Analysis
-
max time kernel
32s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
03-10-2022 18:09
Behavioral task
behavioral1
Sample
d32bdcd96a6860a49ce2d25fbc469a69ab43e30388f7761c6e51725168aa46cb.exe
Resource
win7-20220812-en
General
-
Target
d32bdcd96a6860a49ce2d25fbc469a69ab43e30388f7761c6e51725168aa46cb.exe
-
Size
105KB
-
MD5
02f376268da07095c9978dcaec6488e9
-
SHA1
5ee6cbc3d725452117d2a2af08d96a50f460971e
-
SHA256
d32bdcd96a6860a49ce2d25fbc469a69ab43e30388f7761c6e51725168aa46cb
-
SHA512
62094687040271acddfbf4b223ded049f07d2ee8bde4e7c9e67bd771dac8a255515e25ea9b4d3bf9095fe2c7f07c7ea1862d2ff7604f24a18124b652b92f9782
-
SSDEEP
3072:odKr0ExPTJ5Gx1lB6jm9wadIhwG25MgN9yjR:oqxxPK1mjm9w1yLNAjR
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Modifies firewall policy service 2 TTPs 3 IoCs
Processes:
d32bdcd96a6860a49ce2d25fbc469a69ab43e30388f7761c6e51725168aa46cb.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" d32bdcd96a6860a49ce2d25fbc469a69ab43e30388f7761c6e51725168aa46cb.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" d32bdcd96a6860a49ce2d25fbc469a69ab43e30388f7761c6e51725168aa46cb.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" d32bdcd96a6860a49ce2d25fbc469a69ab43e30388f7761c6e51725168aa46cb.exe -
Processes:
d32bdcd96a6860a49ce2d25fbc469a69ab43e30388f7761c6e51725168aa46cb.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d32bdcd96a6860a49ce2d25fbc469a69ab43e30388f7761c6e51725168aa46cb.exe -
Processes:
d32bdcd96a6860a49ce2d25fbc469a69ab43e30388f7761c6e51725168aa46cb.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" d32bdcd96a6860a49ce2d25fbc469a69ab43e30388f7761c6e51725168aa46cb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" d32bdcd96a6860a49ce2d25fbc469a69ab43e30388f7761c6e51725168aa46cb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" d32bdcd96a6860a49ce2d25fbc469a69ab43e30388f7761c6e51725168aa46cb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" d32bdcd96a6860a49ce2d25fbc469a69ab43e30388f7761c6e51725168aa46cb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" d32bdcd96a6860a49ce2d25fbc469a69ab43e30388f7761c6e51725168aa46cb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" d32bdcd96a6860a49ce2d25fbc469a69ab43e30388f7761c6e51725168aa46cb.exe -
Possible privilege escalation attempt 2 IoCs
Processes:
icacls.exetakeown.exepid process 1648 icacls.exe 1384 takeown.exe -
Processes:
resource yara_rule behavioral1/memory/1468-55-0x0000000001D50000-0x0000000002DDE000-memory.dmp upx behavioral1/memory/1468-56-0x0000000000400000-0x0000000000430000-memory.dmp upx behavioral1/memory/1468-57-0x0000000001D50000-0x0000000002DDE000-memory.dmp upx behavioral1/memory/1468-62-0x0000000000400000-0x0000000000430000-memory.dmp upx behavioral1/memory/1468-63-0x0000000001D50000-0x0000000002DDE000-memory.dmp upx -
Modifies file permissions 1 TTPs 2 IoCs
Processes:
takeown.exeicacls.exepid process 1384 takeown.exe 1648 icacls.exe -
Processes:
d32bdcd96a6860a49ce2d25fbc469a69ab43e30388f7761c6e51725168aa46cb.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" d32bdcd96a6860a49ce2d25fbc469a69ab43e30388f7761c6e51725168aa46cb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" d32bdcd96a6860a49ce2d25fbc469a69ab43e30388f7761c6e51725168aa46cb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" d32bdcd96a6860a49ce2d25fbc469a69ab43e30388f7761c6e51725168aa46cb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" d32bdcd96a6860a49ce2d25fbc469a69ab43e30388f7761c6e51725168aa46cb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc d32bdcd96a6860a49ce2d25fbc469a69ab43e30388f7761c6e51725168aa46cb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" d32bdcd96a6860a49ce2d25fbc469a69ab43e30388f7761c6e51725168aa46cb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" d32bdcd96a6860a49ce2d25fbc469a69ab43e30388f7761c6e51725168aa46cb.exe -
Processes:
d32bdcd96a6860a49ce2d25fbc469a69ab43e30388f7761c6e51725168aa46cb.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d32bdcd96a6860a49ce2d25fbc469a69ab43e30388f7761c6e51725168aa46cb.exe -
Drops file in Windows directory 1 IoCs
Processes:
d32bdcd96a6860a49ce2d25fbc469a69ab43e30388f7761c6e51725168aa46cb.exedescription ioc process File opened for modification C:\Windows\SYSTEM.INI d32bdcd96a6860a49ce2d25fbc469a69ab43e30388f7761c6e51725168aa46cb.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
d32bdcd96a6860a49ce2d25fbc469a69ab43e30388f7761c6e51725168aa46cb.exepid process 1468 d32bdcd96a6860a49ce2d25fbc469a69ab43e30388f7761c6e51725168aa46cb.exe -
Suspicious use of AdjustPrivilegeToken 21 IoCs
Processes:
d32bdcd96a6860a49ce2d25fbc469a69ab43e30388f7761c6e51725168aa46cb.exedescription pid process Token: SeDebugPrivilege 1468 d32bdcd96a6860a49ce2d25fbc469a69ab43e30388f7761c6e51725168aa46cb.exe Token: SeDebugPrivilege 1468 d32bdcd96a6860a49ce2d25fbc469a69ab43e30388f7761c6e51725168aa46cb.exe Token: SeDebugPrivilege 1468 d32bdcd96a6860a49ce2d25fbc469a69ab43e30388f7761c6e51725168aa46cb.exe Token: SeDebugPrivilege 1468 d32bdcd96a6860a49ce2d25fbc469a69ab43e30388f7761c6e51725168aa46cb.exe Token: SeDebugPrivilege 1468 d32bdcd96a6860a49ce2d25fbc469a69ab43e30388f7761c6e51725168aa46cb.exe Token: SeDebugPrivilege 1468 d32bdcd96a6860a49ce2d25fbc469a69ab43e30388f7761c6e51725168aa46cb.exe Token: SeDebugPrivilege 1468 d32bdcd96a6860a49ce2d25fbc469a69ab43e30388f7761c6e51725168aa46cb.exe Token: SeDebugPrivilege 1468 d32bdcd96a6860a49ce2d25fbc469a69ab43e30388f7761c6e51725168aa46cb.exe Token: SeDebugPrivilege 1468 d32bdcd96a6860a49ce2d25fbc469a69ab43e30388f7761c6e51725168aa46cb.exe Token: SeDebugPrivilege 1468 d32bdcd96a6860a49ce2d25fbc469a69ab43e30388f7761c6e51725168aa46cb.exe Token: SeDebugPrivilege 1468 d32bdcd96a6860a49ce2d25fbc469a69ab43e30388f7761c6e51725168aa46cb.exe Token: SeDebugPrivilege 1468 d32bdcd96a6860a49ce2d25fbc469a69ab43e30388f7761c6e51725168aa46cb.exe Token: SeDebugPrivilege 1468 d32bdcd96a6860a49ce2d25fbc469a69ab43e30388f7761c6e51725168aa46cb.exe Token: SeDebugPrivilege 1468 d32bdcd96a6860a49ce2d25fbc469a69ab43e30388f7761c6e51725168aa46cb.exe Token: SeDebugPrivilege 1468 d32bdcd96a6860a49ce2d25fbc469a69ab43e30388f7761c6e51725168aa46cb.exe Token: SeDebugPrivilege 1468 d32bdcd96a6860a49ce2d25fbc469a69ab43e30388f7761c6e51725168aa46cb.exe Token: SeDebugPrivilege 1468 d32bdcd96a6860a49ce2d25fbc469a69ab43e30388f7761c6e51725168aa46cb.exe Token: SeDebugPrivilege 1468 d32bdcd96a6860a49ce2d25fbc469a69ab43e30388f7761c6e51725168aa46cb.exe Token: SeDebugPrivilege 1468 d32bdcd96a6860a49ce2d25fbc469a69ab43e30388f7761c6e51725168aa46cb.exe Token: SeDebugPrivilege 1468 d32bdcd96a6860a49ce2d25fbc469a69ab43e30388f7761c6e51725168aa46cb.exe Token: SeDebugPrivilege 1468 d32bdcd96a6860a49ce2d25fbc469a69ab43e30388f7761c6e51725168aa46cb.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
d32bdcd96a6860a49ce2d25fbc469a69ab43e30388f7761c6e51725168aa46cb.execmd.exedescription pid process target process PID 1468 wrote to memory of 1144 1468 d32bdcd96a6860a49ce2d25fbc469a69ab43e30388f7761c6e51725168aa46cb.exe taskhost.exe PID 1468 wrote to memory of 1240 1468 d32bdcd96a6860a49ce2d25fbc469a69ab43e30388f7761c6e51725168aa46cb.exe Dwm.exe PID 1468 wrote to memory of 1276 1468 d32bdcd96a6860a49ce2d25fbc469a69ab43e30388f7761c6e51725168aa46cb.exe Explorer.EXE PID 1468 wrote to memory of 1268 1468 d32bdcd96a6860a49ce2d25fbc469a69ab43e30388f7761c6e51725168aa46cb.exe conhost.exe PID 1468 wrote to memory of 628 1468 d32bdcd96a6860a49ce2d25fbc469a69ab43e30388f7761c6e51725168aa46cb.exe cmd.exe PID 1468 wrote to memory of 628 1468 d32bdcd96a6860a49ce2d25fbc469a69ab43e30388f7761c6e51725168aa46cb.exe cmd.exe PID 1468 wrote to memory of 628 1468 d32bdcd96a6860a49ce2d25fbc469a69ab43e30388f7761c6e51725168aa46cb.exe cmd.exe PID 1468 wrote to memory of 628 1468 d32bdcd96a6860a49ce2d25fbc469a69ab43e30388f7761c6e51725168aa46cb.exe cmd.exe PID 628 wrote to memory of 1384 628 cmd.exe takeown.exe PID 628 wrote to memory of 1384 628 cmd.exe takeown.exe PID 628 wrote to memory of 1384 628 cmd.exe takeown.exe PID 628 wrote to memory of 1384 628 cmd.exe takeown.exe PID 628 wrote to memory of 1648 628 cmd.exe icacls.exe PID 628 wrote to memory of 1648 628 cmd.exe icacls.exe PID 628 wrote to memory of 1648 628 cmd.exe icacls.exe PID 628 wrote to memory of 1648 628 cmd.exe icacls.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
d32bdcd96a6860a49ce2d25fbc469a69ab43e30388f7761c6e51725168aa46cb.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d32bdcd96a6860a49ce2d25fbc469a69ab43e30388f7761c6e51725168aa46cb.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d32bdcd96a6860a49ce2d25fbc469a69ab43e30388f7761c6e51725168aa46cb.exe"C:\Users\Admin\AppData\Local\Temp\d32bdcd96a6860a49ce2d25fbc469a69ab43e30388f7761c6e51725168aa46cb.exe"1⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\banish.cmd""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\takeown.exeTAKEOWN /F ""3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\SysWOW64\icacls.exeICACLS "" /grant "Admin":F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-477293407-1118318300-1265302866-1255667971-93332703-275156726205790696-1811526107"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\banish.cmdFilesize
760B
MD54f4199874adea9219f1e4ad27d97d9c4
SHA1dc1dae4f4865f84e1d0f572cacd94f48b83fa289
SHA256099a497b7b971d87d0f8c17ce37d1c675e9d6d75d5c1e605c45d85e54c26a2ff
SHA512c703c4c89ec94d2578e2b96110724fb08e5289c7e0db51f47e4bfd6be14d684223e0dfc2dfe978aa56eb8037a4bea514464e582ac3363ed1f506cba1aeaf6017
-
memory/628-58-0x0000000000000000-mapping.dmp
-
memory/1384-60-0x0000000000000000-mapping.dmp
-
memory/1468-54-0x0000000075211000-0x0000000075213000-memory.dmpFilesize
8KB
-
memory/1468-55-0x0000000001D50000-0x0000000002DDE000-memory.dmpFilesize
16.6MB
-
memory/1468-56-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/1468-57-0x0000000001D50000-0x0000000002DDE000-memory.dmpFilesize
16.6MB
-
memory/1468-62-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/1468-63-0x0000000001D50000-0x0000000002DDE000-memory.dmpFilesize
16.6MB
-
memory/1648-61-0x0000000000000000-mapping.dmp