General
-
Target
55b33ad0a923455b500c7570e0782f7f6692c986075e0f5bd80e057dcdbd1c3d
-
Size
1.1MB
-
Sample
240331-xpm61saa32
-
MD5
34f50bdd2ec8d758d43530011b47e600
-
SHA1
0fd072c8947abe583d8c2f9e2299563cc83ebc2a
-
SHA256
55b33ad0a923455b500c7570e0782f7f6692c986075e0f5bd80e057dcdbd1c3d
-
SHA512
12b547152b95a6ac43d065d8b9f43f19c34d0e558ae5b04268c6cfc6fb7de181b57defc765ac30350681784cecbba22e4fd4dba15016e0ea541d89e14c95dd3c
-
SSDEEP
12288:EMg6coXAIJKLwLSXlWhRFdO/hdEo5uh9qwZpH7BKrFjjZ5/yhRob7QrMmnEH4DnE:EMg6coPJKLwLBbFdOm+6RowrMH
Static task
static1
Behavioral task
behavioral1
Sample
55b33ad0a923455b500c7570e0782f7f6692c986075e0f5bd80e057dcdbd1c3d.exe
Resource
win7-20240221-en
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Targets
-
-
Target
55b33ad0a923455b500c7570e0782f7f6692c986075e0f5bd80e057dcdbd1c3d
-
Size
1.1MB
-
MD5
34f50bdd2ec8d758d43530011b47e600
-
SHA1
0fd072c8947abe583d8c2f9e2299563cc83ebc2a
-
SHA256
55b33ad0a923455b500c7570e0782f7f6692c986075e0f5bd80e057dcdbd1c3d
-
SHA512
12b547152b95a6ac43d065d8b9f43f19c34d0e558ae5b04268c6cfc6fb7de181b57defc765ac30350681784cecbba22e4fd4dba15016e0ea541d89e14c95dd3c
-
SSDEEP
12288:EMg6coXAIJKLwLSXlWhRFdO/hdEo5uh9qwZpH7BKrFjjZ5/yhRob7QrMmnEH4DnE:EMg6coPJKLwLBbFdOm+6RowrMH
-
Modifies firewall policy service
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Create or Modify System Process
1Windows Service
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Modify Registry
5Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3