Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
17-06-2024 18:26
General
-
Target
a5faf4e08934c3e4dd4bc630084f0a6839bc4d454ea369b47ec955c2f62f8f16.exe
-
Size
707KB
-
MD5
a0c14900b386365888755c6d66268f9e
-
SHA1
9751d2dc253c517b49cef93057e7ddcf94bb97f2
-
SHA256
a5faf4e08934c3e4dd4bc630084f0a6839bc4d454ea369b47ec955c2f62f8f16
-
SHA512
3a30f306faf898ed912563172da4d2d305a9fa50664e5d444ed003383c7e8b253fc12219fffaa8a42683e1e571c32d2335abdb3785d69eee327f9d9893c0c723
-
SSDEEP
12288:fJFZqYMOaQ0q9nV/zsnK23KHVI6nodVdyMLiqyVcxwtVxgpMiuzOT/FS799xw:hFZqhOBnVyK23C6OoYMLiVcKtVx4Miue
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Modifies firewall policy service 2 TTPs 3 IoCs
-
Sality
Sality is backdoor written in C++, first discovered in 2003.
-
UAC bypass 3 TTPs 1 IoCs
-
Windows security bypass 2 TTPs 6 IoCs
-
UPX packed file 13 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Windows security modification 2 TTPs 7 IoCs
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Drops file in Windows directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies Internet Explorer settings 1 TTPs 34 IoCs
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 20 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 1 IoCs
-
Suspicious use of SetWindowsHookEx 13 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
System policy modification 1 TTPs 1 IoCs
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\a5faf4e08934c3e4dd4bc630084f0a6839bc4d454ea369b47ec955c2f62f8f16.exe"C:\Users\Admin\AppData\Local\Temp\a5faf4e08934c3e4dd4bc630084f0a6839bc4d454ea369b47ec955c2f62f8f16.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://127.0.0.1:88/3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2496 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Modify Registry
6Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Pre-OS Boot
1Bootkit
1Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1112-16-0x0000000001FF0000-0x0000000001FF2000-memory.dmpFilesize
8KB
-
memory/2056-31-0x00000000003D0000-0x00000000003D2000-memory.dmpFilesize
8KB
-
memory/2056-52-0x0000000000400000-0x00000000005A9000-memory.dmpFilesize
1.7MB
-
memory/2056-13-0x0000000001F20000-0x0000000002FAE000-memory.dmpFilesize
16.6MB
-
memory/2056-4-0x0000000001F20000-0x0000000002FAE000-memory.dmpFilesize
16.6MB
-
memory/2056-8-0x0000000001F20000-0x0000000002FAE000-memory.dmpFilesize
16.6MB
-
memory/2056-10-0x0000000001F20000-0x0000000002FAE000-memory.dmpFilesize
16.6MB
-
memory/2056-6-0x0000000001F20000-0x0000000002FAE000-memory.dmpFilesize
16.6MB
-
memory/2056-11-0x0000000001F20000-0x0000000002FAE000-memory.dmpFilesize
16.6MB
-
memory/2056-9-0x0000000001F20000-0x0000000002FAE000-memory.dmpFilesize
16.6MB
-
memory/2056-30-0x00000000003D0000-0x00000000003D2000-memory.dmpFilesize
8KB
-
memory/2056-7-0x0000000001F20000-0x0000000002FAE000-memory.dmpFilesize
16.6MB
-
memory/2056-5-0x0000000001F20000-0x0000000002FAE000-memory.dmpFilesize
16.6MB
-
memory/2056-12-0x0000000001F20000-0x0000000002FAE000-memory.dmpFilesize
16.6MB
-
memory/2056-29-0x00000000003E0000-0x00000000003E1000-memory.dmpFilesize
4KB
-
memory/2056-26-0x00000000003E0000-0x00000000003E1000-memory.dmpFilesize
4KB
-
memory/2056-25-0x00000000003D0000-0x00000000003D2000-memory.dmpFilesize
8KB
-
memory/2056-3-0x0000000001F20000-0x0000000002FAE000-memory.dmpFilesize
16.6MB
-
memory/2056-32-0x0000000074AF1000-0x0000000074AF2000-memory.dmpFilesize
4KB
-
memory/2056-33-0x0000000074AF0000-0x0000000074B2B000-memory.dmpFilesize
236KB
-
memory/2056-35-0x0000000001F20000-0x0000000002FAE000-memory.dmpFilesize
16.6MB
-
memory/2056-50-0x0000000074AF0000-0x0000000074B2B000-memory.dmpFilesize
236KB
-
memory/2056-53-0x0000000001F20000-0x0000000002FAE000-memory.dmpFilesize
16.6MB
-
memory/2056-0-0x0000000000400000-0x00000000005A9000-memory.dmpFilesize
1.7MB