Analysis
-
max time kernel
75s -
max time network
77s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
14-05-2024 17:25
Static task
static1
Behavioral task
behavioral1
Sample
683a09da219918258c58a7f61f7dc4161a3a7a377cf82a31b840baabfb9a4a96.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
683a09da219918258c58a7f61f7dc4161a3a7a377cf82a31b840baabfb9a4a96.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
unpacked.exe
Resource
win7-20240215-en
Behavioral task
behavioral4
Sample
unpacked.exe
Resource
win10v2004-20240508-en
Errors
General
-
Target
unpacked.exe
-
Size
72KB
-
MD5
108756f41d114eb93e136ba2feb838d0
-
SHA1
8c6b51923ee7da2f4642c7717db95fbb77d96164
-
SHA256
b38b4c1dcf6d6ecd1bbfc236b43c37c18044c2f42f11e5088384f4bd0751929c
-
SHA512
d13183e8ba4689475b0cb3f5cc7acbfba34a1ba661eb5988984647c2bd3e561cfa03f6267f60ae9fb2ca0783f26c105cdbcfc89def598c48968febef23c21aaa
-
SSDEEP
768:F9NJK3qZRhxXHIQBsLL16BKc+bBQZ/UMc2:rXzXol6cc+lQZMMc2
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Temp\!satana!.txt
Signatures
-
Satana
Ransomware family which also encrypts the system's Master Boot Record (MBR).
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Deletes itself 1 IoCs
Processes:
qob.exepid process 2592 qob.exe -
Executes dropped EXE 1 IoCs
Processes:
qob.exepid process 2592 qob.exe -
Loads dropped DLL 5 IoCs
Processes:
unpacked.exeqob.exepid process 2972 unpacked.exe 2972 unpacked.exe 2972 unpacked.exe 2972 unpacked.exe 2592 qob.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
unpacked.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\zzgk = "C:\\Users\\Admin\\AppData\\Local\\Temp\\!satana!.txt" unpacked.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
qob.exedescription ioc process File opened for modification \??\PHYSICALDRIVE0 qob.exe -
Drops file in Program Files directory 64 IoCs
Processes:
qob.exedescription ioc process File opened for modification C:\Program Files\7-Zip\Lang\id.txt qob.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Grid.xml qob.exe File created C:\Program Files (x86)\Windows Media Player\Network Sharing\!satana!.txt qob.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-keyring-impl.xml qob.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-util.xml qob.exe File created C:\Program Files (x86)\Common Files\Services\!satana!.txt qob.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\css\!satana!.txt qob.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\Welcome Tool\!satana!.txt qob.exe File created C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\!satana!.txt qob.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\15x15dot.png qob.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-coredump.xml qob.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-sa.xml qob.exe File opened for modification C:\Program Files\Windows NT\TableTextService\TableTextServiceArray.txt qob.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_OffMask.bmp qob.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\divider-vertical.png qob.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsrus.xml qob.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\!satana!.txt qob.exe File opened for modification C:\Program Files\Java\jre7\lib\images\cursors\invalid32x32.gif qob.exe File created C:\Program Files\VideoLAN\VLC\locale\ka\!satana!.txt qob.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\js\!satana!.txt qob.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\drag.png qob.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\!satana!.txt qob.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\!satana!.txt qob.exe File created C:\Program Files (x86)\Common Files\microsoft shared\ink\!satana!.txt qob.exe File created C:\Program Files (x86)\Common Files\System\ado\it-IT\!satana!.txt qob.exe File opened for modification C:\Program Files\Windows Media Player\Network Sharing\wmpnss_bw48.jpg qob.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\SketchIconImages.bmp qob.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\InfoPathOM\Microsoft.Office.InfoPath.xml qob.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_foggy.png qob.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationUp_ButtonGraphic.png qob.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\etc\!satana!.txt qob.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-sampler.xml qob.exe File opened for modification C:\Program Files\Windows Media Player\Media Renderer\avtransport.xml qob.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\info.png qob.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_FileHigh.jpg qob.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SpringGreen\!satana!.txt qob.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsViewAttachmentIconsMask.bmp qob.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\ParentMenuButtonIcon.png qob.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_gray_few-showers.png qob.exe File created C:\Program Files (x86)\Adobe\!satana!.txt qob.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOffNotificationInAcrobat.gif qob.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\720x480icongraphic.png qob.exe File created C:\Program Files\VideoLAN\VLC\locale\cgg\LC_MESSAGES\!satana!.txt qob.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Triedit\es-ES\!satana!.txt qob.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\!satana!.txt qob.exe File created C:\Program Files\Windows Journal\en-US\!satana!.txt qob.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\rss_headline_glow_floating.png qob.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\!satana!.txt qob.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\7.png qob.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\!satana!.txt qob.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\!satana!.txt qob.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-host.xml qob.exe File created C:\Program Files\VideoLAN\VLC\locale\es\LC_MESSAGES\!satana!.txt qob.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-keyring-fallback.xml qob.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Bears.jpg qob.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_gray_foggy.png qob.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\!satana!.txt qob.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\gadget.xml qob.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\rtf_pressed.gif qob.exe File created C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Documentation\1033\!satana!.txt qob.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\144DPI\(144DPI)grayStateIcon.png qob.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\3.png qob.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SPRING\!satana!.txt qob.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\OutofSyncIconImagesMask.bmp qob.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
VSSADMIN.EXEpid process 2944 VSSADMIN.EXE -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
qob.exevssvc.exedescription pid process Token: SeIncBasePriorityPrivilege 2592 qob.exe Token: SeBackupPrivilege 1856 vssvc.exe Token: SeRestorePrivilege 1856 vssvc.exe Token: SeAuditPrivilege 1856 vssvc.exe Token: SeShutdownPrivilege 2592 qob.exe -
Suspicious use of WriteProcessMemory 39 IoCs
Processes:
unpacked.exeqob.exedescription pid process target process PID 2972 wrote to memory of 2592 2972 unpacked.exe qob.exe PID 2972 wrote to memory of 2592 2972 unpacked.exe qob.exe PID 2972 wrote to memory of 2592 2972 unpacked.exe qob.exe PID 2972 wrote to memory of 2592 2972 unpacked.exe qob.exe PID 2592 wrote to memory of 2944 2592 qob.exe VSSADMIN.EXE PID 2592 wrote to memory of 2944 2592 qob.exe VSSADMIN.EXE PID 2592 wrote to memory of 2944 2592 qob.exe VSSADMIN.EXE PID 2592 wrote to memory of 2944 2592 qob.exe VSSADMIN.EXE PID 2592 wrote to memory of 12164 2592 qob.exe NOTEPAD.EXE PID 2592 wrote to memory of 12164 2592 qob.exe NOTEPAD.EXE PID 2592 wrote to memory of 12164 2592 qob.exe NOTEPAD.EXE PID 2592 wrote to memory of 12164 2592 qob.exe NOTEPAD.EXE PID 2592 wrote to memory of 12140 2592 qob.exe rundll32.exe PID 2592 wrote to memory of 12140 2592 qob.exe rundll32.exe PID 2592 wrote to memory of 12140 2592 qob.exe rundll32.exe PID 2592 wrote to memory of 12140 2592 qob.exe rundll32.exe PID 2592 wrote to memory of 12140 2592 qob.exe rundll32.exe PID 2592 wrote to memory of 12140 2592 qob.exe rundll32.exe PID 2592 wrote to memory of 12140 2592 qob.exe rundll32.exe PID 2592 wrote to memory of 12140 2592 qob.exe rundll32.exe PID 2592 wrote to memory of 12140 2592 qob.exe rundll32.exe PID 2592 wrote to memory of 12136 2592 qob.exe rundll32.exe PID 2592 wrote to memory of 12136 2592 qob.exe rundll32.exe PID 2592 wrote to memory of 12136 2592 qob.exe rundll32.exe PID 2592 wrote to memory of 12136 2592 qob.exe rundll32.exe PID 2592 wrote to memory of 12136 2592 qob.exe rundll32.exe PID 2592 wrote to memory of 12136 2592 qob.exe rundll32.exe PID 2592 wrote to memory of 12136 2592 qob.exe rundll32.exe PID 2592 wrote to memory of 12136 2592 qob.exe rundll32.exe PID 2592 wrote to memory of 12136 2592 qob.exe rundll32.exe PID 2592 wrote to memory of 11516 2592 qob.exe rundll32.exe PID 2592 wrote to memory of 11516 2592 qob.exe rundll32.exe PID 2592 wrote to memory of 11516 2592 qob.exe rundll32.exe PID 2592 wrote to memory of 11516 2592 qob.exe rundll32.exe PID 2592 wrote to memory of 11516 2592 qob.exe rundll32.exe PID 2592 wrote to memory of 11516 2592 qob.exe rundll32.exe PID 2592 wrote to memory of 11516 2592 qob.exe rundll32.exe PID 2592 wrote to memory of 11516 2592 qob.exe rundll32.exe PID 2592 wrote to memory of 11516 2592 qob.exe rundll32.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\unpacked.exe"C:\Users\Admin\AppData\Local\Temp\unpacked.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\qob.exe"C:\Users\Admin\AppData\Local\Temp\qob.exe" {846ee340-7039-11de-9d20-806e6f6e6963} "C:\Users\Admin\AppData\Local\Temp\unpacked.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Windows\SysWOW64\VSSADMIN.EXE"C:\Windows\system32\VSSADMIN.EXE" Delete Shadows /All /Quiet3⤵
- Interacts with shadow copies
PID:2944
-
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\!satana!.txt3⤵PID:12164
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe3⤵PID:12140
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe3⤵PID:12136
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe3⤵PID:11516
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1856
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x01⤵PID:12120
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x11⤵PID:1852
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5f9942fdbe5127bd56c2c495c7c512684
SHA1bd5df0980e14621d80c8046d3007d262c039b737
SHA2565617a7c5fd9890818816a12d43fbe407304580aa86e1337ce5055e737354a10e
SHA5126f36590e4741b64b29b3831b4ca663a850966f2643eae0564efad359a0e499605ea28d78e1b425413190b2173799cc98551c270067bdb00bdcc32dfb8109a0fd
-
Filesize
72KB
MD5108756f41d114eb93e136ba2feb838d0
SHA18c6b51923ee7da2f4642c7717db95fbb77d96164
SHA256b38b4c1dcf6d6ecd1bbfc236b43c37c18044c2f42f11e5088384f4bd0751929c
SHA512d13183e8ba4689475b0cb3f5cc7acbfba34a1ba661eb5988984647c2bd3e561cfa03f6267f60ae9fb2ca0783f26c105cdbcfc89def598c48968febef23c21aaa