Analysis
-
max time kernel
40s -
max time network
44s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
30-08-2022 19:18
Static task
static1
Behavioral task
behavioral1
Sample
7c9631139b712117c2cc98fb6745090a.exe
Resource
win7-20220812-en
General
-
Target
7c9631139b712117c2cc98fb6745090a.exe
-
Size
356KB
-
MD5
7c9631139b712117c2cc98fb6745090a
-
SHA1
d367b5882d96175da554aa5a4316bedebdc2b826
-
SHA256
38a3b96704a888a2c08de10c875b8f07cbc5dd4c37048b4870aa617aa0d98401
-
SHA512
d7dec610cb45869cdec94cc3893634e42e0763c1abb8802536323e150b06f8a6d32f0a6b637abc1c90579c18ce7b65c87380886a5adf83289e7d5add2d56bee2
-
SSDEEP
6144:EyH7xOc6H5c6HcT66vlml/SI01Jq3ggxDDwCkTTgPfV7mkcUPf5korLP+zz9Burg:EagCkD19FcUPRk6Wz9ErXI5
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 2 TTPs 3 IoCs
Processes:
7c9631139b712117c2cc98fb6745090a.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 7c9631139b712117c2cc98fb6745090a.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 7c9631139b712117c2cc98fb6745090a.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 7c9631139b712117c2cc98fb6745090a.exe -
Processes:
7c9631139b712117c2cc98fb6745090a.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 7c9631139b712117c2cc98fb6745090a.exe -
Processes:
7c9631139b712117c2cc98fb6745090a.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 7c9631139b712117c2cc98fb6745090a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 7c9631139b712117c2cc98fb6745090a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 7c9631139b712117c2cc98fb6745090a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 7c9631139b712117c2cc98fb6745090a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 7c9631139b712117c2cc98fb6745090a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 7c9631139b712117c2cc98fb6745090a.exe -
Executes dropped EXE 3 IoCs
Processes:
svchost.exe7c9631139b712117c2cc98fb6745090a.exesvchost.exepid process 912 svchost.exe 1204 7c9631139b712117c2cc98fb6745090a.exe 2000 svchost.exe -
Processes:
resource yara_rule behavioral1/memory/1204-61-0x0000000001DA0000-0x0000000002E5A000-memory.dmp upx behavioral1/memory/1204-64-0x0000000001DA0000-0x0000000002E5A000-memory.dmp upx -
Loads dropped DLL 1 IoCs
Processes:
svchost.exepid process 912 svchost.exe -
Processes:
7c9631139b712117c2cc98fb6745090a.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc 7c9631139b712117c2cc98fb6745090a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 7c9631139b712117c2cc98fb6745090a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 7c9631139b712117c2cc98fb6745090a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 7c9631139b712117c2cc98fb6745090a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 7c9631139b712117c2cc98fb6745090a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 7c9631139b712117c2cc98fb6745090a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 7c9631139b712117c2cc98fb6745090a.exe -
Processes:
7c9631139b712117c2cc98fb6745090a.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 7c9631139b712117c2cc98fb6745090a.exe -
Drops file in Windows directory 3 IoCs
Processes:
7c9631139b712117c2cc98fb6745090a.exe7c9631139b712117c2cc98fb6745090a.exedescription ioc process File created C:\Windows\svchost.exe 7c9631139b712117c2cc98fb6745090a.exe File created C:\Windows\6c0761 7c9631139b712117c2cc98fb6745090a.exe File opened for modification C:\Windows\SYSTEM.INI 7c9631139b712117c2cc98fb6745090a.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
7c9631139b712117c2cc98fb6745090a.exepid process 1204 7c9631139b712117c2cc98fb6745090a.exe -
Suspicious use of AdjustPrivilegeToken 20 IoCs
Processes:
7c9631139b712117c2cc98fb6745090a.exedescription pid process Token: SeDebugPrivilege 1204 7c9631139b712117c2cc98fb6745090a.exe Token: SeDebugPrivilege 1204 7c9631139b712117c2cc98fb6745090a.exe Token: SeDebugPrivilege 1204 7c9631139b712117c2cc98fb6745090a.exe Token: SeDebugPrivilege 1204 7c9631139b712117c2cc98fb6745090a.exe Token: SeDebugPrivilege 1204 7c9631139b712117c2cc98fb6745090a.exe Token: SeDebugPrivilege 1204 7c9631139b712117c2cc98fb6745090a.exe Token: SeDebugPrivilege 1204 7c9631139b712117c2cc98fb6745090a.exe Token: SeDebugPrivilege 1204 7c9631139b712117c2cc98fb6745090a.exe Token: SeDebugPrivilege 1204 7c9631139b712117c2cc98fb6745090a.exe Token: SeDebugPrivilege 1204 7c9631139b712117c2cc98fb6745090a.exe Token: SeDebugPrivilege 1204 7c9631139b712117c2cc98fb6745090a.exe Token: SeDebugPrivilege 1204 7c9631139b712117c2cc98fb6745090a.exe Token: SeDebugPrivilege 1204 7c9631139b712117c2cc98fb6745090a.exe Token: SeDebugPrivilege 1204 7c9631139b712117c2cc98fb6745090a.exe Token: SeDebugPrivilege 1204 7c9631139b712117c2cc98fb6745090a.exe Token: SeDebugPrivilege 1204 7c9631139b712117c2cc98fb6745090a.exe Token: SeDebugPrivilege 1204 7c9631139b712117c2cc98fb6745090a.exe Token: SeDebugPrivilege 1204 7c9631139b712117c2cc98fb6745090a.exe Token: SeDebugPrivilege 1204 7c9631139b712117c2cc98fb6745090a.exe Token: SeDebugPrivilege 1204 7c9631139b712117c2cc98fb6745090a.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
7c9631139b712117c2cc98fb6745090a.exesvchost.exe7c9631139b712117c2cc98fb6745090a.exedescription pid process target process PID 1692 wrote to memory of 912 1692 7c9631139b712117c2cc98fb6745090a.exe svchost.exe PID 1692 wrote to memory of 912 1692 7c9631139b712117c2cc98fb6745090a.exe svchost.exe PID 1692 wrote to memory of 912 1692 7c9631139b712117c2cc98fb6745090a.exe svchost.exe PID 1692 wrote to memory of 912 1692 7c9631139b712117c2cc98fb6745090a.exe svchost.exe PID 912 wrote to memory of 1204 912 svchost.exe 7c9631139b712117c2cc98fb6745090a.exe PID 912 wrote to memory of 1204 912 svchost.exe 7c9631139b712117c2cc98fb6745090a.exe PID 912 wrote to memory of 1204 912 svchost.exe 7c9631139b712117c2cc98fb6745090a.exe PID 912 wrote to memory of 1204 912 svchost.exe 7c9631139b712117c2cc98fb6745090a.exe PID 1204 wrote to memory of 1092 1204 7c9631139b712117c2cc98fb6745090a.exe taskhost.exe PID 1204 wrote to memory of 1180 1204 7c9631139b712117c2cc98fb6745090a.exe Dwm.exe PID 1204 wrote to memory of 1208 1204 7c9631139b712117c2cc98fb6745090a.exe Explorer.EXE PID 1204 wrote to memory of 912 1204 7c9631139b712117c2cc98fb6745090a.exe svchost.exe PID 1204 wrote to memory of 912 1204 7c9631139b712117c2cc98fb6745090a.exe svchost.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
7c9631139b712117c2cc98fb6745090a.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 7c9631139b712117c2cc98fb6745090a.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\7c9631139b712117c2cc98fb6745090a.exe"C:\Users\Admin\AppData\Local\Temp\7c9631139b712117c2cc98fb6745090a.exe"2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.exe"C:\Windows\svchost.exe" "C:\Users\Admin\AppData\Local\Temp\7c9631139b712117c2cc98fb6745090a.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7c9631139b712117c2cc98fb6745090a.exe"C:\Users\Admin\AppData\Local\Temp\7c9631139b712117c2cc98fb6745090a.exe"4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\svchost.exeC:\Windows\svchost.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\7c9631139b712117c2cc98fb6745090a.exeFilesize
320KB
MD51065b2fc4abf5490ca5af2c8008d4e9d
SHA1d8309d2e1e3157f042690712af908bbaad051fb0
SHA256db707c2cc424031d0b5d282197521af032eb8baf3d309e37182723921d39c292
SHA512b28289e79f7fdf2564c94d669ccc7dee4488dd81e89ca6f90e51945b96b3da8a7046df146dacb06a44afbb4c392177e4e264a91a990046ff6d6f667460ae42ae
-
C:\Windows\svchost.exeFilesize
35KB
MD583b4da0c5e91e676c355a34ad0fe73da
SHA109322303503ed0a70613110ca72e1bc790348882
SHA2565ad575dccfe237328de529ea01d57917c5d639ed0d8454a01af98aaea9724110
SHA51220183c78adbabf88ac8999521cc3e1884215f78c264f06cb017dd8749b995adc96559c5a9a39ecda3d2c34390cc5caf7dbf6b90b975d55e2ed129e1993eb5b08
-
C:\Windows\svchost.exeFilesize
35KB
MD583b4da0c5e91e676c355a34ad0fe73da
SHA109322303503ed0a70613110ca72e1bc790348882
SHA2565ad575dccfe237328de529ea01d57917c5d639ed0d8454a01af98aaea9724110
SHA51220183c78adbabf88ac8999521cc3e1884215f78c264f06cb017dd8749b995adc96559c5a9a39ecda3d2c34390cc5caf7dbf6b90b975d55e2ed129e1993eb5b08
-
C:\Windows\svchost.exeFilesize
35KB
MD583b4da0c5e91e676c355a34ad0fe73da
SHA109322303503ed0a70613110ca72e1bc790348882
SHA2565ad575dccfe237328de529ea01d57917c5d639ed0d8454a01af98aaea9724110
SHA51220183c78adbabf88ac8999521cc3e1884215f78c264f06cb017dd8749b995adc96559c5a9a39ecda3d2c34390cc5caf7dbf6b90b975d55e2ed129e1993eb5b08
-
\Users\Admin\AppData\Local\Temp\7c9631139b712117c2cc98fb6745090a.exeFilesize
320KB
MD51065b2fc4abf5490ca5af2c8008d4e9d
SHA1d8309d2e1e3157f042690712af908bbaad051fb0
SHA256db707c2cc424031d0b5d282197521af032eb8baf3d309e37182723921d39c292
SHA512b28289e79f7fdf2564c94d669ccc7dee4488dd81e89ca6f90e51945b96b3da8a7046df146dacb06a44afbb4c392177e4e264a91a990046ff6d6f667460ae42ae
-
memory/912-62-0x0000000000120000-0x0000000000171000-memory.dmpFilesize
324KB
-
memory/912-54-0x0000000000000000-mapping.dmp
-
memory/912-65-0x0000000000020000-0x0000000000022000-memory.dmpFilesize
8KB
-
memory/1204-58-0x0000000000000000-mapping.dmp
-
memory/1204-63-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/1204-64-0x0000000001DA0000-0x0000000002E5A000-memory.dmpFilesize
16.7MB
-
memory/1204-61-0x0000000001DA0000-0x0000000002E5A000-memory.dmpFilesize
16.7MB
-
memory/1204-60-0x0000000075661000-0x0000000075663000-memory.dmpFilesize
8KB
-
memory/1204-67-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB