Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    91s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/12/2024, 06:48 UTC

General

  • Target

    e98c4b558cb8ba13d205e75f1536448f6f8e2084c41fed17c46e7a89534b8b42.exe

  • Size

    1.8MB

  • MD5

    591e9d013cda19046f07b1fbc888dd6a

  • SHA1

    c60e3f3e98fc588dfc724215e12617e62f7364fb

  • SHA256

    e98c4b558cb8ba13d205e75f1536448f6f8e2084c41fed17c46e7a89534b8b42

  • SHA512

    537773f933c7fa9346fa4d4465a6bd251c5ec7d7e45a259b493353ba0eccd4557d816f7e81f8bc5149b04caaa9b42b17e76eb30f27c544b5b631f5cac6753544

  • SSDEEP

    49152:sffZMOlq1y3vPhIkNqNoNI/y21vtJndjh7CdxE26:IZTwxd/FtJdjh7Az6

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

Signatures

  • Modifies firewall policy service 3 TTPs 3 IoCs
  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

  • Sality family
  • UAC bypass 3 TTPs 1 IoCs
  • Windows security bypass 2 TTPs 6 IoCs
  • Windows security modification 2 TTPs 7 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file 15 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs
  • System policy modification 1 TTPs 1 IoCs

Processes

  • C:\Windows\system32\fontdrvhost.exe
    "fontdrvhost.exe"
    1⤵
      PID:796
    • C:\Windows\system32\fontdrvhost.exe
      "fontdrvhost.exe"
      1⤵
        PID:800
      • C:\Windows\system32\dwm.exe
        "dwm.exe"
        1⤵
          PID:388
        • C:\Windows\system32\sihost.exe
          sihost.exe
          1⤵
            PID:2420
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
            1⤵
              PID:2436
            • C:\Windows\system32\taskhostw.exe
              taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
              1⤵
                PID:2684
              • C:\Windows\Explorer.EXE
                C:\Windows\Explorer.EXE
                1⤵
                  PID:3412
                  • C:\Users\Admin\AppData\Local\Temp\e98c4b558cb8ba13d205e75f1536448f6f8e2084c41fed17c46e7a89534b8b42.exe
                    "C:\Users\Admin\AppData\Local\Temp\e98c4b558cb8ba13d205e75f1536448f6f8e2084c41fed17c46e7a89534b8b42.exe"
                    2⤵
                    • Modifies firewall policy service
                    • UAC bypass
                    • Windows security bypass
                    • Windows security modification
                    • Checks whether UAC is enabled
                    • Enumerates connected drives
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of WriteProcessMemory
                    • System policy modification
                    PID:4440
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
                  1⤵
                    PID:3536
                  • C:\Windows\system32\DllHost.exe
                    C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                    1⤵
                      PID:3724
                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                      1⤵
                        PID:3812
                      • C:\Windows\System32\RuntimeBroker.exe
                        C:\Windows\System32\RuntimeBroker.exe -Embedding
                        1⤵
                          PID:3880
                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                          1⤵
                            PID:3972
                          • C:\Windows\System32\RuntimeBroker.exe
                            C:\Windows\System32\RuntimeBroker.exe -Embedding
                            1⤵
                              PID:4100
                            • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
                              "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
                              1⤵
                                PID:3732
                              • C:\Windows\System32\RuntimeBroker.exe
                                C:\Windows\System32\RuntimeBroker.exe -Embedding
                                1⤵
                                  PID:4452
                                • C:\Windows\system32\backgroundTaskHost.exe
                                  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
                                  1⤵
                                    PID:1236

                                  Network

                                  • flag-us
                                    DNS
                                    217.106.137.52.in-addr.arpa
                                    Remote address:
                                    8.8.8.8:53
                                    Request
                                    217.106.137.52.in-addr.arpa
                                    IN PTR
                                    Response
                                  • flag-us
                                    DNS
                                    20.160.190.20.in-addr.arpa
                                    Remote address:
                                    8.8.8.8:53
                                    Request
                                    20.160.190.20.in-addr.arpa
                                    IN PTR
                                    Response
                                  • flag-us
                                    DNS
                                    95.221.229.192.in-addr.arpa
                                    Remote address:
                                    8.8.8.8:53
                                    Request
                                    95.221.229.192.in-addr.arpa
                                    IN PTR
                                    Response
                                  • flag-us
                                    DNS
                                    104.219.191.52.in-addr.arpa
                                    Remote address:
                                    8.8.8.8:53
                                    Request
                                    104.219.191.52.in-addr.arpa
                                    IN PTR
                                    Response
                                  • flag-us
                                    DNS
                                    232.168.11.51.in-addr.arpa
                                    Remote address:
                                    8.8.8.8:53
                                    Request
                                    232.168.11.51.in-addr.arpa
                                    IN PTR
                                    Response
                                  • flag-us
                                    DNS
                                    197.87.175.4.in-addr.arpa
                                    Remote address:
                                    8.8.8.8:53
                                    Request
                                    197.87.175.4.in-addr.arpa
                                    IN PTR
                                    Response
                                  • flag-us
                                    DNS
                                    198.187.3.20.in-addr.arpa
                                    Remote address:
                                    8.8.8.8:53
                                    Request
                                    198.187.3.20.in-addr.arpa
                                    IN PTR
                                    Response
                                  • flag-us
                                    DNS
                                    43.229.111.52.in-addr.arpa
                                    Remote address:
                                    8.8.8.8:53
                                    Request
                                    43.229.111.52.in-addr.arpa
                                    IN PTR
                                    Response
                                  No results found
                                  • 8.8.8.8:53
                                    217.106.137.52.in-addr.arpa
                                    dns
                                    73 B
                                    147 B
                                    1
                                    1

                                    DNS Request

                                    217.106.137.52.in-addr.arpa

                                  • 8.8.8.8:53
                                    20.160.190.20.in-addr.arpa
                                    dns
                                    72 B
                                    158 B
                                    1
                                    1

                                    DNS Request

                                    20.160.190.20.in-addr.arpa

                                  • 8.8.8.8:53
                                    95.221.229.192.in-addr.arpa
                                    dns
                                    73 B
                                    144 B
                                    1
                                    1

                                    DNS Request

                                    95.221.229.192.in-addr.arpa

                                  • 8.8.8.8:53
                                    104.219.191.52.in-addr.arpa
                                    dns
                                    73 B
                                    147 B
                                    1
                                    1

                                    DNS Request

                                    104.219.191.52.in-addr.arpa

                                  • 8.8.8.8:53
                                    232.168.11.51.in-addr.arpa
                                    dns
                                    72 B
                                    158 B
                                    1
                                    1

                                    DNS Request

                                    232.168.11.51.in-addr.arpa

                                  • 8.8.8.8:53
                                    197.87.175.4.in-addr.arpa
                                    dns
                                    71 B
                                    157 B
                                    1
                                    1

                                    DNS Request

                                    197.87.175.4.in-addr.arpa

                                  • 8.8.8.8:53
                                    198.187.3.20.in-addr.arpa
                                    dns
                                    71 B
                                    157 B
                                    1
                                    1

                                    DNS Request

                                    198.187.3.20.in-addr.arpa

                                  • 8.8.8.8:53
                                    43.229.111.52.in-addr.arpa
                                    dns
                                    72 B
                                    158 B
                                    1
                                    1

                                    DNS Request

                                    43.229.111.52.in-addr.arpa

                                  MITRE ATT&CK Enterprise v15

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads

                                  • memory/4440-0-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                  • memory/4440-1-0x0000000002200000-0x000000000328E000-memory.dmp

                                    Filesize

                                    16.6MB

                                  • memory/4440-10-0x0000000002200000-0x000000000328E000-memory.dmp

                                    Filesize

                                    16.6MB

                                  • memory/4440-4-0x0000000002200000-0x000000000328E000-memory.dmp

                                    Filesize

                                    16.6MB

                                  • memory/4440-3-0x0000000002200000-0x000000000328E000-memory.dmp

                                    Filesize

                                    16.6MB

                                  • memory/4440-15-0x0000000005A00000-0x0000000005A01000-memory.dmp

                                    Filesize

                                    4KB

                                  • memory/4440-14-0x00000000054A0000-0x00000000054A2000-memory.dmp

                                    Filesize

                                    8KB

                                  • memory/4440-6-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                  • memory/4440-11-0x0000000002200000-0x000000000328E000-memory.dmp

                                    Filesize

                                    16.6MB

                                  • memory/4440-13-0x0000000002200000-0x000000000328E000-memory.dmp

                                    Filesize

                                    16.6MB

                                  • memory/4440-17-0x00000000054A0000-0x00000000054A2000-memory.dmp

                                    Filesize

                                    8KB

                                  • memory/4440-12-0x0000000002200000-0x000000000328E000-memory.dmp

                                    Filesize

                                    16.6MB

                                  • memory/4440-5-0x0000000002200000-0x000000000328E000-memory.dmp

                                    Filesize

                                    16.6MB

                                  • memory/4440-19-0x0000000000401000-0x0000000000411000-memory.dmp

                                    Filesize

                                    64KB

                                  • memory/4440-18-0x00000000054A0000-0x00000000054A2000-memory.dmp

                                    Filesize

                                    8KB

                                  • memory/4440-16-0x0000000002200000-0x000000000328E000-memory.dmp

                                    Filesize

                                    16.6MB

                                  • memory/4440-21-0x0000000002200000-0x000000000328E000-memory.dmp

                                    Filesize

                                    16.6MB

                                  • memory/4440-22-0x0000000002200000-0x000000000328E000-memory.dmp

                                    Filesize

                                    16.6MB

                                  • memory/4440-23-0x0000000002200000-0x000000000328E000-memory.dmp

                                    Filesize

                                    16.6MB

                                  • memory/4440-24-0x0000000002200000-0x000000000328E000-memory.dmp

                                    Filesize

                                    16.6MB

                                  • memory/4440-25-0x0000000002200000-0x000000000328E000-memory.dmp

                                    Filesize

                                    16.6MB

                                  • memory/4440-26-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                  • memory/4440-32-0x00000000054A0000-0x00000000054A2000-memory.dmp

                                    Filesize

                                    8KB

                                  • memory/4440-28-0x0000000002200000-0x000000000328E000-memory.dmp

                                    Filesize

                                    16.6MB

                                  • memory/4440-44-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                  We care about your privacy.

                                  This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.