Analysis
-
max time kernel
93s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
18-12-2024 05:48
General
-
Target
e501a7708b168c18e4effe01f9f7ed41bedbcb7f7b0bd20632daaf7e8e215c22.exe
-
Size
654KB
-
MD5
926fd7ad60304c5c300af3075dd8522d
-
SHA1
0aedfeda0a58abe4e2f52bbef05df441bd20c0dc
-
SHA256
e501a7708b168c18e4effe01f9f7ed41bedbcb7f7b0bd20632daaf7e8e215c22
-
SHA512
76f2b28df2d65e1eae328838e358b0bdf8b37aa23e62c63102ef48dbee2546e7bea45e356a8ffa319e9903de75a972006a1ac7df3e13fbc10220fdf024644ab5
-
SSDEEP
12288:BQe0gFJzVe3ohdwTIOzSW0l2zdpZSPPvdVwtS8J+cb0cBu0e7IOAZiqfyDGRYD1c:agFJzcMWuWhzdpA1Vw/b0x7IsqfyCRYc
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 3 IoCs
-
Sality
Sality is backdoor written in C++, first discovered in 2003.
-
Sality family
-
UAC bypass 3 TTPs 1 IoCs
-
Windows security bypass 2 TTPs 6 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 3 IoCs
-
Windows security modification 2 TTPs 7 IoCs
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
UPX packed file 19 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 4 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of WriteProcessMemory 19 IoCs
-
System policy modification 1 TTPs 1 IoCs
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\e501a7708b168c18e4effe01f9f7ed41bedbcb7f7b0bd20632daaf7e8e215c22.exe"C:\Users\Admin\AppData\Local\Temp\e501a7708b168c18e4effe01f9f7ed41bedbcb7f7b0bd20632daaf7e8e215c22.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Loads dropped DLL
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
\??\c:\5b5847b4a1dc3d5bb3bbf5fd\update\update.exec:\5b5847b4a1dc3d5bb3bbf5fd\update\update.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
25KB
MD5ee207e35aea4d5df41d90221e1b66efa
SHA1757469cf9ad2f21f267bbe730560114fdf8a89a5
SHA256cf64c95e9a2d02967efc22b00efb3736156b913a95231eb63c1df45d43475e64
SHA51243e9f75725daa4f3428b2d9cee2c2cc8b2f2e991b8e58d72d2f429fbdfb614c86d172f03d3f9da98756bd4e245643d9a57c6efa422d6c60ad364a2322245542d
-
Filesize
712KB
MD59570121468658dcc6972f1dfa624a223
SHA161716952df7a03fc01ac919f44f07e9588840b8c
SHA256bc2cde5db3027a726c81df78bdef10b5ec9a7b4a5ba297911c7b999638f76b33
SHA5127c2168a6db5bf7dd7c09682983e9059524621834d0d9ae250382c74d714b0e99b625f5ee9a648e18de9fa25b580bac5ab770ad63c406a9f88c87ade1a372429c
-
Filesize
331KB
MD5eb5c64286d987337f702813e73fcf615
SHA177c393b4cf5b61c29afa408ec1ebd93b22271e3f
SHA25644062d8525a1de307491a46376d1831e23c27c18edb3de8f142d83eb7a21fc52
SHA5120c71779a7b5a3507b5d0ccc0f9ff785032e1d8c32e76a0c0acadfd531d9ca87b61fd9742d69c610823a4315e181ad41f561811badbc262052d0f3ba86b9237a6
-
Filesize
590KB
MD567d24adceabe017ea685b3fd6311f7c1
SHA166b6f8d0d74469a85a7044fca3afa3909c59d585
SHA2565f30925753c29d983c08b1f65c645a110400a0587f4d1d9b73dd47c69f4658ac
SHA5129803e3a252ff1fc79343c6871d0fabacac07d7c39e0474050c8e0e6f86263003681feaeb861214db27c206517d40ac8da019ff940c7cc8c7b6925a6c1144ef79
-
Filesize
336KB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
728KB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
728KB
-
Filesize
8KB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
728KB
-
Filesize
4KB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
728KB
-
Filesize
16.7MB
-
Filesize
8KB