Analysis
-
max time kernel
97s -
max time network
98s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
17-12-2024 14:26
General
-
Target
ffcf659dafafa2feab8e4e57def55e2660c53859b223f195a50c676478939753N.exe
-
Size
1.0MB
-
MD5
3695a727fad8ba98faedd151e7762fb0
-
SHA1
dc58d36d6e8a558e40de7ecbbd33f3497ad556a6
-
SHA256
ffcf659dafafa2feab8e4e57def55e2660c53859b223f195a50c676478939753
-
SHA512
2b632e250c0e580a3a501c3ce7539d68cbbcd9329795594ead966bfcd41c34e5b06a70e7ed0bdba4a2f41e2b36f2ad78dea88337d8ec105d20c4588f5fb9c6c4
-
SSDEEP
24576:vzXbv1ozXKLRVC8e2mnGVMn8FliPNUtYnFohcJY8+dAIZKL+K5bq:vYGYncENUtYnFoeG8+dAgKL+KE
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 3 IoCs
-
Sality
Sality is backdoor written in C++, first discovered in 2003.
-
Sality family
-
UAC bypass 3 TTPs 1 IoCs
-
Windows security bypass 2 TTPs 6 IoCs
-
Windows security modification 2 TTPs 7 IoCs
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
UPX packed file 18 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of WriteProcessMemory 30 IoCs
-
System policy modification 1 TTPs 1 IoCs
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\ffcf659dafafa2feab8e4e57def55e2660c53859b223f195a50c676478939753N.exe"C:\Users\Admin\AppData\Local\Temp\ffcf659dafafa2feab8e4e57def55e2660c53859b223f195a50c676478939753N.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
461B
MD5931d379556201c079dc6128e2aba8dd3
SHA15165e43aecd9e9b805ce31b2fd54f62fcd2178bc
SHA25693429f150bd5645849ac95c334358d2d6bacbc58fd7fac86d000b8fd7dfa5f78
SHA5124220193e08e39c4ef5e14f7efd9ac573c6238c56e4538ee2e3f3269cf35dcc97d4d49d619d4416521aba1dbf4e69be8c9353871725bce17c0d065523e35c6e59
-
Filesize
461B
MD59f0ff3bdb644d9401ee51a5a52d80c1d
SHA1a6b802e75e0f2130455d4e364406985d6126c660
SHA2565c54efd996e82ae9a24b327cc24f10a6940e2ecf1a531da4a098c8d6fa97e5dc
SHA51279b7d82573296cac9254608525c7e1a42902d6137275831cc714bb05335bd6d170584758d090b995eb45e128e935b5224e10dca58b9d43e392279219f8a9ee5f
-
Filesize
461B
MD5f385c360b905e157574c2e746308be39
SHA18095f1af9781dbe8e38bb60c8f9118e4b749e83c
SHA2563245b854011d85b341d637cabded2706ee7d41ad510ffafa555e2b2cf3e08646
SHA512debf3ba10259650c4247875701a79c24d4085fc18015b31f2323f631429d79c30d91c17442f108e51c9bed18d81afbfa7653f5320ef40fb5cec44fc6ddadd60b
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
8KB
-
Filesize
16.7MB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
16.7MB
-
Filesize
1.0MB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
8KB
-
Filesize
16.7MB
-
Filesize
1.0MB