Analysis
-
max time kernel
21s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
18-12-2024 00:48
General
-
Target
615b7955e30774c5be889411cdcb532d46ffbc2bf99d3d3af8c1f478003733e1.exe
-
Size
1.1MB
-
MD5
669b6cf51f911e95a00f1b2d29dbf3ea
-
SHA1
7b0d3fc8e9390eb59d16e2a490d14fdcf0e06458
-
SHA256
615b7955e30774c5be889411cdcb532d46ffbc2bf99d3d3af8c1f478003733e1
-
SHA512
43a5dee16bf807ffcc19fa68d122ef7e58a17703d0774d66c3f82bebda3ae1c7e13d9bfc5722dfe7019e08e1ad16d2c3b50647a07c33773a730d3d98c8fa549a
-
SSDEEP
24576:W1/aGLDCM4D8ayGMCPnXo8/ql8ahCKn+xnjbmf8NRUoNvo2OKVlnFr4sIZjUHt9v:FD8ayGM0Xonl84UHmf8NRUoNvo2OKVlz
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
http://klkjwre77638dfqwieuoi888.info/
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
-
Sality
Sality is backdoor written in C++, first discovered in 2003.
-
Sality family
-
UAC bypass 3 TTPs 2 IoCs
-
Windows security bypass 2 TTPs 12 IoCs
-
Disables RegEdit via registry modification 2 IoCs
-
Disables Task Manager via registry modification
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Windows security modification 2 TTPs 14 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 2 IoCs
-
UPX packed file 26 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 45 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
System policy modification 1 TTPs 2 IoCs
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\615b7955e30774c5be889411cdcb532d46ffbc2bf99d3d3af8c1f478003733e1.exe"C:\Users\Admin\AppData\Local\Temp\615b7955e30774c5be889411cdcb532d46ffbc2bf99d3d3af8c1f478003733e1.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Disables RegEdit via registry modification
- Loads dropped DLL
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\ProgramData\csjslv.exe"C:\ProgramData\csjslv.exe"3⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Disables RegEdit via registry modification
- Deletes itself
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD5d83df3eef398edb32ac01f9820d38c59
SHA1322eafd91f4adea73bab519147a83fd2ee6a85b7
SHA2564b64f171e7cfc9351e8d0aab37045fd5021631314d6ac4f289bad5266cad20f1
SHA5121d4a8c9e5ad77a006e21e3e5172f06a3a5c69beb5c4e03c4c39ca061d44eb01b9688eb36f306d2d1b39dc2e2043bdf652d26c24fae8ea1ae62cd5ef5f5babca7
-
Filesize
557KB
MD56f1656028d98fceaa83d9b6f8cc5459d
SHA17f2e990ad5347f6613683e7efa86f08ebfa9f4a6
SHA2562121af2516f030cebfd88efb6b6c195ecc4573cdbc79595253af54970a0a8a9a
SHA512cc0ede5bd411363d4f6a81e20521af15865decedbfb539702744f8cafc2087533a513f4a7541cb0eb3447411397cd042d00232e9d091a97e09043711379ce71e
-
Filesize
257B
MD5ca6f3b7bcf3d19737339641f589458c2
SHA1a60abc41fe8e5ed8c835db2d48fce7a23ec63153
SHA2564504fdcddd58a5e46b4f0719ce553610f7d55aafa5dc8da18f3c8218e2f2d5fd
SHA512eea0f2f578aebcb62312681cae3c5633af3022b6e97bc4588f34f90b5fb63ae04df81e4b82c00b7d22c54a5c2d068e3d3abbbc11ab1989bc6f0a812ec28795a2
-
Filesize
522KB
MD5e5eb4edf90bd0f39551065e11904d766
SHA18bd449263b6e72a7bc0c54f63d76e84ed47ed008
SHA256d95e5ef8de06fec0d74f30ceac6dd1c83898459eaf9e5e59affe914b898fe7b5
SHA5127298e3bb063f1bf3a2dab4eb17442c8b8129acf89cf1efb931778f41bd11982c055ba833c78c3b8a76fd45ae2ccfb047959a1b54202891b4f413283d2402650a
-
Filesize
4KB
-
Filesize
392KB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
356KB
-
Filesize
8KB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
16.6MB
-
Filesize
8KB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
356KB
-
Filesize
16.6MB
-
Filesize
392KB
-
Filesize
16.6MB
-
Filesize
8KB
-
Filesize
356KB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
356KB
-
Filesize
16.6MB
-
Filesize
8KB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
4KB
-
Filesize
16.6MB
-
Filesize
8KB