Analysis
-
max time kernel
147s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20220715-en -
resource tags
arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system -
submitted
02-08-2022 21:23
Static task
static1
Behavioral task
behavioral1
Sample
b0b0b8c1e356acced8ae97b9fd448932.exe
Resource
win7-20220715-en
General
-
Target
b0b0b8c1e356acced8ae97b9fd448932.exe
-
Size
131KB
-
MD5
b0b0b8c1e356acced8ae97b9fd448932
-
SHA1
b6b9c6f0bb858e5899e7cea98f7f43940b0235df
-
SHA256
232f83fad3deda8644c603c068c057d8a163698efedc2c13651eebb46215375a
-
SHA512
8914e78ea7ccb0ebff3367e69345a496e14637e54c436885559d2f7cd6a26e608202161aadfb69317f764bb00a6b6f14391935e1450f818edfcd0152509d9f6b
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 2 TTPs 3 IoCs
Processes:
b0b0b8c1e356acced8ae97b9fd448932.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" b0b0b8c1e356acced8ae97b9fd448932.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" b0b0b8c1e356acced8ae97b9fd448932.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" b0b0b8c1e356acced8ae97b9fd448932.exe -
Processes:
b0b0b8c1e356acced8ae97b9fd448932.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" b0b0b8c1e356acced8ae97b9fd448932.exe -
Processes:
b0b0b8c1e356acced8ae97b9fd448932.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" b0b0b8c1e356acced8ae97b9fd448932.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" b0b0b8c1e356acced8ae97b9fd448932.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" b0b0b8c1e356acced8ae97b9fd448932.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" b0b0b8c1e356acced8ae97b9fd448932.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" b0b0b8c1e356acced8ae97b9fd448932.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" b0b0b8c1e356acced8ae97b9fd448932.exe -
Processes:
resource yara_rule behavioral1/memory/2012-55-0x0000000001D80000-0x0000000002E3A000-memory.dmp upx behavioral1/memory/2012-57-0x0000000001D80000-0x0000000002E3A000-memory.dmp upx behavioral1/memory/2012-60-0x0000000001D80000-0x0000000002E3A000-memory.dmp upx -
Processes:
b0b0b8c1e356acced8ae97b9fd448932.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" b0b0b8c1e356acced8ae97b9fd448932.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" b0b0b8c1e356acced8ae97b9fd448932.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" b0b0b8c1e356acced8ae97b9fd448932.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" b0b0b8c1e356acced8ae97b9fd448932.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" b0b0b8c1e356acced8ae97b9fd448932.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc b0b0b8c1e356acced8ae97b9fd448932.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" b0b0b8c1e356acced8ae97b9fd448932.exe -
Processes:
b0b0b8c1e356acced8ae97b9fd448932.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" b0b0b8c1e356acced8ae97b9fd448932.exe -
Drops file in Windows directory 2 IoCs
Processes:
b0b0b8c1e356acced8ae97b9fd448932.exedescription ioc process File opened for modification C:\Windows\SYSTEM.INI b0b0b8c1e356acced8ae97b9fd448932.exe File created C:\Windows\6c6356 b0b0b8c1e356acced8ae97b9fd448932.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
b0b0b8c1e356acced8ae97b9fd448932.exepid process 2012 b0b0b8c1e356acced8ae97b9fd448932.exe 2012 b0b0b8c1e356acced8ae97b9fd448932.exe 2012 b0b0b8c1e356acced8ae97b9fd448932.exe 2012 b0b0b8c1e356acced8ae97b9fd448932.exe 2012 b0b0b8c1e356acced8ae97b9fd448932.exe 2012 b0b0b8c1e356acced8ae97b9fd448932.exe 2012 b0b0b8c1e356acced8ae97b9fd448932.exe 2012 b0b0b8c1e356acced8ae97b9fd448932.exe 2012 b0b0b8c1e356acced8ae97b9fd448932.exe 2012 b0b0b8c1e356acced8ae97b9fd448932.exe 2012 b0b0b8c1e356acced8ae97b9fd448932.exe 2012 b0b0b8c1e356acced8ae97b9fd448932.exe 2012 b0b0b8c1e356acced8ae97b9fd448932.exe 2012 b0b0b8c1e356acced8ae97b9fd448932.exe -
Suspicious use of AdjustPrivilegeToken 19 IoCs
Processes:
b0b0b8c1e356acced8ae97b9fd448932.exedescription pid process Token: SeDebugPrivilege 2012 b0b0b8c1e356acced8ae97b9fd448932.exe Token: SeDebugPrivilege 2012 b0b0b8c1e356acced8ae97b9fd448932.exe Token: SeDebugPrivilege 2012 b0b0b8c1e356acced8ae97b9fd448932.exe Token: SeDebugPrivilege 2012 b0b0b8c1e356acced8ae97b9fd448932.exe Token: SeDebugPrivilege 2012 b0b0b8c1e356acced8ae97b9fd448932.exe Token: SeDebugPrivilege 2012 b0b0b8c1e356acced8ae97b9fd448932.exe Token: SeDebugPrivilege 2012 b0b0b8c1e356acced8ae97b9fd448932.exe Token: SeDebugPrivilege 2012 b0b0b8c1e356acced8ae97b9fd448932.exe Token: SeDebugPrivilege 2012 b0b0b8c1e356acced8ae97b9fd448932.exe Token: SeDebugPrivilege 2012 b0b0b8c1e356acced8ae97b9fd448932.exe Token: SeDebugPrivilege 2012 b0b0b8c1e356acced8ae97b9fd448932.exe Token: SeDebugPrivilege 2012 b0b0b8c1e356acced8ae97b9fd448932.exe Token: SeDebugPrivilege 2012 b0b0b8c1e356acced8ae97b9fd448932.exe Token: SeDebugPrivilege 2012 b0b0b8c1e356acced8ae97b9fd448932.exe Token: SeDebugPrivilege 2012 b0b0b8c1e356acced8ae97b9fd448932.exe Token: SeDebugPrivilege 2012 b0b0b8c1e356acced8ae97b9fd448932.exe Token: SeDebugPrivilege 2012 b0b0b8c1e356acced8ae97b9fd448932.exe Token: SeDebugPrivilege 2012 b0b0b8c1e356acced8ae97b9fd448932.exe Token: SeDebugPrivilege 2012 b0b0b8c1e356acced8ae97b9fd448932.exe -
Suspicious use of WriteProcessMemory 57 IoCs
Processes:
b0b0b8c1e356acced8ae97b9fd448932.exedescription pid process target process PID 2012 wrote to memory of 1252 2012 b0b0b8c1e356acced8ae97b9fd448932.exe taskhost.exe PID 2012 wrote to memory of 1344 2012 b0b0b8c1e356acced8ae97b9fd448932.exe Dwm.exe PID 2012 wrote to memory of 1412 2012 b0b0b8c1e356acced8ae97b9fd448932.exe Explorer.EXE PID 2012 wrote to memory of 1252 2012 b0b0b8c1e356acced8ae97b9fd448932.exe taskhost.exe PID 2012 wrote to memory of 1344 2012 b0b0b8c1e356acced8ae97b9fd448932.exe Dwm.exe PID 2012 wrote to memory of 1412 2012 b0b0b8c1e356acced8ae97b9fd448932.exe Explorer.EXE PID 2012 wrote to memory of 1388 2012 b0b0b8c1e356acced8ae97b9fd448932.exe DllHost.exe PID 2012 wrote to memory of 1068 2012 b0b0b8c1e356acced8ae97b9fd448932.exe DllHost.exe PID 2012 wrote to memory of 1252 2012 b0b0b8c1e356acced8ae97b9fd448932.exe taskhost.exe PID 2012 wrote to memory of 1344 2012 b0b0b8c1e356acced8ae97b9fd448932.exe Dwm.exe PID 2012 wrote to memory of 1412 2012 b0b0b8c1e356acced8ae97b9fd448932.exe Explorer.EXE PID 2012 wrote to memory of 1388 2012 b0b0b8c1e356acced8ae97b9fd448932.exe DllHost.exe PID 2012 wrote to memory of 1252 2012 b0b0b8c1e356acced8ae97b9fd448932.exe taskhost.exe PID 2012 wrote to memory of 1344 2012 b0b0b8c1e356acced8ae97b9fd448932.exe Dwm.exe PID 2012 wrote to memory of 1412 2012 b0b0b8c1e356acced8ae97b9fd448932.exe Explorer.EXE PID 2012 wrote to memory of 1388 2012 b0b0b8c1e356acced8ae97b9fd448932.exe DllHost.exe PID 2012 wrote to memory of 1252 2012 b0b0b8c1e356acced8ae97b9fd448932.exe taskhost.exe PID 2012 wrote to memory of 1344 2012 b0b0b8c1e356acced8ae97b9fd448932.exe Dwm.exe PID 2012 wrote to memory of 1412 2012 b0b0b8c1e356acced8ae97b9fd448932.exe Explorer.EXE PID 2012 wrote to memory of 1388 2012 b0b0b8c1e356acced8ae97b9fd448932.exe DllHost.exe PID 2012 wrote to memory of 1252 2012 b0b0b8c1e356acced8ae97b9fd448932.exe taskhost.exe PID 2012 wrote to memory of 1344 2012 b0b0b8c1e356acced8ae97b9fd448932.exe Dwm.exe PID 2012 wrote to memory of 1412 2012 b0b0b8c1e356acced8ae97b9fd448932.exe Explorer.EXE PID 2012 wrote to memory of 1388 2012 b0b0b8c1e356acced8ae97b9fd448932.exe DllHost.exe PID 2012 wrote to memory of 1252 2012 b0b0b8c1e356acced8ae97b9fd448932.exe taskhost.exe PID 2012 wrote to memory of 1344 2012 b0b0b8c1e356acced8ae97b9fd448932.exe Dwm.exe PID 2012 wrote to memory of 1412 2012 b0b0b8c1e356acced8ae97b9fd448932.exe Explorer.EXE PID 2012 wrote to memory of 1388 2012 b0b0b8c1e356acced8ae97b9fd448932.exe DllHost.exe PID 2012 wrote to memory of 1252 2012 b0b0b8c1e356acced8ae97b9fd448932.exe taskhost.exe PID 2012 wrote to memory of 1344 2012 b0b0b8c1e356acced8ae97b9fd448932.exe Dwm.exe PID 2012 wrote to memory of 1412 2012 b0b0b8c1e356acced8ae97b9fd448932.exe Explorer.EXE PID 2012 wrote to memory of 1388 2012 b0b0b8c1e356acced8ae97b9fd448932.exe DllHost.exe PID 2012 wrote to memory of 1252 2012 b0b0b8c1e356acced8ae97b9fd448932.exe taskhost.exe PID 2012 wrote to memory of 1344 2012 b0b0b8c1e356acced8ae97b9fd448932.exe Dwm.exe PID 2012 wrote to memory of 1412 2012 b0b0b8c1e356acced8ae97b9fd448932.exe Explorer.EXE PID 2012 wrote to memory of 1388 2012 b0b0b8c1e356acced8ae97b9fd448932.exe DllHost.exe PID 2012 wrote to memory of 1252 2012 b0b0b8c1e356acced8ae97b9fd448932.exe taskhost.exe PID 2012 wrote to memory of 1344 2012 b0b0b8c1e356acced8ae97b9fd448932.exe Dwm.exe PID 2012 wrote to memory of 1412 2012 b0b0b8c1e356acced8ae97b9fd448932.exe Explorer.EXE PID 2012 wrote to memory of 1388 2012 b0b0b8c1e356acced8ae97b9fd448932.exe DllHost.exe PID 2012 wrote to memory of 1804 2012 b0b0b8c1e356acced8ae97b9fd448932.exe DllHost.exe PID 2012 wrote to memory of 1252 2012 b0b0b8c1e356acced8ae97b9fd448932.exe taskhost.exe PID 2012 wrote to memory of 1344 2012 b0b0b8c1e356acced8ae97b9fd448932.exe Dwm.exe PID 2012 wrote to memory of 1412 2012 b0b0b8c1e356acced8ae97b9fd448932.exe Explorer.EXE PID 2012 wrote to memory of 1388 2012 b0b0b8c1e356acced8ae97b9fd448932.exe DllHost.exe PID 2012 wrote to memory of 1252 2012 b0b0b8c1e356acced8ae97b9fd448932.exe taskhost.exe PID 2012 wrote to memory of 1344 2012 b0b0b8c1e356acced8ae97b9fd448932.exe Dwm.exe PID 2012 wrote to memory of 1412 2012 b0b0b8c1e356acced8ae97b9fd448932.exe Explorer.EXE PID 2012 wrote to memory of 1388 2012 b0b0b8c1e356acced8ae97b9fd448932.exe DllHost.exe PID 2012 wrote to memory of 1252 2012 b0b0b8c1e356acced8ae97b9fd448932.exe taskhost.exe PID 2012 wrote to memory of 1344 2012 b0b0b8c1e356acced8ae97b9fd448932.exe Dwm.exe PID 2012 wrote to memory of 1412 2012 b0b0b8c1e356acced8ae97b9fd448932.exe Explorer.EXE PID 2012 wrote to memory of 1388 2012 b0b0b8c1e356acced8ae97b9fd448932.exe DllHost.exe PID 2012 wrote to memory of 1252 2012 b0b0b8c1e356acced8ae97b9fd448932.exe taskhost.exe PID 2012 wrote to memory of 1344 2012 b0b0b8c1e356acced8ae97b9fd448932.exe Dwm.exe PID 2012 wrote to memory of 1412 2012 b0b0b8c1e356acced8ae97b9fd448932.exe Explorer.EXE PID 2012 wrote to memory of 1388 2012 b0b0b8c1e356acced8ae97b9fd448932.exe DllHost.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
b0b0b8c1e356acced8ae97b9fd448932.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" b0b0b8c1e356acced8ae97b9fd448932.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\b0b0b8c1e356acced8ae97b9fd448932.exe"C:\Users\Admin\AppData\Local\Temp\b0b0b8c1e356acced8ae97b9fd448932.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2012-54-0x0000000076601000-0x0000000076603000-memory.dmpFilesize
8KB
-
memory/2012-55-0x0000000001D80000-0x0000000002E3A000-memory.dmpFilesize
16.7MB
-
memory/2012-56-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/2012-57-0x0000000001D80000-0x0000000002E3A000-memory.dmpFilesize
16.7MB
-
memory/2012-58-0x00000000003F0000-0x00000000003F2000-memory.dmpFilesize
8KB
-
memory/2012-59-0x0000000004D40000-0x0000000004D75000-memory.dmpFilesize
212KB
-
memory/2012-60-0x0000000001D80000-0x0000000002E3A000-memory.dmpFilesize
16.7MB
-
memory/2012-61-0x00000000003F0000-0x00000000003F2000-memory.dmpFilesize
8KB
-
memory/2012-62-0x0000000004D40000-0x0000000004D75000-memory.dmpFilesize
212KB
-
memory/2012-63-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB