Analysis
-
max time kernel
44s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
01-07-2022 05:49
Static task
static1
Behavioral task
behavioral1
Sample
6782415b0e4cfb21a7656bb5d1844a6bddc93e6e134d6c58add8eae156cf2be5.exe
Resource
win7-20220414-en
General
-
Target
6782415b0e4cfb21a7656bb5d1844a6bddc93e6e134d6c58add8eae156cf2be5.exe
-
Size
266KB
-
MD5
4b34ea2ad4316f0f2986ea34b62dee76
-
SHA1
cb397bdd16f9dc7eae8a65c082227fe44c169d54
-
SHA256
6782415b0e4cfb21a7656bb5d1844a6bddc93e6e134d6c58add8eae156cf2be5
-
SHA512
86ab65947681dcc75c39070e4fdfa47b6c25f76b2b5154318397cf03738bb2bb7853e6693388b4af83fbc25d8cf45845df7761a174504d4a225996bded7dd2b9
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 2 TTPs 3 IoCs
Processes:
6782415b0e4cfb21a7656bb5d1844a6bddc93e6e134d6c58add8eae156cf2be5.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 6782415b0e4cfb21a7656bb5d1844a6bddc93e6e134d6c58add8eae156cf2be5.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 6782415b0e4cfb21a7656bb5d1844a6bddc93e6e134d6c58add8eae156cf2be5.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 6782415b0e4cfb21a7656bb5d1844a6bddc93e6e134d6c58add8eae156cf2be5.exe -
Processes:
6782415b0e4cfb21a7656bb5d1844a6bddc93e6e134d6c58add8eae156cf2be5.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 6782415b0e4cfb21a7656bb5d1844a6bddc93e6e134d6c58add8eae156cf2be5.exe -
Processes:
6782415b0e4cfb21a7656bb5d1844a6bddc93e6e134d6c58add8eae156cf2be5.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 6782415b0e4cfb21a7656bb5d1844a6bddc93e6e134d6c58add8eae156cf2be5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 6782415b0e4cfb21a7656bb5d1844a6bddc93e6e134d6c58add8eae156cf2be5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 6782415b0e4cfb21a7656bb5d1844a6bddc93e6e134d6c58add8eae156cf2be5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 6782415b0e4cfb21a7656bb5d1844a6bddc93e6e134d6c58add8eae156cf2be5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 6782415b0e4cfb21a7656bb5d1844a6bddc93e6e134d6c58add8eae156cf2be5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 6782415b0e4cfb21a7656bb5d1844a6bddc93e6e134d6c58add8eae156cf2be5.exe -
Processes:
resource yara_rule behavioral1/memory/1808-55-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/1808-57-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/1808-60-0x00000000006F0000-0x00000000017AA000-memory.dmp upx -
Processes:
6782415b0e4cfb21a7656bb5d1844a6bddc93e6e134d6c58add8eae156cf2be5.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 6782415b0e4cfb21a7656bb5d1844a6bddc93e6e134d6c58add8eae156cf2be5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 6782415b0e4cfb21a7656bb5d1844a6bddc93e6e134d6c58add8eae156cf2be5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 6782415b0e4cfb21a7656bb5d1844a6bddc93e6e134d6c58add8eae156cf2be5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 6782415b0e4cfb21a7656bb5d1844a6bddc93e6e134d6c58add8eae156cf2be5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 6782415b0e4cfb21a7656bb5d1844a6bddc93e6e134d6c58add8eae156cf2be5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 6782415b0e4cfb21a7656bb5d1844a6bddc93e6e134d6c58add8eae156cf2be5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc 6782415b0e4cfb21a7656bb5d1844a6bddc93e6e134d6c58add8eae156cf2be5.exe -
Processes:
6782415b0e4cfb21a7656bb5d1844a6bddc93e6e134d6c58add8eae156cf2be5.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 6782415b0e4cfb21a7656bb5d1844a6bddc93e6e134d6c58add8eae156cf2be5.exe -
Drops file in Windows directory 2 IoCs
Processes:
6782415b0e4cfb21a7656bb5d1844a6bddc93e6e134d6c58add8eae156cf2be5.exedescription ioc process File opened for modification C:\Windows\SYSTEM.INI 6782415b0e4cfb21a7656bb5d1844a6bddc93e6e134d6c58add8eae156cf2be5.exe File created C:\Windows\6c081c 6782415b0e4cfb21a7656bb5d1844a6bddc93e6e134d6c58add8eae156cf2be5.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
6782415b0e4cfb21a7656bb5d1844a6bddc93e6e134d6c58add8eae156cf2be5.exepid process 1808 6782415b0e4cfb21a7656bb5d1844a6bddc93e6e134d6c58add8eae156cf2be5.exe -
Suspicious use of AdjustPrivilegeToken 20 IoCs
Processes:
6782415b0e4cfb21a7656bb5d1844a6bddc93e6e134d6c58add8eae156cf2be5.exedescription pid process Token: SeDebugPrivilege 1808 6782415b0e4cfb21a7656bb5d1844a6bddc93e6e134d6c58add8eae156cf2be5.exe Token: SeDebugPrivilege 1808 6782415b0e4cfb21a7656bb5d1844a6bddc93e6e134d6c58add8eae156cf2be5.exe Token: SeDebugPrivilege 1808 6782415b0e4cfb21a7656bb5d1844a6bddc93e6e134d6c58add8eae156cf2be5.exe Token: SeDebugPrivilege 1808 6782415b0e4cfb21a7656bb5d1844a6bddc93e6e134d6c58add8eae156cf2be5.exe Token: SeDebugPrivilege 1808 6782415b0e4cfb21a7656bb5d1844a6bddc93e6e134d6c58add8eae156cf2be5.exe Token: SeDebugPrivilege 1808 6782415b0e4cfb21a7656bb5d1844a6bddc93e6e134d6c58add8eae156cf2be5.exe Token: SeDebugPrivilege 1808 6782415b0e4cfb21a7656bb5d1844a6bddc93e6e134d6c58add8eae156cf2be5.exe Token: SeDebugPrivilege 1808 6782415b0e4cfb21a7656bb5d1844a6bddc93e6e134d6c58add8eae156cf2be5.exe Token: SeDebugPrivilege 1808 6782415b0e4cfb21a7656bb5d1844a6bddc93e6e134d6c58add8eae156cf2be5.exe Token: SeDebugPrivilege 1808 6782415b0e4cfb21a7656bb5d1844a6bddc93e6e134d6c58add8eae156cf2be5.exe Token: SeDebugPrivilege 1808 6782415b0e4cfb21a7656bb5d1844a6bddc93e6e134d6c58add8eae156cf2be5.exe Token: SeDebugPrivilege 1808 6782415b0e4cfb21a7656bb5d1844a6bddc93e6e134d6c58add8eae156cf2be5.exe Token: SeDebugPrivilege 1808 6782415b0e4cfb21a7656bb5d1844a6bddc93e6e134d6c58add8eae156cf2be5.exe Token: SeDebugPrivilege 1808 6782415b0e4cfb21a7656bb5d1844a6bddc93e6e134d6c58add8eae156cf2be5.exe Token: SeDebugPrivilege 1808 6782415b0e4cfb21a7656bb5d1844a6bddc93e6e134d6c58add8eae156cf2be5.exe Token: SeDebugPrivilege 1808 6782415b0e4cfb21a7656bb5d1844a6bddc93e6e134d6c58add8eae156cf2be5.exe Token: SeDebugPrivilege 1808 6782415b0e4cfb21a7656bb5d1844a6bddc93e6e134d6c58add8eae156cf2be5.exe Token: SeDebugPrivilege 1808 6782415b0e4cfb21a7656bb5d1844a6bddc93e6e134d6c58add8eae156cf2be5.exe Token: SeDebugPrivilege 1808 6782415b0e4cfb21a7656bb5d1844a6bddc93e6e134d6c58add8eae156cf2be5.exe Token: SeDebugPrivilege 1808 6782415b0e4cfb21a7656bb5d1844a6bddc93e6e134d6c58add8eae156cf2be5.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
6782415b0e4cfb21a7656bb5d1844a6bddc93e6e134d6c58add8eae156cf2be5.exedescription pid process target process PID 1808 wrote to memory of 1112 1808 6782415b0e4cfb21a7656bb5d1844a6bddc93e6e134d6c58add8eae156cf2be5.exe taskhost.exe PID 1808 wrote to memory of 1164 1808 6782415b0e4cfb21a7656bb5d1844a6bddc93e6e134d6c58add8eae156cf2be5.exe Dwm.exe PID 1808 wrote to memory of 1204 1808 6782415b0e4cfb21a7656bb5d1844a6bddc93e6e134d6c58add8eae156cf2be5.exe Explorer.EXE -
System policy modification 1 TTPs 1 IoCs
Processes:
6782415b0e4cfb21a7656bb5d1844a6bddc93e6e134d6c58add8eae156cf2be5.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 6782415b0e4cfb21a7656bb5d1844a6bddc93e6e134d6c58add8eae156cf2be5.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\6782415b0e4cfb21a7656bb5d1844a6bddc93e6e134d6c58add8eae156cf2be5.exe"C:\Users\Admin\AppData\Local\Temp\6782415b0e4cfb21a7656bb5d1844a6bddc93e6e134d6c58add8eae156cf2be5.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1808-54-0x0000000075BD1000-0x0000000075BD3000-memory.dmpFilesize
8KB
-
memory/1808-55-0x00000000006F0000-0x00000000017AA000-memory.dmpFilesize
16.7MB
-
memory/1808-56-0x0000000000400000-0x0000000000444000-memory.dmpFilesize
272KB
-
memory/1808-57-0x00000000006F0000-0x00000000017AA000-memory.dmpFilesize
16.7MB
-
memory/1808-58-0x00000000004D0000-0x00000000004D2000-memory.dmpFilesize
8KB
-
memory/1808-59-0x0000000000400000-0x0000000000444000-memory.dmpFilesize
272KB
-
memory/1808-60-0x00000000006F0000-0x00000000017AA000-memory.dmpFilesize
16.7MB