Analysis

  • max time kernel
    123s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/07/2024, 09:10

General

  • Target

    0cf7e1c3efbe6b365efbc513c2ba80b9a93fe9de5241ef030f01fd99574a5e05.exe

  • Size

    124KB

  • MD5

    9a1ab17165e7479a824fff589f61ff4c

  • SHA1

    3e113fde76fd0132f92ba18d8eca697925d1ded3

  • SHA256

    0cf7e1c3efbe6b365efbc513c2ba80b9a93fe9de5241ef030f01fd99574a5e05

  • SHA512

    3af303a03dd9a63dd0efddbf8f56944c5654467ca440e67843253d2461458b9836c8dc678315c347a491b9fc901ec431e166c2ac9f7d40eb2e06e11ad89c86a8

  • SSDEEP

    1536:A3SHmLKarIpY/LcP50Gb8Tfp804Xel9hx5r6XOcCaWuG3rgQSw8O:AkF3p8LchVYW0Uel9hD6XvCduVQth

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Signatures

  • Modifies firewall policy service 3 TTPs 3 IoCs
  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

  • UAC bypass 3 TTPs 1 IoCs
  • Windows security bypass 2 TTPs 6 IoCs
  • Executes dropped EXE 2 IoCs
  • UPX packed file 34 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Windows security modification 2 TTPs 7 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Enumerates connected drives 3 TTPs 42 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file 1 TTPs 2 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 1 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 44 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 1 IoCs

Processes

  • C:\Windows\system32\fontdrvhost.exe
    "fontdrvhost.exe"
    1⤵
      PID:780
    • C:\Windows\system32\fontdrvhost.exe
      "fontdrvhost.exe"
      1⤵
        PID:784
      • C:\Windows\system32\dwm.exe
        "dwm.exe"
        1⤵
          PID:336
        • C:\Windows\system32\sihost.exe
          sihost.exe
          1⤵
            PID:2452
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
            1⤵
              PID:2488
            • C:\Windows\system32\taskhostw.exe
              taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
              1⤵
                PID:2700
              • C:\Windows\Explorer.EXE
                C:\Windows\Explorer.EXE
                1⤵
                  PID:3564
                  • C:\Users\Admin\AppData\Local\Temp\0cf7e1c3efbe6b365efbc513c2ba80b9a93fe9de5241ef030f01fd99574a5e05.exe
                    "C:\Users\Admin\AppData\Local\Temp\0cf7e1c3efbe6b365efbc513c2ba80b9a93fe9de5241ef030f01fd99574a5e05.exe"
                    2⤵
                    • Drops file in Windows directory
                    • Suspicious use of WriteProcessMemory
                    PID:4984
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7109.bat
                      3⤵
                      • Suspicious use of WriteProcessMemory
                      PID:4068
                      • C:\Windows\System32\Conhost.exe
                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                        4⤵
                          PID:3648
                        • C:\Users\Admin\AppData\Local\Temp\0cf7e1c3efbe6b365efbc513c2ba80b9a93fe9de5241ef030f01fd99574a5e05.exe
                          "C:\Users\Admin\AppData\Local\Temp\0cf7e1c3efbe6b365efbc513c2ba80b9a93fe9de5241ef030f01fd99574a5e05.exe"
                          4⤵
                          • Modifies firewall policy service
                          • UAC bypass
                          • Windows security bypass
                          • Executes dropped EXE
                          • Windows security modification
                          • Checks whether UAC is enabled
                          • Enumerates connected drives
                          • Drops autorun.inf file
                          • Drops file in Windows directory
                          • Modifies registry class
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of WriteProcessMemory
                          • System policy modification
                          PID:4272
                      • C:\Windows\Logo1_.exe
                        C:\Windows\Logo1_.exe
                        3⤵
                        • Executes dropped EXE
                        • Enumerates connected drives
                        • Drops file in Program Files directory
                        • Drops file in Windows directory
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of WriteProcessMemory
                        PID:1424
                        • C:\Windows\SysWOW64\net.exe
                          net stop "Kingsoft AntiVirus Service"
                          4⤵
                          • Suspicious use of WriteProcessMemory
                          PID:3664
                          • C:\Windows\SysWOW64\net1.exe
                            C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                            5⤵
                              PID:5044
                    • C:\Windows\system32\svchost.exe
                      C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
                      1⤵
                        PID:3688
                      • C:\Windows\system32\DllHost.exe
                        C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                        1⤵
                          PID:3888
                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                          1⤵
                            PID:3980
                          • C:\Windows\System32\RuntimeBroker.exe
                            C:\Windows\System32\RuntimeBroker.exe -Embedding
                            1⤵
                              PID:4044
                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                              1⤵
                                PID:776
                              • C:\Windows\System32\RuntimeBroker.exe
                                C:\Windows\System32\RuntimeBroker.exe -Embedding
                                1⤵
                                  PID:2356
                                • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
                                  "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
                                  1⤵
                                    PID:1728
                                  • C:\Windows\System32\RuntimeBroker.exe
                                    C:\Windows\System32\RuntimeBroker.exe -Embedding
                                    1⤵
                                      PID:532
                                    • C:\Windows\system32\backgroundTaskHost.exe
                                      "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca
                                      1⤵
                                        PID:4264
                                      • C:\Windows\system32\backgroundTaskHost.exe
                                        "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
                                        1⤵
                                          PID:4724
                                        • C:\Windows\System32\RuntimeBroker.exe
                                          C:\Windows\System32\RuntimeBroker.exe -Embedding
                                          1⤵
                                            PID:2408
                                          • C:\Windows\System32\RuntimeBroker.exe
                                            C:\Windows\System32\RuntimeBroker.exe -Embedding
                                            1⤵
                                              PID:64
                                            • C:\Windows\system32\DllHost.exe
                                              C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
                                              1⤵
                                                PID:4064
                                              • C:\Windows\system32\BackgroundTransferHost.exe
                                                "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
                                                1⤵
                                                  PID:2408

                                                Network

                                                MITRE ATT&CK Enterprise v15

                                                Replay Monitor

                                                Loading Replay Monitor...

                                                Downloads

                                                • C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateCore.exe

                                                  Filesize

                                                  244KB

                                                  MD5

                                                  a188505d53ad954d1b2e6456cf1e7668

                                                  SHA1

                                                  cb8cbeffe88729f7f734ce9e5a6b6c514de79dbe

                                                  SHA256

                                                  c8779deb43865dd24d098fa7dc000ca3c126f2c59f8043cb0fe3b3c8c92d3f35

                                                  SHA512

                                                  9f120b140406c118c2c4574445083bff00108c837b5939538d783c5443d68f462feaa660198b65a92917e2751b05bac68cc67f3b2213efe6cb4d8b125c684353

                                                • C:\Program Files\7-Zip\7z.exe

                                                  Filesize

                                                  571KB

                                                  MD5

                                                  bf443202aa28f39e7c39ccda18a2ce00

                                                  SHA1

                                                  523a5b15315bb5023863c7fc9a166aa94c378ce8

                                                  SHA256

                                                  2a9023ed807f186bcc2e56b4d35b55919b464839bc61a3e59517863804a44f17

                                                  SHA512

                                                  4ce6d6323960ef7fde2931b76f26130c2f253af98d6f7cbcc77c3cf3e99610c9c23c4f38276c20f4c62778eb2744e84bf7b774e45f8afd9461f1937da8c679a2

                                                • C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe

                                                  Filesize

                                                  637KB

                                                  MD5

                                                  9cba1e86016b20490fff38fb45ff4963

                                                  SHA1

                                                  378720d36869d50d06e9ffeef87488fbc2a8c8f7

                                                  SHA256

                                                  a22e6d0f5c7d44fefc2204e0f7c7b048e1684f6cf249ba98c006bbf791c22d19

                                                  SHA512

                                                  2f3737d29ea3925d10ea5c717786425f6434be732974586328f03691a35cd1539828e3301685749e5c4135b8094f15b87fb9659915de63678a25749e2f8f5765

                                                • C:\Users\Admin\AppData\Local\Temp\$$a7109.bat

                                                  Filesize

                                                  722B

                                                  MD5

                                                  3aa39ecf6e4c524b0e9f5026863de7b3

                                                  SHA1

                                                  3914b00b82e4e19e2c23a89b60e00f5f38bdbd94

                                                  SHA256

                                                  a7e6e3de00437c7be8406d6694ab8c89786570ca5cc7ccd7dd9fe47ecbbe45c3

                                                  SHA512

                                                  19bbb14b35c596394c14acb42f73edb627067871fcca8c32ff8c95ae6801c449c53d50eb047c363c163d9a1ab289a027803cd5ab6ba8a33968e8fd7c2c4199a7

                                                • C:\Users\Admin\AppData\Local\Temp\0cf7e1c3efbe6b365efbc513c2ba80b9a93fe9de5241ef030f01fd99574a5e05.exe.exe

                                                  Filesize

                                                  97KB

                                                  MD5

                                                  46556ee3036ad5f36d9e11c707732357

                                                  SHA1

                                                  c29cda7b177901a11b78e2aed416c17086c332e8

                                                  SHA256

                                                  a9703618fd528863b15123b95e24f46fdc9cd1968634c1bff2dfffb40ff12746

                                                  SHA512

                                                  5081dbd9f14dcea8dc9889213d23fea44460fac1c83ad9b8e97fc669b6ab641b545f084f7cffa3ab13752acd6a8e88601c2078232bb0450de1bd375294046bd1

                                                • C:\Windows\Logo1_.exe

                                                  Filesize

                                                  27KB

                                                  MD5

                                                  3992018359c15d0314fdd929a93f6de6

                                                  SHA1

                                                  f555c42a2d4e15a428a549ac4a6efd625dca9f1d

                                                  SHA256

                                                  29351c1cb276aa4bd87e3e0c7aed4808a2c80cad99b26b8be984350aeeee2b48

                                                  SHA512

                                                  236360097d9fe4f693a17d4b7e9d08d4f017019eba021e17217ba1486a6ecaa1a1ad54c93a3819d84b5af2bbeb3096b81ef8e055fd973954323cfcd7107f7dc2

                                                • F:\$RECYCLE.BIN\S-1-5-21-384068567-2943195810-3631207890-1000\_desktop.ini

                                                  Filesize

                                                  9B

                                                  MD5

                                                  1368e4d784ef82633de86fa6bc6e37f9

                                                  SHA1

                                                  77c7384e886b27647bb4f2fd364e7947e7b6abc6

                                                  SHA256

                                                  57507bed6cf91d70e66bd4cc287634889ef30b648cb7c44a4edec0e2cb68b772

                                                  SHA512

                                                  3cb7168e776eb564768e30eba43174014a85108ab306a7c07a1522fb42173c381a5bff9ac10944fd345dd5308061cbe2878c60d1e878f8768281c1adcf5dd85b

                                                • F:\morhj.exe

                                                  Filesize

                                                  97KB

                                                  MD5

                                                  7982ffffdda85c5fe79906a51d466059

                                                  SHA1

                                                  dcba568e70f11225a4bbfef94631322f15a9e8e1

                                                  SHA256

                                                  a95eab176e2d55f2dafae31b072a92d083db5ee10b5031de33a748ff18aa6520

                                                  SHA512

                                                  1ef4ff4a941f3300846f8bcbe3536fde8b0be7dd99c522c3622dc49e89e7cc843fe6f807c08f84211ec01cb0b2d998c3628926b9b7e42a2a41a5a0b6581b8959

                                                • memory/1424-84-0x0000000000400000-0x0000000000435000-memory.dmp

                                                  Filesize

                                                  212KB

                                                • memory/1424-9-0x0000000000400000-0x0000000000435000-memory.dmp

                                                  Filesize

                                                  212KB

                                                • memory/1424-29-0x0000000000760000-0x0000000000761000-memory.dmp

                                                  Filesize

                                                  4KB

                                                • memory/1424-90-0x0000000000560000-0x0000000000562000-memory.dmp

                                                  Filesize

                                                  8KB

                                                • memory/1424-32-0x0000000000560000-0x0000000000562000-memory.dmp

                                                  Filesize

                                                  8KB

                                                • memory/1424-28-0x0000000000560000-0x0000000000562000-memory.dmp

                                                  Filesize

                                                  8KB

                                                • memory/1424-58-0x0000000000400000-0x0000000000435000-memory.dmp

                                                  Filesize

                                                  212KB

                                                • memory/4068-44-0x0000000000CA0000-0x0000000000CA2000-memory.dmp

                                                  Filesize

                                                  8KB

                                                • memory/4068-107-0x0000000000CA0000-0x0000000000CA2000-memory.dmp

                                                  Filesize

                                                  8KB

                                                • memory/4068-26-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

                                                  Filesize

                                                  4KB

                                                • memory/4068-25-0x0000000000CA0000-0x0000000000CA2000-memory.dmp

                                                  Filesize

                                                  8KB

                                                • memory/4068-46-0x0000000000CA0000-0x0000000000CA2000-memory.dmp

                                                  Filesize

                                                  8KB

                                                • memory/4272-59-0x00000000007B0000-0x000000000186A000-memory.dmp

                                                  Filesize

                                                  16.7MB

                                                • memory/4272-71-0x00000000007B0000-0x000000000186A000-memory.dmp

                                                  Filesize

                                                  16.7MB

                                                • memory/4272-42-0x00000000007B0000-0x000000000186A000-memory.dmp

                                                  Filesize

                                                  16.7MB

                                                • memory/4272-33-0x00000000007B0000-0x000000000186A000-memory.dmp

                                                  Filesize

                                                  16.7MB

                                                • memory/4272-43-0x00000000007B0000-0x000000000186A000-memory.dmp

                                                  Filesize

                                                  16.7MB

                                                • memory/4272-36-0x0000000003AF0000-0x0000000003AF2000-memory.dmp

                                                  Filesize

                                                  8KB

                                                • memory/4272-45-0x00000000007B0000-0x000000000186A000-memory.dmp

                                                  Filesize

                                                  16.7MB

                                                • memory/4272-48-0x00000000007B0000-0x000000000186A000-memory.dmp

                                                  Filesize

                                                  16.7MB

                                                • memory/4272-49-0x00000000007B0000-0x000000000186A000-memory.dmp

                                                  Filesize

                                                  16.7MB

                                                • memory/4272-50-0x00000000007B0000-0x000000000186A000-memory.dmp

                                                  Filesize

                                                  16.7MB

                                                • memory/4272-51-0x00000000007B0000-0x000000000186A000-memory.dmp

                                                  Filesize

                                                  16.7MB

                                                • memory/4272-52-0x00000000007B0000-0x000000000186A000-memory.dmp

                                                  Filesize

                                                  16.7MB

                                                • memory/4272-55-0x00000000007B0000-0x000000000186A000-memory.dmp

                                                  Filesize

                                                  16.7MB

                                                • memory/4272-56-0x00000000007B0000-0x000000000186A000-memory.dmp

                                                  Filesize

                                                  16.7MB

                                                • memory/4272-35-0x0000000003AF0000-0x0000000003AF2000-memory.dmp

                                                  Filesize

                                                  8KB

                                                • memory/4272-23-0x00000000007B0000-0x000000000186A000-memory.dmp

                                                  Filesize

                                                  16.7MB

                                                • memory/4272-60-0x00000000007B0000-0x000000000186A000-memory.dmp

                                                  Filesize

                                                  16.7MB

                                                • memory/4272-62-0x00000000007B0000-0x000000000186A000-memory.dmp

                                                  Filesize

                                                  16.7MB

                                                • memory/4272-64-0x00000000007B0000-0x000000000186A000-memory.dmp

                                                  Filesize

                                                  16.7MB

                                                • memory/4272-67-0x00000000007B0000-0x000000000186A000-memory.dmp

                                                  Filesize

                                                  16.7MB

                                                • memory/4272-69-0x00000000007B0000-0x000000000186A000-memory.dmp

                                                  Filesize

                                                  16.7MB

                                                • memory/4272-37-0x00000000007B0000-0x000000000186A000-memory.dmp

                                                  Filesize

                                                  16.7MB

                                                • memory/4272-73-0x00000000007B0000-0x000000000186A000-memory.dmp

                                                  Filesize

                                                  16.7MB

                                                • memory/4272-75-0x00000000007B0000-0x000000000186A000-memory.dmp

                                                  Filesize

                                                  16.7MB

                                                • memory/4272-21-0x00000000007B0000-0x000000000186A000-memory.dmp

                                                  Filesize

                                                  16.7MB

                                                • memory/4272-83-0x00000000007B0000-0x000000000186A000-memory.dmp

                                                  Filesize

                                                  16.7MB

                                                • memory/4272-22-0x00000000007B0000-0x000000000186A000-memory.dmp

                                                  Filesize

                                                  16.7MB

                                                • memory/4272-87-0x00000000007B0000-0x000000000186A000-memory.dmp

                                                  Filesize

                                                  16.7MB

                                                • memory/4272-88-0x00000000007B0000-0x000000000186A000-memory.dmp

                                                  Filesize

                                                  16.7MB

                                                • memory/4272-24-0x00000000007B0000-0x000000000186A000-memory.dmp

                                                  Filesize

                                                  16.7MB

                                                • memory/4272-96-0x00000000007B0000-0x000000000186A000-memory.dmp

                                                  Filesize

                                                  16.7MB

                                                • memory/4272-98-0x00000000007B0000-0x000000000186A000-memory.dmp

                                                  Filesize

                                                  16.7MB

                                                • memory/4272-100-0x0000000003AF0000-0x0000000003AF2000-memory.dmp

                                                  Filesize

                                                  8KB

                                                • memory/4272-101-0x00000000007B0000-0x000000000186A000-memory.dmp

                                                  Filesize

                                                  16.7MB

                                                • memory/4272-103-0x00000000007B0000-0x000000000186A000-memory.dmp

                                                  Filesize

                                                  16.7MB

                                                • memory/4272-104-0x00000000007B0000-0x000000000186A000-memory.dmp

                                                  Filesize

                                                  16.7MB

                                                • memory/4272-31-0x0000000003E80000-0x0000000003E81000-memory.dmp

                                                  Filesize

                                                  4KB

                                                • memory/4272-19-0x00000000007B0000-0x000000000186A000-memory.dmp

                                                  Filesize

                                                  16.7MB

                                                • memory/4272-18-0x0000000000400000-0x0000000000412000-memory.dmp

                                                  Filesize

                                                  72KB

                                                • memory/4984-0-0x0000000000400000-0x0000000000435000-memory.dmp

                                                  Filesize

                                                  212KB

                                                • memory/4984-8-0x0000000000400000-0x0000000000435000-memory.dmp

                                                  Filesize

                                                  212KB