Analysis
-
max time kernel
13s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
-
submitted
30-05-2024 05:14
General
-
Target
f8889955f844a94357547f9072b88ac421e4658e29195b315039571e511ef5d4.exe
-
Size
736KB
-
MD5
bf68397c247f8f3b66e76e23e771b4a5
-
SHA1
8e48636cfe46a36000ca39984cc30e9a4dbd9f11
-
SHA256
f8889955f844a94357547f9072b88ac421e4658e29195b315039571e511ef5d4
-
SHA512
5ae3b42d105de6a0844bfb681218583f37af122fce95d655faa2aa9de458ca246817328c36194a4cf7e3511f9f944cd7630c3910624ae9b47ced09b2853f6191
-
SSDEEP
12288:BTyjXW+48qWywrU4kGFezOAVuJ5PIbww7F5DO3HYffgcZqOnZo:lIXW/8yw1ez54lI3F5SXYHmOnZo
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Modifies firewall policy service 2 TTPs 6 IoCs
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
-
Sality
Sality is backdoor written in C++, first discovered in 2003.
-
UAC bypass 3 TTPs 2 IoCs
-
Windows security bypass 2 TTPs 12 IoCs
-
Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 28 IoCs
-
UPX dump on OEP (original entry point) 28 IoCs
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 27 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Windows security modification 2 TTPs 14 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 2 IoCs
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in Windows directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 41 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
System policy modification 1 TTPs 2 IoCs
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\f8889955f844a94357547f9072b88ac421e4658e29195b315039571e511ef5d4.exe"C:\Users\Admin\AppData\Local\Temp\f8889955f844a94357547f9072b88ac421e4658e29195b315039571e511ef5d4.exe"2⤵
- Modifies firewall policy service
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Windows security bypass
- Loads dropped DLL
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exeC:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe3⤵
- Modifies firewall policy service
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Windows security bypass
- Deletes itself
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
3Disable or Modify Tools
3Modify Registry
8Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
664KB
MD52eb5d76180ce7b3241b281fa79ab3483
SHA106293dea80e39c7eb7ee2bdb00d60b58d932fa8a
SHA256e1b9beb4617a720d55afaec364941bb18ea2c456a8b06b30a736f0cbb5c297e8
SHA51235f553c76fc67afb88a6a090fcbad6af3e2faae154c9c84bd869714194012525a2d42b76dad855805f107a37c351f0de08fd9a03d8ddc1dd400d64640d81b90b
-
Filesize
257B
MD52886017bdeedb091666c805330d99585
SHA1e8d4f8567f69b88b7d5e146ff8b0d63f45f4e05f
SHA2568f970a9f7f01aac6e29182ec1dbce80f058f23d1c93d0a352ac68a3bac9523c5
SHA5121838e52c6b7af142e4b93232532bb38f56e75bd6d9555ff3b610d58337a527da31669f304ef0352e9a2c3f224e9d8f74a6d60243aa773dcf15048de15d14d7c7
-
Filesize
100KB
MD550b1b5eebf6225a58f8e5b0d2cc54cc6
SHA15c2d2dabe70e49990635f54b5b8b5f5e2f4a5763
SHA256a75626106e8fa98554a6c02ae18d3fe49fb079e30280d34b333dea194558802d
SHA512c8ba781c47b58617bdad3e0ea9c01f8bab26e7c0a8c3cc1b7e0a9db40c08bf32658eab2d2e3761dc16d8727080c97d372037542adc42b24250d3f0cdf502fb0b
-
Filesize
736KB
MD5bf68397c247f8f3b66e76e23e771b4a5
SHA18e48636cfe46a36000ca39984cc30e9a4dbd9f11
SHA256f8889955f844a94357547f9072b88ac421e4658e29195b315039571e511ef5d4
SHA5125ae3b42d105de6a0844bfb681218583f37af122fce95d655faa2aa9de458ca246817328c36194a4cf7e3511f9f944cd7630c3910624ae9b47ced09b2853f6191
-
Filesize
8KB
-
Filesize
16.6MB
-
Filesize
8KB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
8KB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
4KB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
564KB
-
Filesize
16.6MB
-
Filesize
768KB
-
Filesize
8KB
-
Filesize
16.6MB
-
Filesize
8KB
-
Filesize
768KB
-
Filesize
8KB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
768KB
-
Filesize
4KB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
4KB
-
Filesize
16.6MB
-
Filesize
768KB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB