Analysis
-
max time kernel
149s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
-
submitted
24-04-2024 18:18
General
-
Target
3e7ee9c99602d6f90e3c1c6f1a0acea9f290a8136e48d248f876068205acf576.exe
-
Size
13.0MB
-
MD5
7585656657f21ef1c021484cff6d6374
-
SHA1
63ab72343c96200b5ef5702ce19ea5d0132ff3aa
-
SHA256
3e7ee9c99602d6f90e3c1c6f1a0acea9f290a8136e48d248f876068205acf576
-
SHA512
c8ace3a3feed8daab6b3e91edc5e32c62c916f558fc73af46dcec266511610ee0e97a4bc85c81130cfb1eba0a00e008ff20dcc9b48370356ae7f7498ee0b256b
-
SSDEEP
196608:DAbLaVc6ImddJpGKxDOwJXf3z8IxfYBcbT+ag1z0ppOj6qoukxo/HXGYlF0E6K1Z:kzOnpXvHfRmaozyOeqouk+/2TY1rV
Score
10/10
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Modifies firewall policy service 2 TTPs 3 IoCs
-
Sality
Sality is backdoor written in C++, first discovered in 2003.
-
UAC bypass 3 TTPs 1 IoCs
-
Windows security bypass 2 TTPs 6 IoCs
-
UPX packed file 16 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Windows security modification 2 TTPs 7 IoCs
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in Windows directory 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
System policy modification 1 TTPs 1 IoCs
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\3e7ee9c99602d6f90e3c1c6f1a0acea9f290a8136e48d248f876068205acf576.exe"C:\Users\Admin\AppData\Local\Temp\3e7ee9c99602d6f90e3c1c6f1a0acea9f290a8136e48d248f876068205acf576.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppX53ypgrj20bgndg05hj3tc7z654myszwp.mca1⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3892-0-0x0000000003C60000-0x0000000004CEE000-memory.dmpFilesize
16.6MB
-
memory/3892-3-0x0000000000400000-0x0000000001DA0000-memory.dmpFilesize
25.6MB
-
memory/3892-2-0x0000000003C60000-0x0000000004CEE000-memory.dmpFilesize
16.6MB
-
memory/3892-4-0x0000000003C60000-0x0000000004CEE000-memory.dmpFilesize
16.6MB
-
memory/3892-5-0x0000000003C40000-0x0000000003C42000-memory.dmpFilesize
8KB
-
memory/3892-6-0x0000000005530000-0x0000000005531000-memory.dmpFilesize
4KB
-
memory/3892-9-0x0000000003C40000-0x0000000003C42000-memory.dmpFilesize
8KB
-
memory/3892-7-0x0000000003C60000-0x0000000004CEE000-memory.dmpFilesize
16.6MB
-
memory/3892-10-0x0000000003C60000-0x0000000004CEE000-memory.dmpFilesize
16.6MB
-
memory/3892-11-0x0000000003C60000-0x0000000004CEE000-memory.dmpFilesize
16.6MB
-
memory/3892-12-0x0000000003C60000-0x0000000004CEE000-memory.dmpFilesize
16.6MB
-
memory/3892-13-0x0000000003C60000-0x0000000004CEE000-memory.dmpFilesize
16.6MB
-
memory/3892-14-0x0000000003C60000-0x0000000004CEE000-memory.dmpFilesize
16.6MB
-
memory/3892-15-0x0000000003C60000-0x0000000004CEE000-memory.dmpFilesize
16.6MB
-
memory/3892-16-0x0000000003C60000-0x0000000004CEE000-memory.dmpFilesize
16.6MB
-
memory/3892-17-0x0000000003C60000-0x0000000004CEE000-memory.dmpFilesize
16.6MB
-
memory/3892-18-0x0000000003C60000-0x0000000004CEE000-memory.dmpFilesize
16.6MB
-
memory/3892-19-0x0000000003C60000-0x0000000004CEE000-memory.dmpFilesize
16.6MB
-
memory/3892-21-0x0000000003C60000-0x0000000004CEE000-memory.dmpFilesize
16.6MB
-
memory/3892-33-0x0000000003C40000-0x0000000003C42000-memory.dmpFilesize
8KB
-
memory/3892-23-0x0000000003C60000-0x0000000004CEE000-memory.dmpFilesize
16.6MB
-
memory/3892-38-0x0000000000400000-0x0000000001DA0000-memory.dmpFilesize
25.6MB