dtt.exe PID 2652 wrote to memory of 2680 2652 dtt.exe dtt.exe PID 2652 wrote to memory of 2680 2652 dtt.exe dtt.exe PID 2652 wrote to memory of 2680 2652 dtt.exe dtt.exe PID 2652 wrote to memory of 2680 2652 dtt.exe dtt.exe PID 2652 wrote to memory of 2680 2652 dtt.exe dtt.exe PID 2652 wrote to memory of 2680 2652 dtt.exe dtt.exe PID 2652 wrote to memory of 2680 2652 dtt.exe dtt.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Trojan.Ransom.exe"C:\Users\Admin\AppData\Local\Temp\Trojan.Ransom.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\Trojan.Ransom.exe"C:\Users\Admin\AppData\Local\Temp\Trojan.Ransom.exe"2⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\dtt.exe"C:\Users\Admin\AppData\Local\Temp\dtt.exe" {846ee340-7039-11de-9d20-806e6f6e6963} "C:\Users\Admin\AppData\Local\Temp\TROJAN~1.EXE"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\dtt.exe"C:\Users\Admin\AppData\Local\Temp\dtt.exe" {846ee340-7039-11de-9d20-806e6f6e6963} "C:\Users\Admin\AppData\Local\Temp\TROJAN~1.EXE"4⤵
- Deletes itself
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of AdjustPrivilegeToken
PID:2680 -
C:\Windows\SysWOW64\VSSADMIN.EXE"C:\Windows\system32\VSSADMIN.EXE" Delete Shadows /All /Quiet5⤵
- Interacts with shadow copies
PID:2460
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5a2e92beeae710cc1ab2f7ea4900fb01b
SHA1e829f22cccbb449926741fc0392483c5883955e1
SHA256efe146eaf878625d384b715a4e11c8266c1bcae2c284fb184b776c26dc2248d4
SHA5121b09c0cfc86b7b814780149a385a592a2ace2ae81f4b333266ae7dd1f2a216c185a5059fd6661ff0e1a4879ccb339d33a139d6f3bd93f9e2c5d0cd2cd730c619
-
Filesize
49KB
MD546bfd4f1d581d7c0121d2b19a005d3df
SHA15b063298bbd1670b4d39e1baef67f854b8dcba9d
SHA256683a09da219918258c58a7f61f7dc4161a3a7a377cf82a31b840baabfb9a4a96
SHA512b52aa090f689765d099689700be7e18922137e7a860a00113e3f72aa6553e94a870bbb741e52de9617506a236a2a59198fb224fcd128576d76642eec9d715df5