Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240319-en -
resource tags
-
submitted
30-03-2024 01:57
General
-
Target
dfba00a78e533093c49e03096bc38c4a7bd42ab69595ea074caae3e06e36fab4.exe
-
Size
65KB
-
MD5
6686079dd5b6eb537817dc1b240a2c51
-
SHA1
1cfa433c05165518f9e14d9b6b0c1a438018f40d
-
SHA256
dfba00a78e533093c49e03096bc38c4a7bd42ab69595ea074caae3e06e36fab4
-
SHA512
70d6d6e857f3526a867c1b714e5b57dbc1f11c2935e1190ec1831112a421b78ff525bb02f175e7099929288a0ab2218dd6d7fb5481a0e4604809c0b44a24875d
-
SSDEEP
1536:xwKe0v4v0iakUxxt4ka/imrSp84zIO5KI/lERvv8yo+vWcotp32op:xPWPyt7aKmkMYKI/MEv+vWRtwop
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 2 TTPs 3 IoCs
-
Sality
Sality is backdoor written in C++, first discovered in 2003.
-
UAC bypass 3 TTPs 1 IoCs
-
Windows security bypass 2 TTPs 6 IoCs
-
Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 32 IoCs
-
UPX dump on OEP (original entry point) 32 IoCs
-
UPX packed file 32 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Windows security modification 2 TTPs 7 IoCs
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in Program Files directory 1 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 32 IoCs
-
Suspicious use of WriteProcessMemory 37 IoCs
-
System policy modification 1 TTPs 1 IoCs
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\dfba00a78e533093c49e03096bc38c4a7bd42ab69595ea074caae3e06e36fab4.exe"C:\Users\Admin\AppData\Local\Temp\dfba00a78e533093c49e03096bc38c4a7bd42ab69595ea074caae3e06e36fab4.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Create or Modify System Process
1Windows Service
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Modify Registry
5Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\wcnsq.exeFilesize
97KB
MD5391a8b15d4def17d46c0951acb531815
SHA1669959fe58bfbbce05a9506c99a0cebbdc4bd1b9
SHA25605c1c446c90e461caca615cae92495f56a35a79babb44e509421e58733177894
SHA5122d862ce7390a6832f8afe3edaf0f4cf65471eb86b8f60d8e328d1add3eaa187cd3689a7ae5204e34a2191ddbd584786d99ce6ab8e933be9fc547257ee80151ce
-
memory/1132-6-0x0000000000350000-0x0000000000352000-memory.dmpFilesize
8KB
-
memory/2144-36-0x0000000000710000-0x00000000017CA000-memory.dmpFilesize
16.7MB
-
memory/2144-94-0x0000000001930000-0x0000000001932000-memory.dmpFilesize
8KB
-
memory/2144-5-0x0000000000710000-0x00000000017CA000-memory.dmpFilesize
16.7MB
-
memory/2144-8-0x0000000000710000-0x00000000017CA000-memory.dmpFilesize
16.7MB
-
memory/2144-12-0x0000000000710000-0x00000000017CA000-memory.dmpFilesize
16.7MB
-
memory/2144-17-0x0000000001930000-0x0000000001932000-memory.dmpFilesize
8KB
-
memory/2144-15-0x0000000000710000-0x00000000017CA000-memory.dmpFilesize
16.7MB
-
memory/2144-19-0x0000000003680000-0x0000000003681000-memory.dmpFilesize
4KB
-
memory/2144-0-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2144-21-0x0000000003680000-0x0000000003681000-memory.dmpFilesize
4KB
-
memory/2144-22-0x0000000000710000-0x00000000017CA000-memory.dmpFilesize
16.7MB
-
memory/2144-26-0x0000000001930000-0x0000000001932000-memory.dmpFilesize
8KB
-
memory/2144-23-0x0000000000710000-0x00000000017CA000-memory.dmpFilesize
16.7MB
-
memory/2144-27-0x0000000000710000-0x00000000017CA000-memory.dmpFilesize
16.7MB
-
memory/2144-32-0x0000000000710000-0x00000000017CA000-memory.dmpFilesize
16.7MB
-
memory/2144-33-0x0000000000710000-0x00000000017CA000-memory.dmpFilesize
16.7MB
-
memory/2144-34-0x0000000000710000-0x00000000017CA000-memory.dmpFilesize
16.7MB
-
memory/2144-35-0x0000000000710000-0x00000000017CA000-memory.dmpFilesize
16.7MB
-
memory/2144-18-0x0000000000710000-0x00000000017CA000-memory.dmpFilesize
16.7MB
-
memory/2144-4-0x0000000000710000-0x00000000017CA000-memory.dmpFilesize
16.7MB
-
memory/2144-55-0x0000000000710000-0x00000000017CA000-memory.dmpFilesize
16.7MB
-
memory/2144-40-0x0000000000710000-0x00000000017CA000-memory.dmpFilesize
16.7MB
-
memory/2144-42-0x0000000000710000-0x00000000017CA000-memory.dmpFilesize
16.7MB
-
memory/2144-49-0x0000000000710000-0x00000000017CA000-memory.dmpFilesize
16.7MB
-
memory/2144-52-0x0000000000710000-0x00000000017CA000-memory.dmpFilesize
16.7MB
-
memory/2144-39-0x0000000000710000-0x00000000017CA000-memory.dmpFilesize
16.7MB
-
memory/2144-57-0x0000000000710000-0x00000000017CA000-memory.dmpFilesize
16.7MB
-
memory/2144-60-0x0000000000710000-0x00000000017CA000-memory.dmpFilesize
16.7MB
-
memory/2144-61-0x0000000000710000-0x00000000017CA000-memory.dmpFilesize
16.7MB
-
memory/2144-63-0x0000000000710000-0x00000000017CA000-memory.dmpFilesize
16.7MB
-
memory/2144-65-0x0000000000710000-0x00000000017CA000-memory.dmpFilesize
16.7MB
-
memory/2144-71-0x0000000000710000-0x00000000017CA000-memory.dmpFilesize
16.7MB
-
memory/2144-72-0x0000000000710000-0x00000000017CA000-memory.dmpFilesize
16.7MB
-
memory/2144-79-0x0000000000710000-0x00000000017CA000-memory.dmpFilesize
16.7MB
-
memory/2144-81-0x0000000000710000-0x00000000017CA000-memory.dmpFilesize
16.7MB
-
memory/2144-87-0x0000000000710000-0x00000000017CA000-memory.dmpFilesize
16.7MB
-
memory/2144-38-0x0000000000710000-0x00000000017CA000-memory.dmpFilesize
16.7MB
-
memory/2144-2-0x0000000000710000-0x00000000017CA000-memory.dmpFilesize
16.7MB