Analysis
-
max time kernel
40s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
30-08-2022 19:18
Static task
static1
Behavioral task
behavioral1
Sample
b8ea7fe7fd4bf863c7a63ab6cf5422b4.exe
Resource
win7-20220812-en
General
-
Target
b8ea7fe7fd4bf863c7a63ab6cf5422b4.exe
-
Size
364KB
-
MD5
b8ea7fe7fd4bf863c7a63ab6cf5422b4
-
SHA1
b892322b63d5514ba0f54f610d5fd154daab6e92
-
SHA256
19f24c2a73187cc772aa3b6db14e4b819f74e3efa4a1ff1fa34af35ba8880c71
-
SHA512
f980fb9d86a6790118a08efdabf9875116b8a61c67f44e20edb9e4c996115dd84fd4725e71097a35661044f6e905ccf1bbcde87247a36a1854d4dd866fb37a1a
-
SSDEEP
6144:EyH7xOc6H5c6HcT66vlml/SI01Jq3ggxDDwCkTTgPFfnDPteU1oUf5klG4yFFBuO:EagCkD/pzrRklGvFFEr1I5
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 2 TTPs 3 IoCs
Processes:
b8ea7fe7fd4bf863c7a63ab6cf5422b4.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" b8ea7fe7fd4bf863c7a63ab6cf5422b4.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" b8ea7fe7fd4bf863c7a63ab6cf5422b4.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" b8ea7fe7fd4bf863c7a63ab6cf5422b4.exe -
Processes:
b8ea7fe7fd4bf863c7a63ab6cf5422b4.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" b8ea7fe7fd4bf863c7a63ab6cf5422b4.exe -
Processes:
b8ea7fe7fd4bf863c7a63ab6cf5422b4.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" b8ea7fe7fd4bf863c7a63ab6cf5422b4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" b8ea7fe7fd4bf863c7a63ab6cf5422b4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" b8ea7fe7fd4bf863c7a63ab6cf5422b4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" b8ea7fe7fd4bf863c7a63ab6cf5422b4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" b8ea7fe7fd4bf863c7a63ab6cf5422b4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" b8ea7fe7fd4bf863c7a63ab6cf5422b4.exe -
Executes dropped EXE 3 IoCs
Processes:
svchost.exeb8ea7fe7fd4bf863c7a63ab6cf5422b4.exesvchost.exepid process 1852 svchost.exe 884 b8ea7fe7fd4bf863c7a63ab6cf5422b4.exe 1688 svchost.exe -
Processes:
resource yara_rule behavioral1/memory/884-63-0x0000000001E60000-0x0000000002F1A000-memory.dmp upx behavioral1/memory/884-65-0x0000000001E60000-0x0000000002F1A000-memory.dmp upx -
Loads dropped DLL 1 IoCs
Processes:
svchost.exepid process 1852 svchost.exe -
Processes:
b8ea7fe7fd4bf863c7a63ab6cf5422b4.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" b8ea7fe7fd4bf863c7a63ab6cf5422b4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" b8ea7fe7fd4bf863c7a63ab6cf5422b4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" b8ea7fe7fd4bf863c7a63ab6cf5422b4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" b8ea7fe7fd4bf863c7a63ab6cf5422b4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc b8ea7fe7fd4bf863c7a63ab6cf5422b4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" b8ea7fe7fd4bf863c7a63ab6cf5422b4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" b8ea7fe7fd4bf863c7a63ab6cf5422b4.exe -
Processes:
b8ea7fe7fd4bf863c7a63ab6cf5422b4.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" b8ea7fe7fd4bf863c7a63ab6cf5422b4.exe -
Drops file in Windows directory 2 IoCs
Processes:
b8ea7fe7fd4bf863c7a63ab6cf5422b4.exeb8ea7fe7fd4bf863c7a63ab6cf5422b4.exedescription ioc process File created C:\Windows\svchost.exe b8ea7fe7fd4bf863c7a63ab6cf5422b4.exe File created C:\Windows\6bf9f9 b8ea7fe7fd4bf863c7a63ab6cf5422b4.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
b8ea7fe7fd4bf863c7a63ab6cf5422b4.exesvchost.exedescription pid process target process PID 2036 wrote to memory of 1852 2036 b8ea7fe7fd4bf863c7a63ab6cf5422b4.exe svchost.exe PID 2036 wrote to memory of 1852 2036 b8ea7fe7fd4bf863c7a63ab6cf5422b4.exe svchost.exe PID 2036 wrote to memory of 1852 2036 b8ea7fe7fd4bf863c7a63ab6cf5422b4.exe svchost.exe PID 2036 wrote to memory of 1852 2036 b8ea7fe7fd4bf863c7a63ab6cf5422b4.exe svchost.exe PID 1852 wrote to memory of 884 1852 svchost.exe b8ea7fe7fd4bf863c7a63ab6cf5422b4.exe PID 1852 wrote to memory of 884 1852 svchost.exe b8ea7fe7fd4bf863c7a63ab6cf5422b4.exe PID 1852 wrote to memory of 884 1852 svchost.exe b8ea7fe7fd4bf863c7a63ab6cf5422b4.exe PID 1852 wrote to memory of 884 1852 svchost.exe b8ea7fe7fd4bf863c7a63ab6cf5422b4.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
b8ea7fe7fd4bf863c7a63ab6cf5422b4.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" b8ea7fe7fd4bf863c7a63ab6cf5422b4.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b8ea7fe7fd4bf863c7a63ab6cf5422b4.exe"C:\Users\Admin\AppData\Local\Temp\b8ea7fe7fd4bf863c7a63ab6cf5422b4.exe"1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.exe"C:\Windows\svchost.exe" "C:\Users\Admin\AppData\Local\Temp\b8ea7fe7fd4bf863c7a63ab6cf5422b4.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\b8ea7fe7fd4bf863c7a63ab6cf5422b4.exe"C:\Users\Admin\AppData\Local\Temp\b8ea7fe7fd4bf863c7a63ab6cf5422b4.exe"3⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System policy modification
-
C:\Windows\svchost.exeC:\Windows\svchost.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\b8ea7fe7fd4bf863c7a63ab6cf5422b4.exeFilesize
328KB
MD5b37cda37c8414ae688e52068bafc294a
SHA1dba9bb090990ced1047d42ebe12412ed5bbaf3aa
SHA256485ef44aa9220fd406dabf5d0023955ce2e4bf9275bda5d41fe633b56f0464cb
SHA512eb321ef6176bb41127e5847d42be287543311fd1eadb6d7db2df01f46873d623b9376a3b84003e7dd8e591be2e139a145c5c8c01dec38123d1dd039f2db96f88
-
C:\Windows\svchost.exeFilesize
35KB
MD583b4da0c5e91e676c355a34ad0fe73da
SHA109322303503ed0a70613110ca72e1bc790348882
SHA2565ad575dccfe237328de529ea01d57917c5d639ed0d8454a01af98aaea9724110
SHA51220183c78adbabf88ac8999521cc3e1884215f78c264f06cb017dd8749b995adc96559c5a9a39ecda3d2c34390cc5caf7dbf6b90b975d55e2ed129e1993eb5b08
-
C:\Windows\svchost.exeFilesize
35KB
MD583b4da0c5e91e676c355a34ad0fe73da
SHA109322303503ed0a70613110ca72e1bc790348882
SHA2565ad575dccfe237328de529ea01d57917c5d639ed0d8454a01af98aaea9724110
SHA51220183c78adbabf88ac8999521cc3e1884215f78c264f06cb017dd8749b995adc96559c5a9a39ecda3d2c34390cc5caf7dbf6b90b975d55e2ed129e1993eb5b08
-
C:\Windows\svchost.exeFilesize
35KB
MD583b4da0c5e91e676c355a34ad0fe73da
SHA109322303503ed0a70613110ca72e1bc790348882
SHA2565ad575dccfe237328de529ea01d57917c5d639ed0d8454a01af98aaea9724110
SHA51220183c78adbabf88ac8999521cc3e1884215f78c264f06cb017dd8749b995adc96559c5a9a39ecda3d2c34390cc5caf7dbf6b90b975d55e2ed129e1993eb5b08
-
\Users\Admin\AppData\Local\Temp\b8ea7fe7fd4bf863c7a63ab6cf5422b4.exeFilesize
328KB
MD5b37cda37c8414ae688e52068bafc294a
SHA1dba9bb090990ced1047d42ebe12412ed5bbaf3aa
SHA256485ef44aa9220fd406dabf5d0023955ce2e4bf9275bda5d41fe633b56f0464cb
SHA512eb321ef6176bb41127e5847d42be287543311fd1eadb6d7db2df01f46873d623b9376a3b84003e7dd8e591be2e139a145c5c8c01dec38123d1dd039f2db96f88
-
memory/884-60-0x0000000075521000-0x0000000075523000-memory.dmpFilesize
8KB
-
memory/884-58-0x0000000000000000-mapping.dmp
-
memory/884-62-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB
-
memory/884-63-0x0000000001E60000-0x0000000002F1A000-memory.dmpFilesize
16.7MB
-
memory/884-64-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB
-
memory/884-65-0x0000000001E60000-0x0000000002F1A000-memory.dmpFilesize
16.7MB
-
memory/1852-61-0x0000000000350000-0x00000000003A3000-memory.dmpFilesize
332KB
-
memory/1852-54-0x0000000000000000-mapping.dmp