dd4b7d499dc7eb0fd5cb649edcafa5fbb83b103a04d6580b237a67e8a1c13d59

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
16-05-2024 23:47

Target

sarac.exe
Size

1.1MB
MD5

2bfa45cef3433a89ac23744e218e4928
SHA1

dc030193e3232e72f24c32d7a19bab67aeae13ce
SHA256

eb467223a5b2f2bb51fa68d4ec6a4c95a605edefe6b96b82850e78ba459c21d0
SHA512

1decb81a1ab3555c08b45ab4347c3f63b46fd6ad495b6e0bd55230b30ae3a7acd0316b255e715d3ab9b796fea504d05f624eecc9d4ccd3e0ef468dc3c9f5ad44
SSDEEP

24576:GM8qzs4Zn2GK0C5abCi77sX/CnS7HjQpzEhoFcko9Rf:W0uGnkabL74X/gyDQpzMoqkoDf

Score

7^/10

persistence

Allows Network login with blank passwords 1 TTPs 4 IoCs

Allows local user accounts with blank passwords to access device from the network.

Remote Desktop Protocol

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\LimitBlankPasswordUse = "0"	sarac.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet002\Control\Lsa\LimitBlankPasswordUse = "0"	sarac.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\LimitBlankPasswordUse = "1"	sarac.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet002\Control\Lsa\LimitBlankPasswordUse = "1"	sarac.exe

Deletes itself 1 IoCs

pid	Process
852	cmd.exe

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Facebook Update Start = "\"C:\\Program Files (x86)\\Facebook Update Start\\facesecup.exe\""	sarac.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Facebook Update Start\facesecup.exe	sarac.exe
File created	C:\Program Files (x86)\Facebook Update Start\ECount.exe	sarac.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
2772	timeout.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
2508	taskkill.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2312	sarac.exe
2312	sarac.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2508	taskkill.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2312 wrote to memory of 852	2312	sarac.exe	28
PID 2312 wrote to memory of 852	2312	sarac.exe	28
PID 2312 wrote to memory of 852	2312	sarac.exe	28
PID 2312 wrote to memory of 852	2312	sarac.exe	28
PID 852 wrote to memory of 2508	852	cmd.exe	30
PID 852 wrote to memory of 2508	852	cmd.exe	30
PID 852 wrote to memory of 2508	852	cmd.exe	30
PID 852 wrote to memory of 2508	852	cmd.exe	30
PID 852 wrote to memory of 2772	852	cmd.exe	32
PID 852 wrote to memory of 2772	852	cmd.exe	32
PID 852 wrote to memory of 2772	852	cmd.exe	32
PID 852 wrote to memory of 2772	852	cmd.exe	32