Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
26-12-2024 06:44
General
-
Target
2fb963462bb268bbcc6fa05f5621540397bc7d14749fc732e6a7ca3537e78797N.exe
-
Size
1012KB
-
MD5
ad28c9805e5eb87d99463a1924e56200
-
SHA1
3d9b780eca5d339acaa84b6c0455adb746c6f595
-
SHA256
2fb963462bb268bbcc6fa05f5621540397bc7d14749fc732e6a7ca3537e78797
-
SHA512
cb76e668f8d8285cf261a530ed0280ade80212eaef6ef440bc8f435fc1354faf406da56212ee70bd10d8ca74a52a68aec37662cf45cf5e88a186e3ed7b7737e4
-
SSDEEP
24576:k1/aGLDCM4D8ayGM0R3o8/l3kAM8bb6HF7bdCUzl:3D8ayGM0ZoMX6HF3zl
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Modifies firewall policy service 3 TTPs 3 IoCs
-
Sality
Sality is backdoor written in C++, first discovered in 2003.
-
Sality family
-
UAC bypass 3 TTPs 1 IoCs
-
Windows security bypass 2 TTPs 6 IoCs
-
Disables RegEdit via registry modification 1 IoCs
-
Disables Task Manager via registry modification
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Windows security modification 2 TTPs 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
UPX packed file 10 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 22 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
-
System policy modification 1 TTPs 1 IoCs
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\2fb963462bb268bbcc6fa05f5621540397bc7d14749fc732e6a7ca3537e78797N.exe"C:\Users\Admin\AppData\Local\Temp\2fb963462bb268bbcc6fa05f5621540397bc7d14749fc732e6a7ca3537e78797N.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Disables RegEdit via registry modification
- Loads dropped DLL
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\ProgramData\jtomv.exe"C:\ProgramData\jtomv.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1012KB
MD59168cdc8789c74ba05ad53f288207dda
SHA12413abdf39b1578c78b92750990b8faf3808a799
SHA256ae6d2fa504728976d014e7e6930b89eaf8e75974b8e6d4a1f5d32e59d966850b
SHA51218a6f72f5e621c3e792066866bbc79e8b78a592f2b8c68335635fa2f51f0ac35639f99691e1464eda764a67b0c473a37f8e3836633c3ab8382ff4dc1466ed30f
-
Filesize
557KB
MD58d0dcbc1481a967175e19dfa204d461e
SHA1e785b892957645d143f1408e71811130f8d3db96
SHA256a723e131c3067b612750c583cab54524721189ed95929f96dc71b326a98e4b72
SHA5128457e9a648ace64fadfc5bc742ec3c1315c5815176a06c3c37271cf4a7cd9b1030dddd1077f353a393435a5442ecc8983c7dd1e0a090d5e3d7711231589af1ba
-
Filesize
454KB
MD5360609b3211174f57fb7fbbf63dc53cf
SHA11f66acf4cd17c24e1cee9d046279eba795c6067c
SHA2565bc4b666ff0b861f71175701581de28d0e389cb2619580dcb94652b0b94fd386
SHA5120fe620ce9d4831dfc4297ce0e28ff611161f2e51a9c54810f95388b71219e461b975ebe4d334d4be6b85429ae30c36ce7a93960348212977ee18be04756f1d60
-
Filesize
8KB
-
Filesize
288KB
-
Filesize
8KB
-
Filesize
16.6MB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
392KB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
4KB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
392KB
-
Filesize
8KB
-
Filesize
16.6MB
-
Filesize
16.6MB