Analysis
-
max time kernel
94s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20250129-en -
resource tags
-
submitted
04-02-2025 20:17
General
-
Target
4b2af9375ba4f9ba8292b321904a389c59811d5df1672fcf451ebfe7edf1c8f5N.exe
-
Size
2.3MB
-
MD5
5120687b58c696d6dd278c33b8f602c0
-
SHA1
2f943de41a955cf57dd986a76be5ea2ab2f74106
-
SHA256
4b2af9375ba4f9ba8292b321904a389c59811d5df1672fcf451ebfe7edf1c8f5
-
SHA512
1d9b114a6fbe63cdc62d9e460956a178871bd43dfd58abdf91fd965ce87262a3e482b313a9c6d8d96e23db5d896e9ddd4ab1766ca35723e1a9a3e82b39d921a4
-
SSDEEP
49152:eSqLS9g8pdEbrkchyOn7pPGEKG/DAW2NzG3nJJOvw0:eSJ9ubrHRpPGvEX2VG3J
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 3 IoCs
-
Sality
Sality is backdoor written in C++, first discovered in 2003.
-
Sality family
-
UAC bypass 3 TTPs 1 IoCs
-
Windows security bypass 2 TTPs 6 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Windows security modification 2 TTPs 7 IoCs
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Enumerates connected drives 3 TTPs 6 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
UPX packed file 22 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 4 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of WriteProcessMemory 40 IoCs
-
System policy modification 1 TTPs 1 IoCs
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\4b2af9375ba4f9ba8292b321904a389c59811d5df1672fcf451ebfe7edf1c8f5N.exe"C:\Users\Admin\AppData\Local\Temp\4b2af9375ba4f9ba8292b321904a389c59811d5df1672fcf451ebfe7edf1c8f5N.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
\??\c:\c2951b27f517f049e3de37\update\update.exec:\c2951b27f517f049e3de37\update\update.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵
-
C:\Windows\system32\BackgroundTaskHost.exe"C:\Windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.2MB
MD57395d79f92cffad11bb35f8c2501f44e
SHA196d025062a1c5e458e1ce11924088f4d398cc2f0
SHA25613ec51ba205f86f938311aee14c3d748bc82053207a4c282e6b23c508132d347
SHA512a9b634da7fcd11090642707f5ad49d38305860143abd5bb24ef3c7a4b0fe4acc1a085163630c87886674d94de6f3dfd145f147f9c34cd65d544507bb58500b8c
-
Filesize
20KB
MD5d4eb5085e6467ac362053383a7f355c2
SHA107991485565b0805c8e7768cd699dc504c7ce241
SHA256d4eea3cdccfdcec3358501152b498f6798bd3048f398940c51d5f1c677c02fc4
SHA512e85b254f339b65142a53e18e8fc73fd6686537d425e1172cf31352d55fb2ced3d3766c0ea73173bb8d3e61cb2383e4732a289937a61d1344d72f2a98c76c2ade
-
Filesize
8KB
MD5915d28b2e2dbfdd8f63250c7806c22f6
SHA189c57169b264b293e81aa41a0a780c35162c7f31
SHA25630bddabc8bea0c2520e6859121897c52a8e9bb56b90e9dbe0a519cd20415c1aa
SHA5121061ae1a71e572f8abeca227f3978186513d3fec9350c6dfe33ebd4896ec07b0be6745763a1520928ac00758aa77609be15fdc446d394c08add6490d8648912a
-
Filesize
451KB
MD559b5bae540e021de17880e4bde817554
SHA1ac321f865076d4f5f1074666b3a704b5003d246c
SHA2564c90d40c3303be5f7ab50ff68ce7ec14d37e7afd8a30d6db10b5d2fc3bb3dd17
SHA512b722b1dfc39461451b5417c04515abe1393f4548398b1df08ecf43ffdb38b8a89e1fe12f7125c25e710b7e7b1f99293c477573189be5f4e9a24042e563a5a4e4
-
Filesize
946KB
MD5fdb5b6011f1b000b6d5f51b26b4f5d28
SHA1784ae6c59bb06f212b2da8cf29b23cc06c62f925
SHA256dd40dc1e85286f9ff0f7380eb4925cdb9a6406d7fb78890c81e52d6fc6d3b52e
SHA512cbd1cf87419e84c2bdab6dadb6ec2222799178f0ff0c48d1148b5836862bd88275161bb4d3b93d7fdd209a0f2c6bb7b774d19ddea7935ade93d1247a3dc77aec
-
Filesize
70KB
MD5f0f090d689e632841184bb75831e842f
SHA1045d3166096bf08b193966e7494faf2b2d6cfec7
SHA256761384678b46e39d5486e9d6a08f8ca6ab407ec14bd1b87dcfd781c6e4b8fcc3
SHA512ad4510d5115d5ba87ce5e3e3b63443909663f131142f5d17c5283f6203b3b9ffec6add3280a2fee19233104a40ef75ebc459dd07d9ffe9cf36e3dd6f1c8b3c98
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
2.3MB
-
Filesize
16.7MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
8KB
-
Filesize
16.7MB
-
Filesize
8KB
-
Filesize
2.3MB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
2.3MB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
2.3MB
-
Filesize
468KB