Analysis
-
max time kernel
97s -
max time network
103s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
22-05-2024 20:16
General
-
Target
32345db6f83b5e90e3c46762e43e0425eb0641e082be1a2e48cf4949a4c3bfcc.exe
-
Size
65KB
-
MD5
825ecdda71af3bf75ee5d1322b278462
-
SHA1
61599f8bb235ac0e78e592e4fc43006d36f49a3e
-
SHA256
32345db6f83b5e90e3c46762e43e0425eb0641e082be1a2e48cf4949a4c3bfcc
-
SHA512
dc0016868bed9bc22be73c95b1bde4cfd296de57e1b8096a7e265084010c844b785a2dfd59c59d8b4c330a07e5548084fd4fe657e2ae6152c5f1d4e3c9ff2697
-
SSDEEP
1536:BjoPqOMzvf/Q9HMrdFFhhuCorwuLd93/oPm1or:NUqOaf/Q9HUPs5Zcr
Score
10/10
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 2 TTPs 3 IoCs
-
Sality
Sality is backdoor written in C++, first discovered in 2003.
-
UAC bypass 3 TTPs 1 IoCs
-
Windows security bypass 2 TTPs 6 IoCs
-
Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 25 IoCs
-
UPX dump on OEP (original entry point) 26 IoCs
-
UPX packed file 25 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Windows security modification 2 TTPs 7 IoCs
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Enumerates connected drives 3 TTPs 8 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in Windows directory 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of WriteProcessMemory 36 IoCs
-
System policy modification 1 TTPs 1 IoCs
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\32345db6f83b5e90e3c46762e43e0425eb0641e082be1a2e48cf4949a4c3bfcc.exe"C:\Users\Admin\AppData\Local\Temp\32345db6f83b5e90e3c46762e43e0425eb0641e082be1a2e48cf4949a4c3bfcc.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Create or Modify System Process
1Windows Service
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Modify Registry
5Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4928-0-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/4928-1-0x00000000007F0000-0x00000000018AA000-memory.dmpFilesize
16.7MB
-
memory/4928-5-0x00000000007F0000-0x00000000018AA000-memory.dmpFilesize
16.7MB
-
memory/4928-6-0x00000000007F0000-0x00000000018AA000-memory.dmpFilesize
16.7MB
-
memory/4928-3-0x00000000007F0000-0x00000000018AA000-memory.dmpFilesize
16.7MB
-
memory/4928-16-0x0000000001AF0000-0x0000000001AF2000-memory.dmpFilesize
8KB
-
memory/4928-17-0x0000000001AF0000-0x0000000001AF2000-memory.dmpFilesize
8KB
-
memory/4928-4-0x00000000007F0000-0x00000000018AA000-memory.dmpFilesize
16.7MB
-
memory/4928-18-0x00000000007F0000-0x00000000018AA000-memory.dmpFilesize
16.7MB
-
memory/4928-13-0x00000000007F0000-0x00000000018AA000-memory.dmpFilesize
16.7MB
-
memory/4928-7-0x00000000007F0000-0x00000000018AA000-memory.dmpFilesize
16.7MB
-
memory/4928-15-0x0000000001B00000-0x0000000001B01000-memory.dmpFilesize
4KB
-
memory/4928-14-0x0000000001AF0000-0x0000000001AF2000-memory.dmpFilesize
8KB
-
memory/4928-19-0x00000000007F0000-0x00000000018AA000-memory.dmpFilesize
16.7MB
-
memory/4928-20-0x00000000007F0000-0x00000000018AA000-memory.dmpFilesize
16.7MB
-
memory/4928-21-0x00000000007F0000-0x00000000018AA000-memory.dmpFilesize
16.7MB
-
memory/4928-23-0x00000000007F0000-0x00000000018AA000-memory.dmpFilesize
16.7MB
-
memory/4928-22-0x00000000007F0000-0x00000000018AA000-memory.dmpFilesize
16.7MB
-
memory/4928-24-0x00000000007F0000-0x00000000018AA000-memory.dmpFilesize
16.7MB
-
memory/4928-25-0x00000000007F0000-0x00000000018AA000-memory.dmpFilesize
16.7MB
-
memory/4928-26-0x00000000007F0000-0x00000000018AA000-memory.dmpFilesize
16.7MB
-
memory/4928-28-0x00000000007F0000-0x00000000018AA000-memory.dmpFilesize
16.7MB
-
memory/4928-29-0x00000000007F0000-0x00000000018AA000-memory.dmpFilesize
16.7MB
-
memory/4928-30-0x00000000007F0000-0x00000000018AA000-memory.dmpFilesize
16.7MB
-
memory/4928-32-0x00000000007F0000-0x00000000018AA000-memory.dmpFilesize
16.7MB
-
memory/4928-33-0x00000000007F0000-0x00000000018AA000-memory.dmpFilesize
16.7MB
-
memory/4928-35-0x00000000007F0000-0x00000000018AA000-memory.dmpFilesize
16.7MB
-
memory/4928-36-0x00000000007F0000-0x00000000018AA000-memory.dmpFilesize
16.7MB
-
memory/4928-38-0x00000000007F0000-0x00000000018AA000-memory.dmpFilesize
16.7MB
-
memory/4928-52-0x0000000001AF0000-0x0000000001AF2000-memory.dmpFilesize
8KB
-
memory/4928-41-0x00000000007F0000-0x00000000018AA000-memory.dmpFilesize
16.7MB
-
memory/4928-60-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB