Analysis
-
max time kernel
123s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
-
submitted
23-04-2024 02:18
General
-
Target
7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe
-
Size
2.0MB
-
MD5
f41ad1e9b99154dc5cc1b562c2166ca2
-
SHA1
3de885cc21dfa13fea14cb9d73bab6b09fb2b889
-
SHA256
7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b
-
SHA512
49d5ac77e9186b72067c28d6974d0aa1b82b20dc78913296876e04e0e8ced17336600b8b3bd8192053d940202af9feb732b4a38e3006ccafa6fb4856d7147960
-
SSDEEP
49152:47sM3dbEnmZgJH6iADNsNn/3JQErFu/fEHHhF/poL9WpTo5pp9P:hOdbEnMgJaB5mn/3JQf/snXpi9WpToZt
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Modifies firewall policy service 2 TTPs 3 IoCs
-
Sality
Sality is backdoor written in C++, first discovered in 2003.
-
UAC bypass 3 TTPs 1 IoCs
-
Windows security bypass 2 TTPs 6 IoCs
-
Executes dropped EXE 2 IoCs
-
UPX packed file 36 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Windows security modification 2 TTPs 7 IoCs
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Enumerates connected drives 3 TTPs 42 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 5 IoCs
-
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 44 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
System policy modification 1 TTPs 1 IoCs
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe"C:\Users\Admin\AppData\Local\Temp\7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe"2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a33B2.bat3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
C:\Users\Admin\AppData\Local\Temp\7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe"C:\Users\Admin\AppData\Local\Temp\7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe"4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppX53ypgrj20bgndg05hj3tc7z654myszwp.mca1⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exeFilesize
251KB
MD5977cf1f77316a3972f08a77ce53c3b91
SHA19f041b81a9344226baf41ced0284ec3120ccca45
SHA256291ec6a369034c1b0b53b24a6bcc7521e3aafa10dd286bf7a003a6b3c66c8511
SHA512816477692fdaebc07ce50e71bca986e2d2a2abdfa9edbfaae1dff5d7cb19256bc7408ab7bc6040f684d37ebe1b73397d118045b7f3d0d8e561b89a3b95d5b383
-
C:\Program Files\7-Zip\7z.exeFilesize
570KB
MD530733913ee76b30e772f6495cac46d42
SHA1bf4115aa2519d7f1e2e76c573352ef1588974ea2
SHA256c9da3a226a1e3f90b384c9e85d319a67ebe6278c3d96dde317f33dd267328cce
SHA5122f9b074efe9dac0d43070a7bd340da01834c3242a67c6cfdf8a59016570e8c45edbc4c2c394c2a0ccb1053f456c8a7e37d055cb4eb23de73ac11a565ba2983c2
-
C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exeFilesize
636KB
MD52500f702e2b9632127c14e4eaae5d424
SHA18726fef12958265214eeb58001c995629834b13a
SHA25682e5b0001f025ca3b8409c98e4fb06c119c68de1e4ef60a156360cb4ef61d19c
SHA512f420c62fa1f6897f51dd7a0f0e910fb54ad14d51973a2d4840eeea0448c860bf83493fb1c07be65f731efc39e19f8a99886c8cfd058cee482fe52d255a33a55c
-
C:\Users\Admin\AppData\Local\Temp\$$a33B2.batFilesize
722B
MD5531352b679b262932a52a5f239534418
SHA1c1dbe40fd1cab4378dd0f3183254823b5afb77b1
SHA256859ab9c349b973b5b4bb90678ca6aa4400a8766d20b5681620f64e4d1d4543dd
SHA512aedaef6c9374a7457e938c8195292f43a1b771db2542b0cca4078a253f0eecc4f0a586c5652beb1f883424958db3088bcbe5a72d5a2024809744594e645e7801
-
C:\Users\Admin\AppData\Local\Temp\7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe.exeFilesize
1.9MB
MD50249e536946ecdee7fc96462981f9051
SHA1f8d57ca34b945114ab12e9d6ab72f798ed9fe101
SHA2563953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2
SHA5121893ea7fb7e60a507962ed7efb620478f734f230f1b1f8a6a8541f79dec575dff852b74363048661b9a7de3106593d190846e7edd42da9ba31125fc249497f5d
-
C:\Windows\Logo1_.exeFilesize
26KB
MD5d64fff83fde04bb05f120dc27af13d2b
SHA16637e6000271fa24db8c67a554475eba56911db9
SHA256edb19ce6117ad3b8bcfc38f2076c82e3c5e69a927a5108d442de991bce2d9d84
SHA5125b82e2895823afa819b452cd185bbc8f57b9dbf9e138fcedeeeb7da7871db38e59da651c8def70b157d36f90af8d956283373f8590bbdaaf703ea89b80230d3e
-
F:\$RECYCLE.BIN\S-1-5-21-1132431369-515282257-1998160155-1000\_desktop.iniFilesize
9B
MD55e45e0c42537212b4bfef35112ec91ba
SHA110c59c091fd35facc82bbc96938f118ce5a60546
SHA2569f6b7a83161db36757e96dc40936aec1e5a9a41f9fca089f9cf5a4d695dd5ed5
SHA512ee964e08687daa53fdc8e063402791acb104bd59f5d0f8a6d11d3e889db476315641c38032ade4177cd794b060f9fc4e6fd161989e452aae828c875c747e4bfb
-
F:\ngogcb.pifFilesize
96KB
MD5ec20c9b794072e56d12902d1049f1d99
SHA18277ff58c4c382eea5226feb3161dbe8f32ad3b1
SHA2562ba910ff3f33ffaca53ce9cef0b3ed8a77055a705020a9de4de986c04f22ca0e
SHA5129bc994ed7fc5eeefa5b9e9e9f4665fd2d1c9cfe0487cc19e10243f28c99024f69475610d282926d3085808d02067b6a520f7440a3bf05a4a1d514c4e601931d7
-
memory/316-8-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/316-0-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/940-30-0x00000000009B0000-0x00000000009B1000-memory.dmpFilesize
4KB
-
memory/940-39-0x00000000008F0000-0x00000000008F2000-memory.dmpFilesize
8KB
-
memory/940-37-0x00000000008F0000-0x00000000008F2000-memory.dmpFilesize
8KB
-
memory/940-29-0x00000000008F0000-0x00000000008F2000-memory.dmpFilesize
8KB
-
memory/1520-46-0x0000000002600000-0x000000000368E000-memory.dmpFilesize
16.6MB
-
memory/1520-53-0x0000000002600000-0x000000000368E000-memory.dmpFilesize
16.6MB
-
memory/1520-18-0x0000000000400000-0x00000000006E5000-memory.dmpFilesize
2.9MB
-
memory/1520-27-0x0000000002600000-0x000000000368E000-memory.dmpFilesize
16.6MB
-
memory/1520-26-0x0000000002600000-0x000000000368E000-memory.dmpFilesize
16.6MB
-
memory/1520-19-0x0000000002600000-0x000000000368E000-memory.dmpFilesize
16.6MB
-
memory/1520-25-0x0000000002600000-0x000000000368E000-memory.dmpFilesize
16.6MB
-
memory/1520-38-0x0000000003D70000-0x0000000003D72000-memory.dmpFilesize
8KB
-
memory/1520-36-0x0000000003E90000-0x0000000003E91000-memory.dmpFilesize
4KB
-
memory/1520-21-0x0000000002600000-0x000000000368E000-memory.dmpFilesize
16.6MB
-
memory/1520-40-0x0000000003D70000-0x0000000003D72000-memory.dmpFilesize
8KB
-
memory/1520-24-0x0000000002600000-0x000000000368E000-memory.dmpFilesize
16.6MB
-
memory/1520-41-0x0000000002600000-0x000000000368E000-memory.dmpFilesize
16.6MB
-
memory/1520-42-0x0000000002600000-0x000000000368E000-memory.dmpFilesize
16.6MB
-
memory/1520-44-0x0000000002600000-0x000000000368E000-memory.dmpFilesize
16.6MB
-
memory/1520-45-0x0000000002600000-0x000000000368E000-memory.dmpFilesize
16.6MB
-
memory/1520-23-0x0000000002600000-0x000000000368E000-memory.dmpFilesize
16.6MB
-
memory/1520-48-0x0000000002600000-0x000000000368E000-memory.dmpFilesize
16.6MB
-
memory/1520-49-0x0000000002600000-0x000000000368E000-memory.dmpFilesize
16.6MB
-
memory/1520-50-0x0000000002600000-0x000000000368E000-memory.dmpFilesize
16.6MB
-
memory/1520-52-0x0000000002600000-0x000000000368E000-memory.dmpFilesize
16.6MB
-
memory/1520-55-0x0000000000400000-0x00000000006E5000-memory.dmpFilesize
2.9MB
-
memory/1520-99-0x0000000002600000-0x000000000368E000-memory.dmpFilesize
16.6MB
-
memory/1520-28-0x0000000002600000-0x000000000368E000-memory.dmpFilesize
16.6MB
-
memory/1520-57-0x0000000002600000-0x000000000368E000-memory.dmpFilesize
16.6MB
-
memory/1520-59-0x0000000002600000-0x000000000368E000-memory.dmpFilesize
16.6MB
-
memory/1520-62-0x0000000002600000-0x000000000368E000-memory.dmpFilesize
16.6MB
-
memory/1520-64-0x0000000002600000-0x000000000368E000-memory.dmpFilesize
16.6MB
-
memory/1520-66-0x0000000002600000-0x000000000368E000-memory.dmpFilesize
16.6MB
-
memory/1520-68-0x0000000002600000-0x000000000368E000-memory.dmpFilesize
16.6MB
-
memory/1520-75-0x0000000002600000-0x000000000368E000-memory.dmpFilesize
16.6MB
-
memory/1520-77-0x0000000002600000-0x000000000368E000-memory.dmpFilesize
16.6MB
-
memory/1520-22-0x0000000002600000-0x000000000368E000-memory.dmpFilesize
16.6MB
-
memory/1520-98-0x0000000003D70000-0x0000000003D72000-memory.dmpFilesize
8KB
-
memory/1520-87-0x0000000002600000-0x000000000368E000-memory.dmpFilesize
16.6MB
-
memory/1520-89-0x0000000002600000-0x000000000368E000-memory.dmpFilesize
16.6MB
-
memory/1520-91-0x0000000002600000-0x000000000368E000-memory.dmpFilesize
16.6MB
-
memory/1520-96-0x0000000002600000-0x000000000368E000-memory.dmpFilesize
16.6MB
-
memory/1520-94-0x0000000002600000-0x000000000368E000-memory.dmpFilesize
16.6MB
-
memory/2780-92-0x0000000000550000-0x0000000000552000-memory.dmpFilesize
8KB
-
memory/2780-85-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/2780-54-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/2780-33-0x0000000000550000-0x0000000000552000-memory.dmpFilesize
8KB
-
memory/2780-34-0x0000000000560000-0x0000000000561000-memory.dmpFilesize
4KB
-
memory/2780-32-0x0000000000550000-0x0000000000552000-memory.dmpFilesize
8KB
-
memory/2780-10-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB