Analysis
-
max time kernel
123s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
22-05-2024 21:20
General
-
Target
4a4d3eb67da40094714346116f3e9176b3ff44a1f1e01a479b44376852f31301.exe
-
Size
100KB
-
MD5
f06b90e8439d3b3b94467e080b9970e0
-
SHA1
67c03284e74196aeffe5b11713c54d0f3bf0a3f9
-
SHA256
4a4d3eb67da40094714346116f3e9176b3ff44a1f1e01a479b44376852f31301
-
SHA512
d471503e3f22efa4cb4dadb9c687ed93672b7a6d05d82d2d636178b2b7ab4400d92f7d1c00185007c600b2f0e74f9933daa17aecbe1314dc5e2bb0c50b7251ad
-
SSDEEP
1536:RapRq3H+u/4VxtpYS2zwyydjUoKpe/weACIg:RaXq+s4VBYRzIjUpedtn
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Modifies firewall policy service 2 TTPs 3 IoCs
-
Sality
Sality is backdoor written in C++, first discovered in 2003.
-
UAC bypass 3 TTPs 1 IoCs
-
Windows security bypass 2 TTPs 6 IoCs
-
Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 29 IoCs
-
UPX dump on OEP (original entry point) 27 IoCs
-
UPX packed file 27 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Windows security modification 2 TTPs 7 IoCs
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in Program Files directory 5 IoCs
-
Drops file in Windows directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 31 IoCs
-
Suspicious use of WriteProcessMemory 37 IoCs
-
System policy modification 1 TTPs 1 IoCs
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\4a4d3eb67da40094714346116f3e9176b3ff44a1f1e01a479b44376852f31301.exe"C:\Users\Admin\AppData\Local\Temp\4a4d3eb67da40094714346116f3e9176b3ff44a1f1e01a479b44376852f31301.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\pyldre.pifFilesize
100KB
MD5f5edb066fe923eef0a9b412e94236359
SHA1686b1a2eb87088620b09cd91fa8b352baf658e7c
SHA2560200ae7be53c081e3cbbd8c017e24e4fe272c08d0ca7333e0fc74395b20c3f98
SHA512c8ee25709e1105f0bd1e88552589c8a96e7114ec39c3b2cda60ca35e08cf5656ab27a165907181b05a855bfb4991cbb4cc23f46fb0fee2c36eb44f272a9491ae
-
memory/1108-11-0x0000000000220000-0x0000000000222000-memory.dmpFilesize
8KB
-
memory/1508-29-0x0000000001DC0000-0x0000000002E4E000-memory.dmpFilesize
16.6MB
-
memory/1508-103-0x0000000004750000-0x0000000004752000-memory.dmpFilesize
8KB
-
memory/1508-3-0x0000000001DC0000-0x0000000002E4E000-memory.dmpFilesize
16.6MB
-
memory/1508-1-0x0000000001DC0000-0x0000000002E4E000-memory.dmpFilesize
16.6MB
-
memory/1508-10-0x0000000001DC0000-0x0000000002E4E000-memory.dmpFilesize
16.6MB
-
memory/1508-8-0x0000000001DC0000-0x0000000002E4E000-memory.dmpFilesize
16.6MB
-
memory/1508-23-0x0000000000560000-0x0000000000561000-memory.dmpFilesize
4KB
-
memory/1508-6-0x0000000001DC0000-0x0000000002E4E000-memory.dmpFilesize
16.6MB
-
memory/1508-0-0x0000000000400000-0x0000000000415000-memory.dmpFilesize
84KB
-
memory/1508-19-0x00000000003F0000-0x00000000003F2000-memory.dmpFilesize
8KB
-
memory/1508-4-0x0000000001DC0000-0x0000000002E4E000-memory.dmpFilesize
16.6MB
-
memory/1508-9-0x0000000001DC0000-0x0000000002E4E000-memory.dmpFilesize
16.6MB
-
memory/1508-25-0x00000000003F0000-0x00000000003F2000-memory.dmpFilesize
8KB
-
memory/1508-24-0x00000000003F0000-0x00000000003F2000-memory.dmpFilesize
8KB
-
memory/1508-26-0x0000000001DC0000-0x0000000002E4E000-memory.dmpFilesize
16.6MB
-
memory/1508-27-0x0000000001DC0000-0x0000000002E4E000-memory.dmpFilesize
16.6MB
-
memory/1508-28-0x0000000001DC0000-0x0000000002E4E000-memory.dmpFilesize
16.6MB
-
memory/1508-30-0x0000000001DC0000-0x0000000002E4E000-memory.dmpFilesize
16.6MB
-
memory/1508-20-0x0000000000560000-0x0000000000561000-memory.dmpFilesize
4KB
-
memory/1508-5-0x0000000001DC0000-0x0000000002E4E000-memory.dmpFilesize
16.6MB
-
memory/1508-49-0x0000000001DC0000-0x0000000002E4E000-memory.dmpFilesize
16.6MB
-
memory/1508-45-0x00000000049C0000-0x00000000049C1000-memory.dmpFilesize
4KB
-
memory/1508-44-0x0000000004750000-0x0000000004752000-memory.dmpFilesize
8KB
-
memory/1508-46-0x0000000004750000-0x0000000004752000-memory.dmpFilesize
8KB
-
memory/1508-47-0x0000000001DC0000-0x0000000002E4E000-memory.dmpFilesize
16.6MB
-
memory/1508-33-0x0000000001DC0000-0x0000000002E4E000-memory.dmpFilesize
16.6MB
-
memory/1508-51-0x0000000001DC0000-0x0000000002E4E000-memory.dmpFilesize
16.6MB
-
memory/1508-53-0x0000000001DC0000-0x0000000002E4E000-memory.dmpFilesize
16.6MB
-
memory/1508-54-0x0000000001DC0000-0x0000000002E4E000-memory.dmpFilesize
16.6MB
-
memory/1508-57-0x0000000001DC0000-0x0000000002E4E000-memory.dmpFilesize
16.6MB
-
memory/1508-58-0x0000000001DC0000-0x0000000002E4E000-memory.dmpFilesize
16.6MB
-
memory/1508-62-0x0000000001DC0000-0x0000000002E4E000-memory.dmpFilesize
16.6MB
-
memory/1508-64-0x0000000001DC0000-0x0000000002E4E000-memory.dmpFilesize
16.6MB
-
memory/1508-65-0x0000000001DC0000-0x0000000002E4E000-memory.dmpFilesize
16.6MB
-
memory/1508-66-0x0000000001DC0000-0x0000000002E4E000-memory.dmpFilesize
16.6MB
-
memory/1508-80-0x00000000003F0000-0x00000000003F2000-memory.dmpFilesize
8KB
-
memory/1508-32-0x0000000001DC0000-0x0000000002E4E000-memory.dmpFilesize
16.6MB
-
memory/1508-7-0x0000000001DC0000-0x0000000002E4E000-memory.dmpFilesize
16.6MB