Analysis
-
max time kernel
45s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
12-06-2022 09:28
Static task
static1
Behavioral task
behavioral1
Sample
21288e10f35fd98053254a8613f4725899a8fe7f4e8f99f6c7c999a8f04353c7.exe
Resource
win7-20220414-en
General
-
Target
21288e10f35fd98053254a8613f4725899a8fe7f4e8f99f6c7c999a8f04353c7.exe
-
Size
765KB
-
MD5
dce39ede1995a15dca04f2522f9230b5
-
SHA1
1ac9ce4b452516a9275af6be23707bdaf079adeb
-
SHA256
21288e10f35fd98053254a8613f4725899a8fe7f4e8f99f6c7c999a8f04353c7
-
SHA512
2fd0a275447224acd790f5d70051d40b3586e20b8635f9b6fee458f05e4bb9d131471372ade1d3b9fe71b9d620f57f1240f7fdf00660287c5d20bc3bc18d77fa
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Modifies firewall policy service 2 TTPs 3 IoCs
Processes:
21288e10f35fd98053254a8613f4725899a8fe7f4e8f99f6c7c999a8f04353c7.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 21288e10f35fd98053254a8613f4725899a8fe7f4e8f99f6c7c999a8f04353c7.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 21288e10f35fd98053254a8613f4725899a8fe7f4e8f99f6c7c999a8f04353c7.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 21288e10f35fd98053254a8613f4725899a8fe7f4e8f99f6c7c999a8f04353c7.exe -
Processes:
21288e10f35fd98053254a8613f4725899a8fe7f4e8f99f6c7c999a8f04353c7.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 21288e10f35fd98053254a8613f4725899a8fe7f4e8f99f6c7c999a8f04353c7.exe -
Processes:
21288e10f35fd98053254a8613f4725899a8fe7f4e8f99f6c7c999a8f04353c7.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 21288e10f35fd98053254a8613f4725899a8fe7f4e8f99f6c7c999a8f04353c7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 21288e10f35fd98053254a8613f4725899a8fe7f4e8f99f6c7c999a8f04353c7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 21288e10f35fd98053254a8613f4725899a8fe7f4e8f99f6c7c999a8f04353c7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 21288e10f35fd98053254a8613f4725899a8fe7f4e8f99f6c7c999a8f04353c7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 21288e10f35fd98053254a8613f4725899a8fe7f4e8f99f6c7c999a8f04353c7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 21288e10f35fd98053254a8613f4725899a8fe7f4e8f99f6c7c999a8f04353c7.exe -
Processes:
resource yara_rule behavioral1/memory/548-55-0x0000000001E90000-0x0000000002F1E000-memory.dmp upx behavioral1/memory/548-57-0x0000000001E90000-0x0000000002F1E000-memory.dmp upx -
Processes:
21288e10f35fd98053254a8613f4725899a8fe7f4e8f99f6c7c999a8f04353c7.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 21288e10f35fd98053254a8613f4725899a8fe7f4e8f99f6c7c999a8f04353c7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 21288e10f35fd98053254a8613f4725899a8fe7f4e8f99f6c7c999a8f04353c7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 21288e10f35fd98053254a8613f4725899a8fe7f4e8f99f6c7c999a8f04353c7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 21288e10f35fd98053254a8613f4725899a8fe7f4e8f99f6c7c999a8f04353c7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 21288e10f35fd98053254a8613f4725899a8fe7f4e8f99f6c7c999a8f04353c7.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc 21288e10f35fd98053254a8613f4725899a8fe7f4e8f99f6c7c999a8f04353c7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 21288e10f35fd98053254a8613f4725899a8fe7f4e8f99f6c7c999a8f04353c7.exe -
Processes:
21288e10f35fd98053254a8613f4725899a8fe7f4e8f99f6c7c999a8f04353c7.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 21288e10f35fd98053254a8613f4725899a8fe7f4e8f99f6c7c999a8f04353c7.exe -
Drops file in Windows directory 1 IoCs
Processes:
21288e10f35fd98053254a8613f4725899a8fe7f4e8f99f6c7c999a8f04353c7.exedescription ioc process File opened for modification C:\Windows\SYSTEM.INI 21288e10f35fd98053254a8613f4725899a8fe7f4e8f99f6c7c999a8f04353c7.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
21288e10f35fd98053254a8613f4725899a8fe7f4e8f99f6c7c999a8f04353c7.exepid process 548 21288e10f35fd98053254a8613f4725899a8fe7f4e8f99f6c7c999a8f04353c7.exe -
Suspicious use of AdjustPrivilegeToken 20 IoCs
Processes:
21288e10f35fd98053254a8613f4725899a8fe7f4e8f99f6c7c999a8f04353c7.exedescription pid process Token: SeDebugPrivilege 548 21288e10f35fd98053254a8613f4725899a8fe7f4e8f99f6c7c999a8f04353c7.exe Token: SeDebugPrivilege 548 21288e10f35fd98053254a8613f4725899a8fe7f4e8f99f6c7c999a8f04353c7.exe Token: SeDebugPrivilege 548 21288e10f35fd98053254a8613f4725899a8fe7f4e8f99f6c7c999a8f04353c7.exe Token: SeDebugPrivilege 548 21288e10f35fd98053254a8613f4725899a8fe7f4e8f99f6c7c999a8f04353c7.exe Token: SeDebugPrivilege 548 21288e10f35fd98053254a8613f4725899a8fe7f4e8f99f6c7c999a8f04353c7.exe Token: SeDebugPrivilege 548 21288e10f35fd98053254a8613f4725899a8fe7f4e8f99f6c7c999a8f04353c7.exe Token: SeDebugPrivilege 548 21288e10f35fd98053254a8613f4725899a8fe7f4e8f99f6c7c999a8f04353c7.exe Token: SeDebugPrivilege 548 21288e10f35fd98053254a8613f4725899a8fe7f4e8f99f6c7c999a8f04353c7.exe Token: SeDebugPrivilege 548 21288e10f35fd98053254a8613f4725899a8fe7f4e8f99f6c7c999a8f04353c7.exe Token: SeDebugPrivilege 548 21288e10f35fd98053254a8613f4725899a8fe7f4e8f99f6c7c999a8f04353c7.exe Token: SeDebugPrivilege 548 21288e10f35fd98053254a8613f4725899a8fe7f4e8f99f6c7c999a8f04353c7.exe Token: SeDebugPrivilege 548 21288e10f35fd98053254a8613f4725899a8fe7f4e8f99f6c7c999a8f04353c7.exe Token: SeDebugPrivilege 548 21288e10f35fd98053254a8613f4725899a8fe7f4e8f99f6c7c999a8f04353c7.exe Token: SeDebugPrivilege 548 21288e10f35fd98053254a8613f4725899a8fe7f4e8f99f6c7c999a8f04353c7.exe Token: SeDebugPrivilege 548 21288e10f35fd98053254a8613f4725899a8fe7f4e8f99f6c7c999a8f04353c7.exe Token: SeDebugPrivilege 548 21288e10f35fd98053254a8613f4725899a8fe7f4e8f99f6c7c999a8f04353c7.exe Token: SeDebugPrivilege 548 21288e10f35fd98053254a8613f4725899a8fe7f4e8f99f6c7c999a8f04353c7.exe Token: SeDebugPrivilege 548 21288e10f35fd98053254a8613f4725899a8fe7f4e8f99f6c7c999a8f04353c7.exe Token: SeDebugPrivilege 548 21288e10f35fd98053254a8613f4725899a8fe7f4e8f99f6c7c999a8f04353c7.exe Token: SeDebugPrivilege 548 21288e10f35fd98053254a8613f4725899a8fe7f4e8f99f6c7c999a8f04353c7.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
21288e10f35fd98053254a8613f4725899a8fe7f4e8f99f6c7c999a8f04353c7.exedescription pid process target process PID 548 wrote to memory of 1104 548 21288e10f35fd98053254a8613f4725899a8fe7f4e8f99f6c7c999a8f04353c7.exe taskhost.exe PID 548 wrote to memory of 1180 548 21288e10f35fd98053254a8613f4725899a8fe7f4e8f99f6c7c999a8f04353c7.exe Dwm.exe PID 548 wrote to memory of 1212 548 21288e10f35fd98053254a8613f4725899a8fe7f4e8f99f6c7c999a8f04353c7.exe Explorer.EXE -
System policy modification 1 TTPs 1 IoCs
Processes:
21288e10f35fd98053254a8613f4725899a8fe7f4e8f99f6c7c999a8f04353c7.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 21288e10f35fd98053254a8613f4725899a8fe7f4e8f99f6c7c999a8f04353c7.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1104
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1180
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1212
-
C:\Users\Admin\AppData\Local\Temp\21288e10f35fd98053254a8613f4725899a8fe7f4e8f99f6c7c999a8f04353c7.exe"C:\Users\Admin\AppData\Local\Temp\21288e10f35fd98053254a8613f4725899a8fe7f4e8f99f6c7c999a8f04353c7.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:548
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/548-54-0x0000000076181000-0x0000000076183000-memory.dmpFilesize
8KB
-
memory/548-55-0x0000000001E90000-0x0000000002F1E000-memory.dmpFilesize
16.6MB
-
memory/548-56-0x0000000000400000-0x00000000004DB000-memory.dmpFilesize
876KB
-
memory/548-58-0x0000000000230000-0x0000000000232000-memory.dmpFilesize
8KB
-
memory/548-57-0x0000000001E90000-0x0000000002F1E000-memory.dmpFilesize
16.6MB