Analysis
-
max time kernel
118s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
26-12-2024 06:44
General
-
Target
2fb963462bb268bbcc6fa05f5621540397bc7d14749fc732e6a7ca3537e78797N.exe
-
Size
1012KB
-
MD5
ad28c9805e5eb87d99463a1924e56200
-
SHA1
3d9b780eca5d339acaa84b6c0455adb746c6f595
-
SHA256
2fb963462bb268bbcc6fa05f5621540397bc7d14749fc732e6a7ca3537e78797
-
SHA512
cb76e668f8d8285cf261a530ed0280ade80212eaef6ef440bc8f435fc1354faf406da56212ee70bd10d8ca74a52a68aec37662cf45cf5e88a186e3ed7b7737e4
-
SSDEEP
24576:k1/aGLDCM4D8ayGM0R3o8/l3kAM8bb6HF7bdCUzl:3D8ayGM0ZoMX6HF3zl
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Modifies firewall policy service 3 TTPs 3 IoCs
-
Sality
Sality is backdoor written in C++, first discovered in 2003.
-
Sality family
-
UAC bypass 3 TTPs 1 IoCs
-
Windows security bypass 2 TTPs 6 IoCs
-
Disables RegEdit via registry modification 1 IoCs
-
Disables Task Manager via registry modification
-
Executes dropped EXE 1 IoCs
-
Windows security modification 2 TTPs 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
UPX packed file 10 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
System policy modification 1 TTPs 1 IoCs
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\2fb963462bb268bbcc6fa05f5621540397bc7d14749fc732e6a7ca3537e78797N.exe"C:\Users\Admin\AppData\Local\Temp\2fb963462bb268bbcc6fa05f5621540397bc7d14749fc732e6a7ca3537e78797N.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Disables RegEdit via registry modification
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\ProgramData\jtomv.exe"C:\ProgramData\jtomv.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1012KB
MD5ec99952c12549803ec7d35b10be9cded
SHA152d2eabc5acdc4844ba5def8bbc4b4af917c713a
SHA2567afa555036988a8662561d1aff218b757e05ac9c15129afa84c20d6603e52bd6
SHA5121a3104c4b5fdb1861c6837847d753c859380ae6bd9c227bc80eccd972689c43d1eab5811ac04bde446ba60e80d8b0e3589f490177324389cd7dd10e33e1d30c5
-
Filesize
557KB
MD58d0dcbc1481a967175e19dfa204d461e
SHA1e785b892957645d143f1408e71811130f8d3db96
SHA256a723e131c3067b612750c583cab54524721189ed95929f96dc71b326a98e4b72
SHA5128457e9a648ace64fadfc5bc742ec3c1315c5815176a06c3c37271cf4a7cd9b1030dddd1077f353a393435a5442ecc8983c7dd1e0a090d5e3d7711231589af1ba
-
Filesize
454KB
MD5360609b3211174f57fb7fbbf63dc53cf
SHA11f66acf4cd17c24e1cee9d046279eba795c6067c
SHA2565bc4b666ff0b861f71175701581de28d0e389cb2619580dcb94652b0b94fd386
SHA5120fe620ce9d4831dfc4297ce0e28ff611161f2e51a9c54810f95388b71219e461b975ebe4d334d4be6b85429ae30c36ce7a93960348212977ee18be04756f1d60
-
Filesize
288KB
-
Filesize
16.6MB
-
Filesize
392KB
-
Filesize
8KB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
16.6MB
-
Filesize
8KB
-
Filesize
392KB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB