Analysis
-
max time kernel
143s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
05/12/2024, 10:59
General
-
Target
e83a873af960a432da3e5df827f9a2a1fa45e2002a065656247055dd2e914dde.exe
-
Size
775KB
-
MD5
eb353cc031d5fc0dfd16b26ba43d8a31
-
SHA1
0df106f6f40554fc45e2ebe9dbfe5baff3a69601
-
SHA256
e83a873af960a432da3e5df827f9a2a1fa45e2002a065656247055dd2e914dde
-
SHA512
121c8c0b0933f2c42197dd9ad4fa4f0856f29ec0334dda8222b3f7b62de968b1d99a4aa5b1dfb3334287cbc6276283cbd3ae420d9549282f330e4392c009ac12
-
SSDEEP
12288:L1V4L4PCtGDtlLJgsGov6gYAMkZ6XlwAcMs+50tgAakT7hs5fDDbbjmh8Q0ukCEh:L1VUQDtlLJg3oH6XKAsCI/Akdos92
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 3 IoCs
-
Sality
Sality is backdoor written in C++, first discovered in 2003.
-
Sality family
-
UAC bypass 3 TTPs 1 IoCs
-
Windows security bypass 2 TTPs 6 IoCs
-
Downloads MZ/PE file
-
Windows security modification 2 TTPs 7 IoCs
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
UPX packed file 19 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs
-
Modifies Internet Explorer settings 1 TTPs 36 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 23 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
System policy modification 1 TTPs 1 IoCs
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\e83a873af960a432da3e5df827f9a2a1fa45e2002a065656247055dd2e914dde.exe"C:\Users\Admin\AppData\Local\Temp\e83a873af960a432da3e5df827f9a2a1fa45e2002a065656247055dd2e914dde.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://down.360safe.com/setupbeta.exe3⤵
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2652 CREDAT:275457 /prefetch:24⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
7Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
342B
MD5659e194ac35c7a0185758382b7ec83f1
SHA12d73636caceb9b950c50b3474f806c3b4c4526e5
SHA256037a497a3b8c06b8ea657604f95849303600bde8e60dad6df27d7d349bcd95de
SHA512c9c48986ad552abfead72de720264c0d82cdb5eb1a1805de7940f6a228741fc3e069b54f924290f2abe67964771892c8c561acf52df25848b51c7e452cf1ba98
-
Filesize
342B
MD5b3ca4cd8dd2d7318ac778daae5685447
SHA1c4d1068b83bff5645f78af7a6445f37bd3c32ae7
SHA25690622303f27bc0818621e30f119086a72690c75cd2f4eff79bc0c137dc00e8c2
SHA512c837307dbeaea20e3f94da97aa9a5905c4fae93e5736cfd70ccd21a3df12ab4bd847fcb9e153f26fd31483a18c8a62942df7ce52e2236a516b27805a30dab514
-
Filesize
342B
MD5c7defa39d408a8d34ad465b93c1cacd7
SHA17e23f5e692066a4fcd2b92d26789687f3911f9b2
SHA25688477d38f3713f6dd8754b28f357551e74d9c4084dfff4f4e31b2f376f0d6f15
SHA512a65e0ce6d4e5edf4d04792bf06dcbd2d6bb665ed73af33a830460a1d5720fd68577d36d7e0196dfcc3942b4c02b398ae4586d181faa7899af5e99b4091326f5c
-
Filesize
342B
MD5dfb66c82b38d99ca18223fc0346df4f4
SHA1da78a6b805d2ff91101704a40b8cf849b1fb022a
SHA256fb5ed2db484693b17e25ef9cc83bfb055dd1b4c48bb0b8d7f6e42181dfab7b14
SHA512d2284cd7c71a74daa04544cfe4ecb3f13b7365d4d4a1c3f524e0f37c379afb7894cf05146bd008af4d722e8e3f2a0853dd56b5bd38452a08171a3ff19fe66c75
-
Filesize
342B
MD58f37fffde5b2ce18b61d31f56c9592c6
SHA1210a82334bae9e206af049badc53cf1fcac27d4a
SHA256f8af37cc1ebcac9d5f90935fbd1d5d5d4df410a3f30ab536b36545a8463d812d
SHA512c05d5b4e6cfa268a0fb676aa2cd8fd01ca5c17b51f91ddc8ac676fa3a48580f52bcd2b1197ed2f841297f9a2391016f2d24b2862ef666fcf48438d85f9a59ffa
-
Filesize
342B
MD5f289fe6e1821ebd888cf4e792b3093cc
SHA1e8c6235d9d07499a01284dcd9e283f9cec5bd23a
SHA2569d55169c3edf1113e2886d34f2a3d5458e8fa19e9d650f2ba7396c69891e4dd1
SHA512952567061747a19e1a13bfc1b69652766ba907c188123d71e63b463ce23ee3ad0274bbacfba32b43da36ef1d5b5bf335154f8c0354c803ff4b337c4994af3962
-
Filesize
342B
MD5ee0d5cfcb6e6b23be5932499db55ac49
SHA12dc036393139fd38bad7ea61d675ce9ff724f649
SHA256a70b71a8d668c047a53783a95fe28712afce7a4c99b071337fad06f86747592a
SHA51200cd350a3306bb1ba3b24893e2c242f91f016b9028704ad00198025e902e0bf45200144ba3457fcb892f63472372c15e6fa578d77d91a99dcb028a98296eea94
-
Filesize
342B
MD58069214214250565092d6f93cb25fde9
SHA1e8095d4a0897ae424da2f976f21c66aee664094b
SHA256c87f6f1431571b3fc9c3bc6ace3b76bc38572644918e87bb8e873c7706606cd3
SHA512181ae74d33a7204406647402684fd3ab0fa7c9772e2da79b97b9ba7c58d601b866f6639aab058709bf0737e61523b108051f527684f302ec82efb5547859d7f2
-
Filesize
342B
MD58c46859318cbde0c3b736e1a5de11555
SHA164bb3a33c25db2ab921c54f6615eca0448548286
SHA256ff1756c47a114d138e9147e92506cdfdd5358dc0d97d69d0faa613af998e0822
SHA512da7d88b54b621a6f4c766c4a910b98235839e38606dced9b3b3296de1f454e4abb7b7b962fd8efe0a7e2066da1bf0aacc86acead53926a32b2d224d3814a002b
-
Filesize
342B
MD52eb6ae845eaeaad96ac0a79306177710
SHA109b4cc4e1575610af1bd75d739572274406b645a
SHA256fcff07b37fac57aa2c7e54c6165fa1e146bf511cf24c12b75e3d54e1c30c0cfb
SHA5124cb30a2773ba9c9c5050ad30dee5ce05aa96cd533830d21bb4ef7dca84b629c28c1329df9ae53bfa7002e266103f39605c2f9fe5b0f52612bc752be594af09ad
-
Filesize
342B
MD5f697d9df4f5b45ebf96a44a2c8d3a743
SHA192bd2a896b68320cb41072c0e6230a4cc1ca99f0
SHA2566ebdf2a218abc6c316e64a17bfdc2dceca09e174f7e9eb0c0ff2f3e94c5f6b55
SHA51244e787f65942859818cdb2f67350f1b14c931b6922096268ec61470f5c99d2164ffc7e564b3a418094fdb3ff984ccccc71b34b48b72223f04315ea8383db345f
-
Filesize
342B
MD5edfefe5e54cb3ff3b0dc589825cd54b8
SHA147b121d70bd427679697dcb075a8794efc78f717
SHA2564a07264a7a374c0cecf982e8b0af39a8c696cc39dc6c2eaaec2ba67b3df0c943
SHA5129ab9c1339464aea5244465723fe876f00b494c1045891044314ab39eb823ad356a2846c036d562eaff5870b5e40e74e83688289449e07ec7651b354b29d7b694
-
Filesize
342B
MD535282afde72961414f98fb9a5f133798
SHA1058eff3c0501fb3204bceee76bd33b2261671d2b
SHA256079ee7fab1f7a9ad4e7957f4049895997df4104de59440a257b1e956b5636b3e
SHA5124b818826be9520283db8b0136bd796765db698cd25c20964692804f2cad68fab7454ebbeb8a6e7c548a1835bef6e4e06b66208957def3c7d3f63211dede6e336
-
Filesize
342B
MD53da1de189504f13b8745c56430e62942
SHA18a05cbceb032ab2379c4760edc859e79a7cc6ba6
SHA256163828136cd988317225f783abcae38bea01ae2da3bf9cce2f5b813542e7b187
SHA512b2a19e72d3a573a523ac1c89cbace7699bab4466c80f655dc10122365f7cc9532a794f0c21efcd8fb9cf2677ed34b188df49a871e176cdabe3062c5fad6bd475
-
Filesize
342B
MD5b03ec43a3f4d05c3e9fa56d47517616e
SHA1dc40fe603ce294532d859219ab10ac3764353058
SHA256b2e638875e4586de7393dddf586279c49939308c9f5f82551076e5f825da72c8
SHA5128a0910fc319de16b60286e272b8bb1f5fdfe1ae9aeb584e8818b13f424f8b9af083b46af20eabd7cf129abd6611434c5287d767066e410abe5b6b7d981348149
-
Filesize
342B
MD506705e86058071c1ee750cb0190011af
SHA1688bbef1d42676dd11dfb8a9224e5b5c3a06c523
SHA25692f46b1c4eb7c13abdc191a2fa6b5a318e4547ce83a6c60bcd74dceb876fcc99
SHA5129530fe6107eaab5cc759a75f840851f0944eccff97ebc8f35129843f4d885c756a81b49d9a327c837ee1adce7cbbda4ed0462616a2604887066459c417fc54bc
-
Filesize
342B
MD5ace175b8a7a2139a0eeec80fe90391c2
SHA151d778ab0d423d305473f687d96c625629b98e28
SHA2565dab06212b34dc0bb13c885b7d52681c81d6bbc9fad794dff2c483029631a127
SHA5125fa2a8cc7adf88bef41115728c5fbe74e924151c1b9692e17a2178afce5470a690ae23308a1aa3c33592060517816c4e42e907d16ea2cc730b31dac727a7c839
-
Filesize
342B
MD5383b4e8224d50d8c0e5f1b10e5b36de3
SHA1295ab80cf4b9a3f08607a8c588ce00a4f41d891f
SHA2569147249f1723784bd4a15e81f0547f09c9906f8b27a1bb0d4bb07cb8469a7d44
SHA51293f497da2fb56eeca655e6e4246d6ddfca8e4fa17232cead11916bd529387b8a76859ee31bea38cb745bf5914f19b6db9fa9069111434187c5e7af20938b2e39
-
Filesize
342B
MD5c30a638d75f4e63a69bebd600149203d
SHA103e773cf207e4bbb1e3271b44eeb6007b32f98d6
SHA2560e5d90f257d8d9620738340ad64c074219c689ec03e208111a7ff1e1fb39d019
SHA51213306e0805e938c5a0381ddca83023912927a49a3b7d8254da082ab846b398885c54df718d5576210d2e1df674fba54adb254b0304af40dd919fcb246c188a70
-
Filesize
342B
MD5a7a45e22c4520214a7221b3ae62531d5
SHA1ff42c561859f9b2690781ddbc95ab803d011e78c
SHA25615f68b1022597c2682609363ba8cddfa795eed463306ea7c90e38d8dd3ee9be7
SHA5122dd9a0957918ce287ddb58fbda7212c85b650c96af22ec1f018d1978c7f63999239f7985cf6c485cdaec7747d3f8200f3f2b1a2229d63eb38bb8079646f6efbd
-
Filesize
342B
MD5e9a5c5ff9178914bce98650ee1780c06
SHA1a46258a9c9e2166359198da56a916aea01ff797c
SHA256507c43b39c680592c0cb779f320f8641479a4b1be687e964d09d64ec53de4791
SHA5121f9c28bc0fc766582a4642e134bb71560198af1548feaf44ed786bb3ec20a9fdb5c1d2bdde9f8256a2337a84ae77d54e4e810eb12d32dcd75f6f1b32a65808e0
-
Filesize
342B
MD51fa26f6b5f412024777a7fe4f453a1b0
SHA11e0753cbc3e57c5445b7964589ec6f685f8a7a23
SHA25645cbe5881824492940c1a05fc7cf9942e94e3180c144266dada9420d826cb90a
SHA51222d8774e665833f96e8afedc3b5b23d02647c9450bcd5fbc32c582bd8211c529e9d1b53013f0c44bda1a0777aed3f4ea48fd9e5a0dd9c783f43d667c55237184
-
Filesize
342B
MD5efd2fc5ae3570fa2db52a7caa3db5ccf
SHA1a9d6fcd934e9878ce89c96f4a8f97c3463707410
SHA25614281e73d208e78b85b50c88b3a85fb444db3e31c5f5fbb7cb77b212d34a7468
SHA5120e26b48eb05272e9e14ec8f797fef56458b557ed36ad6fb02c553c256c012a90767afdcb8c720a0463ded704550068fede7ced2179098d2c70e2875b6c91a8d6
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
8KB
-
Filesize
16.7MB
-
Filesize
784KB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
784KB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
16.7MB