Analysis
-
max time kernel
18s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
31-12-2024 00:41
General
-
Target
e761db38b3e51796cac26fa3f16c1cb1e5caeb0a616ebfdc0fd52df0eeaebcd5.exe
-
Size
3.5MB
-
MD5
45db05360fd5a30d736276bd9511643e
-
SHA1
c4f021f826a86786b1cf7548236aeaedc54cba4d
-
SHA256
e761db38b3e51796cac26fa3f16c1cb1e5caeb0a616ebfdc0fd52df0eeaebcd5
-
SHA512
1a9b4eca38c5df1c2d82ee60de8c5c767346aadcaa0246f558ff132388be01bdf26ca07de4c7e5b381a7297f1e18635ae47707038c64fe02777af2ea7041efa4
-
SSDEEP
98304:ont+QQwdB9q2Ic9FWx4yc1HlJXQcFLOAkGkzdnEVomFHKnP1lTD:ouwUo11HlJX9FLOyomFHKnP15D
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Disables service(s) 3 TTPs
-
Modifies firewall policy service 3 TTPs 6 IoCs
-
Sality
Sality is backdoor written in C++, first discovered in 2003.
-
Sality family
-
UAC bypass 3 TTPs 2 IoCs
-
Windows security bypass 2 TTPs 12 IoCs
-
Blocklisted process makes network request 1 IoCs
-
Stops running service(s) 4 TTPs
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 12 IoCs
-
Windows security modification 2 TTPs 14 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 2 IoCs
-
Enumerates connected drives 3 TTPs 4 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory 3 IoCs
-
UPX packed file 21 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Program Files directory 1 IoCs
-
Drops file in Windows directory 3 IoCs
-
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 12 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
-
Suspicious behavior: LoadsDriver 1 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 45 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
System policy modification 1 TTPs 2 IoCs
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\e761db38b3e51796cac26fa3f16c1cb1e5caeb0a616ebfdc0fd52df0eeaebcd5.exe"C:\Users\Admin\AppData\Local\Temp\e761db38b3e51796cac26fa3f16c1cb1e5caeb0a616ebfdc0fd52df0eeaebcd5.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Loads dropped DLL
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\Rundll32.exeRundll32 C:\Windows\system32\ffwtxctb.dll Exucute4⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exenet stop WinDefend5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop WinDefend6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\net.exenet stop MpsSvc5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MpsSvc6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\sc.exesc config WinDefend start= disabled5⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\sc.exesc config MpsSvc start= disabled5⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" stop PolicyAgent5⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\Rundll32.exeRundll32 C:\Windows\system32\wxhtxctb.dll Exucute4⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Users\Admin\AppData\Local\Temp\e761db38b3e51796cac26fa3f16c1cb1e5caeb0a616ebfdc0fd52df0eeaebcd5.exeC:\Users\Admin\AppData\Local\Temp\e761db38b3e51796cac26fa3f16c1cb1e5caeb0a616ebfdc0fd52df0eeaebcd5.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
3Windows Service
3Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
3Windows Service
3Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
5Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.3MB
MD587fc21eaa1cc7ae2e3a378e23372a967
SHA127c30df7256004da31d25c7b12d4ac5019d2c9b2
SHA2562fbdc9b888fa6621676378d11ae4e6ff967e8e0fb8a3ab86b894a7212058b377
SHA5128cc430b50517c9faaccfe40417c86a0c50c694503626d78896d36963cec9acdaa2cba0517cd6c0a791d2559a0d649af9947820540d4c5cc241e3c1b2cde280a4
-
Filesize
257B
MD5f2b1fea098499918474ea59ccdd008df
SHA17d26bd267c244a4c741648be28b542661d2c814f
SHA256f521baff8802365d3570aae729b19d87c1efe23b09a51e599da253fa49d6c3f7
SHA5125fe8d8dbb29e9dc6bc6cf56e561f154004db28c29ab0938d5786b1da58aab3b4028631194240423ca14a8c855fe3e7d7f62b4c3407ba832dd878eaff57294061
-
Filesize
97KB
MD59cede092be87af84b03bee70a2026369
SHA1d808da9f3587017b9280405136f131be00e448e5
SHA2565fd668cd7caef86140b2348886b80fe43d3186be74e9c53fdc6b5da2b9c43b82
SHA512df6b6ba24ee372da4f032ab86f993f51cb78219c760667221612e396c3080951124cffe24998b7700ef947a4e335fb92ac731bb24bed5dc5c8775d2ff10e5480
-
Filesize
1.7MB
MD5b5eb5bd3066959611e1f7a80fd6cc172
SHA16fb1532059212c840737b3f923a9c0b152c0887a
SHA2561ffb68a66f28f604adcae9c135f8dcf301316ab7fda8ebd294583c56dd26f7cc
SHA5126c0743e0ff4922e859ba66b68040ab994dbae33e80c63ce8c993ad31a0c7aad6c6467484da1550063214953cd641dbf597438dd0c02f24164505d88ca80ea1b6
-
Filesize
53KB
MD5f42bde03a60aa8430290c9598db10d40
SHA1cdfbdd3cbc04150d1e1b1892dea6450a379ca00d
SHA256e1e875c1d42f3196306887d31cfd5d49c0bed29926bcb0daac1b9dcd365127ce
SHA512a27bd15134086d93eb21e06711d403a8c5cdc494bdf4e26340022fb2ada28218c4d0737386691d8161de0a399dc5d91b97e1def3370ae61e6985e8728501fc5e
-
Filesize
150KB
MD562f7f0a9cc1b8d0e91605ca18b42af18
SHA156ea9bc4e7f5c8ca0b1f0474c8a8d7501822bb1d
SHA2560f9805c848a56fbee7ab4783e65b3e850d44045f5157c8fc4aa7245f76b4ebba
SHA512dd01b06fe1c07385b7e165c9905213a9d4d19b5c4e50b8079127e7a81d96270985be223003da428e6334c6ac079f0b92cb14ad66b3307cc74cfbe46591182677
-
Filesize
18KB
MD5056ac80d746cee3a003d283adeeca989
SHA1a0985dddfb010d8f784b1515264691008cf8673a
SHA256c115b42f9838e9ba531d9a1d5dc2881bbf2874933e8f85314faeba90064076da
SHA51261e05e7f0630b4d6543b6142272d69b17486812750aa024aef3f3cd3068fce88d93339cc444cf627a4fc779218a16232647661deb953192f2c6c3a8bd830fe3a
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
3.5MB
-
Filesize
16.7MB
-
Filesize
4KB
-
Filesize
3.5MB
-
Filesize
160KB
-
Filesize
8KB
-
Filesize
160KB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
8KB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
16.7MB
-
Filesize
8KB
-
Filesize
160KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
160KB