Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

1

6dad95abd5...99.exe

windows7-x64

10

6dad95abd5...99.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    50s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    02/10/2022, 16:48

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    6dad95abd55beb7e69c7331e186cfffec1a9c89b8f4d58b5fe53db8c082bee99.exe

  • Size

    200KB

  • MD5

    6fc4a01694ec42707b4ede49510be100

  • SHA1

    9291ba8ebbb1ba01e38d727fdd77cb5aa027b4a6

  • SHA256

    6dad95abd55beb7e69c7331e186cfffec1a9c89b8f4d58b5fe53db8c082bee99

  • SHA512

    ed4fc889733e7bb6aa39fabd7bc34314bab61f6a50bd50eac8c56e08626186d6b6aee3a2054eff6536d40617ef1e778b9df3e8f83cb2133a018e1543baa008c0

  • SSDEEP

    3072:TQIVRTXJiP+1bbLDtpJuHnjl9DrXwmqtaBL0GFkfRXk3UqRgrXH2TPFfth/S8lpe:TJUcH/tpE9tJ0Ekp03UqRqWTFl5S8jYJ

Score
10/10
salitybackdoorevasionspywarestealertrojanupx

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

Signatures

  • Modifies firewall policy service 2 TTPs 6 IoCs
    evasion
  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality
  • UAC bypass 3 TTPs 2 IoCs
    evasiontrojan
  • Windows security bypass 2 TTPs 12 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 2 IoCs
    evasion
  • Disables Task Manager via registry modification
    evasion
  • Executes dropped EXE 2 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Deletes itself 1 IoCs
  • Loads dropped DLL 10 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 14 IoCs
    evasiontrojan
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    evasiontrojan
  • Enumerates connected drives 3 TTPs 22 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file 1 TTPs 1 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in Program Files directory 5 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • NSIS installer 14 IoCs
    installer
  • Suspicious behavior: EnumeratesProcesses 15 IoCs
  • Suspicious use of AdjustPrivilegeToken 40 IoCs
  • Suspicious use of WriteProcessMemory 61 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion

Processes

  • C:\Windows\system32\Dwm.exe
    "C:\Windows\system32\Dwm.exe"
    1⤵
      PID:1176
    • C:\Windows\Explorer.EXE
      C:\Windows\Explorer.EXE
      1⤵
        PID:1200
        • C:\Users\Admin\AppData\Local\Temp\6dad95abd55beb7e69c7331e186cfffec1a9c89b8f4d58b5fe53db8c082bee99.exe
          "C:\Users\Admin\AppData\Local\Temp\6dad95abd55beb7e69c7331e186cfffec1a9c89b8f4d58b5fe53db8c082bee99.exe"
          2⤵
          • Modifies firewall policy service
          • UAC bypass
          • Windows security bypass
          • Disables RegEdit via registry modification
          • Loads dropped DLL
          • Windows security modification
          • Checks whether UAC is enabled
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:1304
          • C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
            "C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\
            3⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of WriteProcessMemory
            PID:456
            • C:\Users\Admin\AppData\Local\Temp\nsd2F4D.tmp\Search-Results Toolbar uninstall.exe
              "C:\Users\Admin\AppData\Local\Temp\nsd2F4D.tmp\Search-Results Toolbar uninstall.exe" /NCRC _?=C:\Users\Admin\AppData\Local\Temp
              4⤵
              • Modifies firewall policy service
              • UAC bypass
              • Windows security bypass
              • Disables RegEdit via registry modification
              • Executes dropped EXE
              • Deletes itself
              • Loads dropped DLL
              • Windows security modification
              • Checks whether UAC is enabled
              • Enumerates connected drives
              • Drops autorun.inf file
              • Drops file in Program Files directory
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              • System policy modification
              PID:2020
      • C:\Windows\system32\taskhost.exe
        "taskhost.exe"
        1⤵
          PID:1112

        Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\006C2434_Rar\6dad95abd55beb7e69c7331e186cfffec1a9c89b8f4d58b5fe53db8c082bee99.exe
          Filesize

          124KB

          MD5

          11bcd35d4465eaa6a4f4b90da56538c3

          SHA1

          a94ac6687989241b8adfa5e5929f7f3ba56282e6

          SHA256

          39229c48c8d9ab2987a30f26e181527e30fab9f66c5e4e24e4d604dd7eb87eee

          SHA512

          9ab3edf3d523202123de31eba23914a6a9c8e0619dc936d1fdd7db5405fbe5fdc558facca551340eefcd734944c84f86602172b7ab1b8c013751ebc0ad719eda

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\nsd2F4D.tmp\Search-Results Toolbar uninstall.exe
          Filesize

          200KB

          MD5

          6fc4a01694ec42707b4ede49510be100

          SHA1

          9291ba8ebbb1ba01e38d727fdd77cb5aa027b4a6

          SHA256

          6dad95abd55beb7e69c7331e186cfffec1a9c89b8f4d58b5fe53db8c082bee99

          SHA512

          ed4fc889733e7bb6aa39fabd7bc34314bab61f6a50bd50eac8c56e08626186d6b6aee3a2054eff6536d40617ef1e778b9df3e8f83cb2133a018e1543baa008c0

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\nsd2F4D.tmp\Search-Results Toolbar uninstall.exe
          Filesize

          200KB

          MD5

          6fc4a01694ec42707b4ede49510be100

          SHA1

          9291ba8ebbb1ba01e38d727fdd77cb5aa027b4a6

          SHA256

          6dad95abd55beb7e69c7331e186cfffec1a9c89b8f4d58b5fe53db8c082bee99

          SHA512

          ed4fc889733e7bb6aa39fabd7bc34314bab61f6a50bd50eac8c56e08626186d6b6aee3a2054eff6536d40617ef1e778b9df3e8f83cb2133a018e1543baa008c0

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\nsd2F4D.tmp\UAC.dat
          Filesize

          19B

          MD5

          17a988e26a4025f6fcdb27000aa24f75

          SHA1

          e218f24b821e150f82f0f85efd03d645a0739b72

          SHA256

          9136c9c8387d85ee3d30668ad8186e36b031f3ca1978521bff8b5a14d9f2662a

          SHA512

          a7a4a9e2708507f6b0f19633bd2d01a787a5837e510cb791ce20d697401ff5939d2858f1aa436cf5d0447c1a909b10aad60aa8eaf1caff820a3c28c4bece63a2

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
          Filesize

          200KB

          MD5

          6fc4a01694ec42707b4ede49510be100

          SHA1

          9291ba8ebbb1ba01e38d727fdd77cb5aa027b4a6

          SHA256

          6dad95abd55beb7e69c7331e186cfffec1a9c89b8f4d58b5fe53db8c082bee99

          SHA512

          ed4fc889733e7bb6aa39fabd7bc34314bab61f6a50bd50eac8c56e08626186d6b6aee3a2054eff6536d40617ef1e778b9df3e8f83cb2133a018e1543baa008c0

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
          Filesize

          200KB

          MD5

          6fc4a01694ec42707b4ede49510be100

          SHA1

          9291ba8ebbb1ba01e38d727fdd77cb5aa027b4a6

          SHA256

          6dad95abd55beb7e69c7331e186cfffec1a9c89b8f4d58b5fe53db8c082bee99

          SHA512

          ed4fc889733e7bb6aa39fabd7bc34314bab61f6a50bd50eac8c56e08626186d6b6aee3a2054eff6536d40617ef1e778b9df3e8f83cb2133a018e1543baa008c0

          Download Submit

        • C:\Windows\SYSTEM.INI
          Filesize

          255B

          MD5

          3fe3188f8cf21690c71f338e471ca7eb

          SHA1

          4904ebbbb71aed87433f252969646150ed9b01f9

          SHA256

          03a80b23125b9939ff9f59914a216915a65b2c6cd2932b8fe82360c7fceec7ac

          SHA512

          cb6f11bf8eb93b74584773e0fe85a7397036680838aa56d662d948e6273844b2bd61ff858dcbb1f0035853b603a10c534b97ff7ec45074465a6a7b5acd2f1815

          Download Submit

        • \Users\Admin\AppData\Local\Temp\nsd2F4D.tmp\Search-Results Toolbar uninstall.exe
          Filesize

          200KB

          MD5

          6fc4a01694ec42707b4ede49510be100

          SHA1

          9291ba8ebbb1ba01e38d727fdd77cb5aa027b4a6

          SHA256

          6dad95abd55beb7e69c7331e186cfffec1a9c89b8f4d58b5fe53db8c082bee99

          SHA512

          ed4fc889733e7bb6aa39fabd7bc34314bab61f6a50bd50eac8c56e08626186d6b6aee3a2054eff6536d40617ef1e778b9df3e8f83cb2133a018e1543baa008c0

          Download Submit

        • \Users\Admin\AppData\Local\Temp\nsd2F4D.tmp\System.dll
          Filesize

          11KB

          MD5

          c17103ae9072a06da581dec998343fc1

          SHA1

          b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

          SHA256

          dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

          SHA512

          d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

          Download Submit

        • \Users\Admin\AppData\Local\Temp\nsd2F4D.tmp\System.dll
          Filesize

          11KB

          MD5

          c17103ae9072a06da581dec998343fc1

          SHA1

          b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

          SHA256

          dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

          SHA512

          d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

          Download Submit

        • \Users\Admin\AppData\Local\Temp\nsy34AA.tmp\InstallOptions.dll
          Filesize

          14KB

          MD5

          325b008aec81e5aaa57096f05d4212b5

          SHA1

          27a2d89747a20305b6518438eff5b9f57f7df5c3

          SHA256

          c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b

          SHA512

          18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf

          Download Submit

        • \Users\Admin\AppData\Local\Temp\nsy34AA.tmp\LangDLL.dll
          Filesize

          5KB

          MD5

          9384f4007c492d4fa040924f31c00166

          SHA1

          aba37faef30d7c445584c688a0b5638f5db31c7b

          SHA256

          60a964095af1be79f6a99b22212fefe2d16f5a0afd7e707d14394e4143e3f4f5

          SHA512

          68f158887e24302673227adffc688fd3edabf097d7f5410f983e06c6b9c7344ca1d8a45c7fa05553adcc5987993df3a298763477168d4842e554c4eb93b9aaaf

          Download Submit

        • \Users\Admin\AppData\Local\Temp\nsy34AA.tmp\System.dll
          Filesize

          11KB

          MD5

          c17103ae9072a06da581dec998343fc1

          SHA1

          b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

          SHA256

          dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

          SHA512

          d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

          Download Submit

        • \Users\Admin\AppData\Local\Temp\nsy34AA.tmp\System.dll
          Filesize

          11KB

          MD5

          c17103ae9072a06da581dec998343fc1

          SHA1

          b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

          SHA256

          dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

          SHA512

          d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

          Download Submit

        • \Users\Admin\AppData\Local\Temp\nsy34AA.tmp\UAC.dll
          Filesize

          16KB

          MD5

          0d422e0c03a7d9428c6c02175d7dc9f8

          SHA1

          5e13d49521cfbbe52cd74de8e1682789f0268969

          SHA256

          9f47ec720d74e538bbc8d0c1118efcbc52e52050dbe98c27029fc35329996f7c

          SHA512

          2edf47b24c4201e082841824d6ad9047a06e9a877d799e87befaf5d54179c924849d2e608cf9f60a1480828edcd98e19f3d139d19bdb4b96ee4939fe58bf0887

          Download Submit

        • \Users\Admin\AppData\Local\Temp\nsy34AA.tmp\xml.dll
          Filesize

          26KB

          MD5

          fbda05aa26e02d38effb82294e83ea69

          SHA1

          aa2291ace177515173315668480c74442e21549d

          SHA256

          565e439a6262cbe6c8164312ad330930738efa8d4defcbcdcc1eeb752fdb75b3

          SHA512

          3fd4dcbe059df3078f7709b2b9edbe30744ad7ff6e4cd1c494b40bb796a31838d5c9761fe9db860c38bd929c364df4767435fb85dc4e4115e361dd9d640c256f

          Download Submit

        • \Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
          Filesize

          200KB

          MD5

          6fc4a01694ec42707b4ede49510be100

          SHA1

          9291ba8ebbb1ba01e38d727fdd77cb5aa027b4a6

          SHA256

          6dad95abd55beb7e69c7331e186cfffec1a9c89b8f4d58b5fe53db8c082bee99

          SHA512

          ed4fc889733e7bb6aa39fabd7bc34314bab61f6a50bd50eac8c56e08626186d6b6aee3a2054eff6536d40617ef1e778b9df3e8f83cb2133a018e1543baa008c0

          Download Submit

        • memory/456-94-0x0000000002F10000-0x0000000002F71000-memory.dmp

          Filesize

          388KB

          Download

        • memory/456-93-0x0000000000400000-0x0000000000461000-memory.dmp

          Filesize

          388KB

          Download

        • memory/456-91-0x0000000003190000-0x0000000003192000-memory.dmp

          Filesize

          8KB

          Download

        • memory/456-87-0x0000000003190000-0x0000000003192000-memory.dmp

          Filesize

          8KB

          Download

        • memory/456-65-0x0000000000400000-0x0000000000461000-memory.dmp

          Filesize

          388KB

          Download

        • memory/456-74-0x0000000002F10000-0x0000000002F71000-memory.dmp

          Filesize

          388KB

          Download

        • memory/1304-64-0x0000000001FB0000-0x000000000303E000-memory.dmp

          Filesize

          16.6MB

          Download

        • memory/1304-57-0x0000000001FB0000-0x000000000303E000-memory.dmp

          Filesize

          16.6MB

          Download

        • memory/1304-63-0x0000000000400000-0x0000000000461000-memory.dmp

          Filesize

          388KB

          Download

        • memory/1304-54-0x00000000762E1000-0x00000000762E3000-memory.dmp

          Filesize

          8KB

          Download

        • memory/1304-56-0x0000000000400000-0x0000000000461000-memory.dmp

          Filesize

          388KB

          Download

        • memory/1304-55-0x0000000001FB0000-0x000000000303E000-memory.dmp

          Filesize

          16.6MB

          Download

        • memory/1304-58-0x00000000003F0000-0x00000000003F2000-memory.dmp

          Filesize

          8KB

          Download

        • memory/2020-75-0x0000000000400000-0x0000000000461000-memory.dmp

          Filesize

          388KB

          Download

        • memory/2020-90-0x0000000001E30000-0x0000000002EBE000-memory.dmp

          Filesize

          16.6MB

          Download

        • memory/2020-92-0x0000000000340000-0x0000000000342000-memory.dmp

          Filesize

          8KB

          Download

        • memory/2020-88-0x0000000000340000-0x0000000000342000-memory.dmp

          Filesize

          8KB

          Download

        • memory/2020-84-0x0000000003CE0000-0x0000000003CE8000-memory.dmp

          Filesize

          32KB

          Download

        • memory/2020-73-0x0000000001E30000-0x0000000002EBE000-memory.dmp

          Filesize

          16.6MB

          Download

        • memory/2020-95-0x0000000000400000-0x0000000000461000-memory.dmp

          Filesize

          388KB

          Download