Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system -
submitted
03-08-2024 03:40
Static task
static1
Behavioral task
behavioral1
Sample
683a09da219918258c58a7f61f7dc4161a3a7a377cf82a31b840baabfb9a4a96.exe
Resource
win11-20240802-en
Behavioral task
behavioral2
Sample
unpacked.exe
Resource
win11-20240802-en
General
-
Target
unpacked.exe
-
Size
72KB
-
MD5
108756f41d114eb93e136ba2feb838d0
-
SHA1
8c6b51923ee7da2f4642c7717db95fbb77d96164
-
SHA256
b38b4c1dcf6d6ecd1bbfc236b43c37c18044c2f42f11e5088384f4bd0751929c
-
SHA512
d13183e8ba4689475b0cb3f5cc7acbfba34a1ba661eb5988984647c2bd3e561cfa03f6267f60ae9fb2ca0783f26c105cdbcfc89def598c48968febef23c21aaa
-
SSDEEP
768:F9NJK3qZRhxXHIQBsLL16BKc+bBQZ/UMc2:rXzXol6cc+lQZMMc2
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Temp\!satana!.txt
Signatures
-
Satana
Ransomware family which also encrypts the system's Master Boot Record (MBR).
-
Deletes itself 1 IoCs
Processes:
vnn.exepid process 1412 vnn.exe -
Executes dropped EXE 1 IoCs
Processes:
vnn.exepid process 1412 vnn.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
unpacked.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000\Software\Microsoft\Windows\CurrentVersion\Run\wkzjtxl = "C:\\Users\\Admin\\AppData\\Local\\Temp\\!satana!.txt" unpacked.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
vnn.exedescription ioc process File opened for modification \??\PHYSICALDRIVE0 vnn.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
unpacked.exevnn.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language unpacked.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vnn.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
vnn.exedescription pid process Token: SeIncBasePriorityPrivilege 1412 vnn.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
unpacked.exedescription pid process target process PID 4216 wrote to memory of 1412 4216 unpacked.exe vnn.exe PID 4216 wrote to memory of 1412 4216 unpacked.exe vnn.exe PID 4216 wrote to memory of 1412 4216 unpacked.exe vnn.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\unpacked.exe"C:\Users\Admin\AppData\Local\Temp\unpacked.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\Users\Admin\AppData\Local\Temp\vnn.exe"C:\Users\Admin\AppData\Local\Temp\vnn.exe" {4a6feaa9-5125-11ef-ad6f-806e6f6e6963} "C:\Users\Admin\AppData\Local\Temp\unpacked.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1412
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD53ded20899c7c81e008441b646fa6b96a
SHA1dcd2687c0e7ed577d456ffd26da0565b3326866d
SHA256b7aa982c8ab7795cc5bdc1e63d8e3dcadd5cf0dd50b4712e4b31e6b7eb1da28e
SHA512eb9dbfc8cfe53f1d5f6525e1495c505799b8b86bf0db1c2c3f5ebceefb7a63d779ae3daffbeaad24e08d50e04a81e5bd1bf8b94794a15febe195390cb18e9c3b
-
Filesize
72KB
MD5108756f41d114eb93e136ba2feb838d0
SHA18c6b51923ee7da2f4642c7717db95fbb77d96164
SHA256b38b4c1dcf6d6ecd1bbfc236b43c37c18044c2f42f11e5088384f4bd0751929c
SHA512d13183e8ba4689475b0cb3f5cc7acbfba34a1ba661eb5988984647c2bd3e561cfa03f6267f60ae9fb2ca0783f26c105cdbcfc89def598c48968febef23c21aaa