Analysis
-
max time kernel
14s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
03-02-2025 06:44
General
-
Target
8495820dff405411b583506d7fc8957dda5896bbca3026f623cdff8d55202a10.exe
-
Size
798KB
-
MD5
5e97b77494e9a232d41fd412c2e0e5f1
-
SHA1
5509ff42481ba325cc9c42bc6da8d3fac1c0cd8f
-
SHA256
8495820dff405411b583506d7fc8957dda5896bbca3026f623cdff8d55202a10
-
SHA512
61c944ec76eaac64070b2ec6f0c1eeeedce10417eac9b70deb4fb6a9270b7a552ec80ba7470b26bed3c5de2f45e5f8a8bcd076794f46eed34b802c8437344e56
-
SSDEEP
12288:AITsqgmDWSpR+Gqc1gOSJVSKdet5RVu5ihnYQspCp9qWvX9fRBZtVRnOB:AIXgCWSpRycdSJVDsVu5unzqWvX1fVs
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 3 IoCs
-
Sality
Sality is backdoor written in C++, first discovered in 2003.
-
Sality family
-
UAC bypass 3 TTPs 1 IoCs
-
Windows security bypass 2 TTPs 6 IoCs
-
Windows security modification 2 TTPs 7 IoCs
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
UPX packed file 16 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 21 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
-
System policy modification 1 TTPs 1 IoCs
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\8495820dff405411b583506d7fc8957dda5896bbca3026f623cdff8d55202a10.exe"C:\Users\Admin\AppData\Local\Temp\8495820dff405411b583506d7fc8957dda5896bbca3026f623cdff8d55202a10.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD558db6edebcc6f237c907719215757cf3
SHA1e1be147af669bcd0aefc8a9d3dbc256698fd7585
SHA2561115193e7057876fc4a0752e71da9a6059e4b4354166b06987a91876a46023d9
SHA512fb5f1ba45c2a1bedfd73acde3e0bd50715a7f8559533aa4e31f0f6da3e011c5ade6b6a3535dabee40fa4725a0716ef0f465f960dd87edae6e9afeb7912fed1b1
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
8KB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
4KB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
800KB
-
Filesize
800KB