Analysis
-
max time kernel
41s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220414-en -
resource tags
arch:x64arch:x86image:win7-20220414-enlocale:en-usos:windows7-x64system -
submitted
16-07-2022 07:58
Static task
static1
Behavioral task
behavioral1
Sample
virussign.dll
Resource
win7-20220414-en
General
-
Target
virussign.dll
-
Size
120KB
-
MD5
981c8a2357a000371a465746daf3a340
-
SHA1
ed2872a3df64db6859d15ec30382156aa203015f
-
SHA256
449463aa2edcc35b3f5db7cbae40b09aac5ec12ee65d1c0f89c8628b5bd868e1
-
SHA512
434b7c87cbf9b62bdd0f7f942fda10c74ce9c62eb5d64fd3847958749d2ac94670737205212ccfc3f86d018d879916177072bbf03f51170fa9d0bd5209e1bded
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 2 TTPs 3 IoCs
Processes:
6bf72c.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 6bf72c.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 6bf72c.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 6bf72c.exe -
Processes:
6bf72c.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 6bf72c.exe -
Processes:
6bf72c.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 6bf72c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 6bf72c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 6bf72c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 6bf72c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 6bf72c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 6bf72c.exe -
Executes dropped EXE 3 IoCs
Processes:
6bf72c.exe6bf98c.exe6c10c4.exepid process 1128 6bf72c.exe 1608 6bf98c.exe 268 6c10c4.exe -
Processes:
resource yara_rule behavioral1/memory/1128-61-0x0000000000680000-0x000000000173A000-memory.dmp upx behavioral1/memory/1128-69-0x0000000000680000-0x000000000173A000-memory.dmp upx behavioral1/memory/1128-83-0x0000000000680000-0x000000000173A000-memory.dmp upx behavioral1/memory/1128-85-0x0000000000680000-0x000000000173A000-memory.dmp upx behavioral1/memory/1608-87-0x0000000000910000-0x00000000019CA000-memory.dmp upx behavioral1/memory/268-90-0x00000000009A0000-0x0000000001A5A000-memory.dmp upx -
Loads dropped DLL 6 IoCs
Processes:
rundll32.exepid process 864 rundll32.exe 864 rundll32.exe 864 rundll32.exe 864 rundll32.exe 864 rundll32.exe 864 rundll32.exe -
Processes:
6bf72c.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc 6bf72c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 6bf72c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 6bf72c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 6bf72c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 6bf72c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 6bf72c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 6bf72c.exe -
Processes:
6bf72c.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 6bf72c.exe -
Enumerates connected drives 3 TTPs 8 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
6bf72c.exedescription ioc process File opened (read-only) \??\L: 6bf72c.exe File opened (read-only) \??\E: 6bf72c.exe File opened (read-only) \??\F: 6bf72c.exe File opened (read-only) \??\G: 6bf72c.exe File opened (read-only) \??\H: 6bf72c.exe File opened (read-only) \??\I: 6bf72c.exe File opened (read-only) \??\J: 6bf72c.exe File opened (read-only) \??\K: 6bf72c.exe -
Drops file in Windows directory 2 IoCs
Processes:
6bf72c.exedescription ioc process File opened for modification C:\Windows\SYSTEM.INI 6bf72c.exe File created C:\Windows\6bf90f 6bf72c.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
6bf72c.exepid process 1128 6bf72c.exe 1128 6bf72c.exe -
Suspicious use of AdjustPrivilegeToken 21 IoCs
Processes:
6bf72c.exedescription pid process Token: SeDebugPrivilege 1128 6bf72c.exe Token: SeDebugPrivilege 1128 6bf72c.exe Token: SeDebugPrivilege 1128 6bf72c.exe Token: SeDebugPrivilege 1128 6bf72c.exe Token: SeDebugPrivilege 1128 6bf72c.exe Token: SeDebugPrivilege 1128 6bf72c.exe Token: SeDebugPrivilege 1128 6bf72c.exe Token: SeDebugPrivilege 1128 6bf72c.exe Token: SeDebugPrivilege 1128 6bf72c.exe Token: SeDebugPrivilege 1128 6bf72c.exe Token: SeDebugPrivilege 1128 6bf72c.exe Token: SeDebugPrivilege 1128 6bf72c.exe Token: SeDebugPrivilege 1128 6bf72c.exe Token: SeDebugPrivilege 1128 6bf72c.exe Token: SeDebugPrivilege 1128 6bf72c.exe Token: SeDebugPrivilege 1128 6bf72c.exe Token: SeDebugPrivilege 1128 6bf72c.exe Token: SeDebugPrivilege 1128 6bf72c.exe Token: SeDebugPrivilege 1128 6bf72c.exe Token: SeDebugPrivilege 1128 6bf72c.exe Token: SeDebugPrivilege 1128 6bf72c.exe -
Suspicious use of WriteProcessMemory 32 IoCs
Processes:
rundll32.exerundll32.exe6bf72c.exedescription pid process target process PID 2024 wrote to memory of 864 2024 rundll32.exe rundll32.exe PID 2024 wrote to memory of 864 2024 rundll32.exe rundll32.exe PID 2024 wrote to memory of 864 2024 rundll32.exe rundll32.exe PID 2024 wrote to memory of 864 2024 rundll32.exe rundll32.exe PID 2024 wrote to memory of 864 2024 rundll32.exe rundll32.exe PID 2024 wrote to memory of 864 2024 rundll32.exe rundll32.exe PID 2024 wrote to memory of 864 2024 rundll32.exe rundll32.exe PID 864 wrote to memory of 1128 864 rundll32.exe 6bf72c.exe PID 864 wrote to memory of 1128 864 rundll32.exe 6bf72c.exe PID 864 wrote to memory of 1128 864 rundll32.exe 6bf72c.exe PID 864 wrote to memory of 1128 864 rundll32.exe 6bf72c.exe PID 1128 wrote to memory of 1112 1128 6bf72c.exe taskhost.exe PID 1128 wrote to memory of 1168 1128 6bf72c.exe Dwm.exe PID 1128 wrote to memory of 1200 1128 6bf72c.exe Explorer.EXE PID 1128 wrote to memory of 2024 1128 6bf72c.exe rundll32.exe PID 1128 wrote to memory of 864 1128 6bf72c.exe rundll32.exe PID 1128 wrote to memory of 864 1128 6bf72c.exe rundll32.exe PID 864 wrote to memory of 1608 864 rundll32.exe 6bf98c.exe PID 864 wrote to memory of 1608 864 rundll32.exe 6bf98c.exe PID 864 wrote to memory of 1608 864 rundll32.exe 6bf98c.exe PID 864 wrote to memory of 1608 864 rundll32.exe 6bf98c.exe PID 864 wrote to memory of 268 864 rundll32.exe 6c10c4.exe PID 864 wrote to memory of 268 864 rundll32.exe 6c10c4.exe PID 864 wrote to memory of 268 864 rundll32.exe 6c10c4.exe PID 864 wrote to memory of 268 864 rundll32.exe 6c10c4.exe PID 1128 wrote to memory of 1112 1128 6bf72c.exe taskhost.exe PID 1128 wrote to memory of 1168 1128 6bf72c.exe Dwm.exe PID 1128 wrote to memory of 1200 1128 6bf72c.exe Explorer.EXE PID 1128 wrote to memory of 1608 1128 6bf72c.exe 6bf98c.exe PID 1128 wrote to memory of 1608 1128 6bf72c.exe 6bf98c.exe PID 1128 wrote to memory of 268 1128 6bf72c.exe 6c10c4.exe PID 1128 wrote to memory of 268 1128 6bf72c.exe 6c10c4.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
6bf72c.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 6bf72c.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\virussign.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\virussign.dll,#13⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\6bf72c.exeC:\Users\Admin\AppData\Local\Temp\6bf72c.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\6bf98c.exeC:\Users\Admin\AppData\Local\Temp\6bf98c.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\6c10c4.exeC:\Users\Admin\AppData\Local\Temp\6c10c4.exe4⤵
- Executes dropped EXE
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\6bf72c.exeFilesize
97KB
MD53a00289a3ffdf63aa62b52e411ffd3a5
SHA16722ba636ab432bd8597fdd2f61599bd97c65aa5
SHA2566fc0a47ae77064fb7d210db67785ad1d26802e5280622cf5fd21febfe92cc75f
SHA512bd729500e4d0ae732294c784b047f3849b899ff14ed089a97954b9a970dba2d2d4ba2aaa5e4c7c36f9bec229f61dc5c28cd36b81adfb9fdbe24b99d486a1f516
-
C:\Users\Admin\AppData\Local\Temp\6bf98c.exeFilesize
97KB
MD53a00289a3ffdf63aa62b52e411ffd3a5
SHA16722ba636ab432bd8597fdd2f61599bd97c65aa5
SHA2566fc0a47ae77064fb7d210db67785ad1d26802e5280622cf5fd21febfe92cc75f
SHA512bd729500e4d0ae732294c784b047f3849b899ff14ed089a97954b9a970dba2d2d4ba2aaa5e4c7c36f9bec229f61dc5c28cd36b81adfb9fdbe24b99d486a1f516
-
C:\Users\Admin\AppData\Local\Temp\6c10c4.exeFilesize
97KB
MD53a00289a3ffdf63aa62b52e411ffd3a5
SHA16722ba636ab432bd8597fdd2f61599bd97c65aa5
SHA2566fc0a47ae77064fb7d210db67785ad1d26802e5280622cf5fd21febfe92cc75f
SHA512bd729500e4d0ae732294c784b047f3849b899ff14ed089a97954b9a970dba2d2d4ba2aaa5e4c7c36f9bec229f61dc5c28cd36b81adfb9fdbe24b99d486a1f516
-
\Users\Admin\AppData\Local\Temp\6bf72c.exeFilesize
97KB
MD53a00289a3ffdf63aa62b52e411ffd3a5
SHA16722ba636ab432bd8597fdd2f61599bd97c65aa5
SHA2566fc0a47ae77064fb7d210db67785ad1d26802e5280622cf5fd21febfe92cc75f
SHA512bd729500e4d0ae732294c784b047f3849b899ff14ed089a97954b9a970dba2d2d4ba2aaa5e4c7c36f9bec229f61dc5c28cd36b81adfb9fdbe24b99d486a1f516
-
\Users\Admin\AppData\Local\Temp\6bf72c.exeFilesize
97KB
MD53a00289a3ffdf63aa62b52e411ffd3a5
SHA16722ba636ab432bd8597fdd2f61599bd97c65aa5
SHA2566fc0a47ae77064fb7d210db67785ad1d26802e5280622cf5fd21febfe92cc75f
SHA512bd729500e4d0ae732294c784b047f3849b899ff14ed089a97954b9a970dba2d2d4ba2aaa5e4c7c36f9bec229f61dc5c28cd36b81adfb9fdbe24b99d486a1f516
-
\Users\Admin\AppData\Local\Temp\6bf98c.exeFilesize
97KB
MD53a00289a3ffdf63aa62b52e411ffd3a5
SHA16722ba636ab432bd8597fdd2f61599bd97c65aa5
SHA2566fc0a47ae77064fb7d210db67785ad1d26802e5280622cf5fd21febfe92cc75f
SHA512bd729500e4d0ae732294c784b047f3849b899ff14ed089a97954b9a970dba2d2d4ba2aaa5e4c7c36f9bec229f61dc5c28cd36b81adfb9fdbe24b99d486a1f516
-
\Users\Admin\AppData\Local\Temp\6bf98c.exeFilesize
97KB
MD53a00289a3ffdf63aa62b52e411ffd3a5
SHA16722ba636ab432bd8597fdd2f61599bd97c65aa5
SHA2566fc0a47ae77064fb7d210db67785ad1d26802e5280622cf5fd21febfe92cc75f
SHA512bd729500e4d0ae732294c784b047f3849b899ff14ed089a97954b9a970dba2d2d4ba2aaa5e4c7c36f9bec229f61dc5c28cd36b81adfb9fdbe24b99d486a1f516
-
\Users\Admin\AppData\Local\Temp\6c10c4.exeFilesize
97KB
MD53a00289a3ffdf63aa62b52e411ffd3a5
SHA16722ba636ab432bd8597fdd2f61599bd97c65aa5
SHA2566fc0a47ae77064fb7d210db67785ad1d26802e5280622cf5fd21febfe92cc75f
SHA512bd729500e4d0ae732294c784b047f3849b899ff14ed089a97954b9a970dba2d2d4ba2aaa5e4c7c36f9bec229f61dc5c28cd36b81adfb9fdbe24b99d486a1f516
-
\Users\Admin\AppData\Local\Temp\6c10c4.exeFilesize
97KB
MD53a00289a3ffdf63aa62b52e411ffd3a5
SHA16722ba636ab432bd8597fdd2f61599bd97c65aa5
SHA2566fc0a47ae77064fb7d210db67785ad1d26802e5280622cf5fd21febfe92cc75f
SHA512bd729500e4d0ae732294c784b047f3849b899ff14ed089a97954b9a970dba2d2d4ba2aaa5e4c7c36f9bec229f61dc5c28cd36b81adfb9fdbe24b99d486a1f516
-
memory/268-81-0x0000000000260000-0x0000000000262000-memory.dmpFilesize
8KB
-
memory/268-76-0x0000000000000000-mapping.dmp
-
memory/268-79-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/268-90-0x00000000009A0000-0x0000000001A5A000-memory.dmpFilesize
16.7MB
-
memory/268-91-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/864-71-0x00000000003B0000-0x00000000003C2000-memory.dmpFilesize
72KB
-
memory/864-63-0x00000000000B0000-0x00000000000C2000-memory.dmpFilesize
72KB
-
memory/864-54-0x0000000000000000-mapping.dmp
-
memory/864-55-0x0000000075B71000-0x0000000075B73000-memory.dmpFilesize
8KB
-
memory/864-73-0x00000000001A0000-0x00000000001A2000-memory.dmpFilesize
8KB
-
memory/864-62-0x0000000010000000-0x0000000010020000-memory.dmpFilesize
128KB
-
memory/864-78-0x00000000000B0000-0x00000000000B6000-memory.dmpFilesize
24KB
-
memory/1128-85-0x0000000000680000-0x000000000173A000-memory.dmpFilesize
16.7MB
-
memory/1128-83-0x0000000000680000-0x000000000173A000-memory.dmpFilesize
16.7MB
-
memory/1128-64-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1128-69-0x0000000000680000-0x000000000173A000-memory.dmpFilesize
16.7MB
-
memory/1128-61-0x0000000000680000-0x000000000173A000-memory.dmpFilesize
16.7MB
-
memory/1128-80-0x00000000003F0000-0x00000000003F2000-memory.dmpFilesize
8KB
-
memory/1128-58-0x0000000000000000-mapping.dmp
-
memory/1128-70-0x00000000002F0000-0x00000000002F2000-memory.dmpFilesize
8KB
-
memory/1128-84-0x00000000002F0000-0x00000000002F2000-memory.dmpFilesize
8KB
-
memory/1608-67-0x0000000000000000-mapping.dmp
-
memory/1608-87-0x0000000000910000-0x00000000019CA000-memory.dmpFilesize
16.7MB
-
memory/1608-88-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1608-82-0x00000000001F0000-0x00000000001F2000-memory.dmpFilesize
8KB
-
memory/1608-72-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB