Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
25-12-2024 14:57
General
-
Target
9215bd936f85f1b177858972fb75437419d56686b85adea7bf25574ab39f06eb.exe
-
Size
1012KB
-
MD5
d4648382de8effa5627bc3a4a8ee8695
-
SHA1
429c5ce856adb12905df2c1e0be1ac44ec1b280e
-
SHA256
9215bd936f85f1b177858972fb75437419d56686b85adea7bf25574ab39f06eb
-
SHA512
fa67fb34b86bf9450c74a8f951806ded35fa2186076efcdd7071a95a545bb830ec7e981d9f64b578567763894b917a32fc421e93f66a9216f22586bb9f3008f4
-
SSDEEP
12288:k1/aGLDCMNpNAkoSzZWD8ayX2MQCw7D0INK4h1oWxJpcEi0/3IWV//7cSd8HR4by:k1/aGLDCM4D8ayGM0R3o8/oAuylKi+P
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Modifies firewall policy service 3 TTPs 3 IoCs
-
Sality
Sality is backdoor written in C++, first discovered in 2003.
-
Sality family
-
UAC bypass 3 TTPs 1 IoCs
-
Windows security bypass 2 TTPs 6 IoCs
-
Disables RegEdit via registry modification 1 IoCs
-
Disables Task Manager via registry modification
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Windows security modification 2 TTPs 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
UPX packed file 10 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 20 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
-
System policy modification 1 TTPs 1 IoCs
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\9215bd936f85f1b177858972fb75437419d56686b85adea7bf25574ab39f06eb.exe"C:\Users\Admin\AppData\Local\Temp\9215bd936f85f1b177858972fb75437419d56686b85adea7bf25574ab39f06eb.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Disables RegEdit via registry modification
- Loads dropped DLL
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\ProgramData\homwr.exe"C:\ProgramData\homwr.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1012KB
MD5a5d8ca3e74b01839f86911d2d4ba0e0f
SHA1e6d8b44d0ea82bca04100fd092f5c31af35daa89
SHA2561f28c1701ec15805b1cf7cef8416d679cddf89e72278cfd03fe16c81ff1d4214
SHA5121351d4aefe4e6c8c4208d3493f01d26e585de40e9cfbe091c7ce7a15acca97803d651d06abacd22277be4e524e53ca77fb6fc87f25659991d08c162426be2364
-
Filesize
557KB
MD58d0dcbc1481a967175e19dfa204d461e
SHA1e785b892957645d143f1408e71811130f8d3db96
SHA256a723e131c3067b612750c583cab54524721189ed95929f96dc71b326a98e4b72
SHA5128457e9a648ace64fadfc5bc742ec3c1315c5815176a06c3c37271cf4a7cd9b1030dddd1077f353a393435a5442ecc8983c7dd1e0a090d5e3d7711231589af1ba
-
Filesize
454KB
MD514ca389eed3fdd83f1721e3dccd181f7
SHA12dac941eb729a477d713a1c264b5ed8cc61ec90a
SHA25668573a90faef02bf79c0f762d368bd17dfe40cb20d3a0fa0ee3a35c26d3c3304
SHA5122706e50b9726cdb08f9f075ed5b12311db76ee357208a625e91cd9f5344861542a45490074bae1cab9d53a0affbedf77010d447e434ab87bc639453942f5d31c
-
Filesize
8KB
-
Filesize
16.6MB
-
Filesize
8KB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
8KB
-
Filesize
16.6MB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
392KB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
8KB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
392KB
-
Filesize
288KB