Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    30s
  • max time network
    34s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    07/12/2022, 02:27

General

  • Target

    fd3dacc6a77b9dcdebac15effe86bb88985415cc3bbb2f1904f9de6cb3594eb3.dll

  • Size

    120KB

  • MD5

    0a1ddf0a30a705624a875f6de419e8ea

  • SHA1

    2b098735ee7e85811669e0a31d6ac5f0943c70a5

  • SHA256

    fd3dacc6a77b9dcdebac15effe86bb88985415cc3bbb2f1904f9de6cb3594eb3

  • SHA512

    67426cd549e06104e1fca7fad6948a62939ffad7c4b5def921260289f087f67bc87f4aa78f0706495b573144dd715bfcf5efbab7c449af8c230c724231c86bf1

  • SSDEEP

    1536:s/smIuMlrJLlak253CGI0ycfjc7UiK1Q0eE/VK17xy/3IhQ9Iv:qMhDb2Cj97UiK1Z/VmVykiG

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Signatures

  • Modifies firewall policy service 2 TTPs 3 IoCs
  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

  • UAC bypass 3 TTPs 1 IoCs
  • Windows security bypass 2 TTPs 6 IoCs
  • Executes dropped EXE 3 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL 6 IoCs
  • Windows security modification 2 TTPs 7 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Enumerates connected drives 3 TTPs 9 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 21 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs
  • System policy modification 1 TTPs 1 IoCs

Processes

  • C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    1⤵
      PID:1116
    • C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      1⤵
        PID:1168
      • C:\Windows\Explorer.EXE
        C:\Windows\Explorer.EXE
        1⤵
          PID:1224
          • C:\Windows\system32\rundll32.exe
            rundll32.exe C:\Users\Admin\AppData\Local\Temp\fd3dacc6a77b9dcdebac15effe86bb88985415cc3bbb2f1904f9de6cb3594eb3.dll,#1
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:836
            • C:\Windows\SysWOW64\rundll32.exe
              rundll32.exe C:\Users\Admin\AppData\Local\Temp\fd3dacc6a77b9dcdebac15effe86bb88985415cc3bbb2f1904f9de6cb3594eb3.dll,#1
              3⤵
              • Loads dropped DLL
              • Suspicious use of WriteProcessMemory
              PID:1684
              • C:\Users\Admin\AppData\Local\Temp\6c0d98.exe
                C:\Users\Admin\AppData\Local\Temp\6c0d98.exe
                4⤵
                • Modifies firewall policy service
                • UAC bypass
                • Windows security bypass
                • Executes dropped EXE
                • Windows security modification
                • Checks whether UAC is enabled
                • Enumerates connected drives
                • Drops file in Windows directory
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                • System policy modification
                PID:2012
              • C:\Users\Admin\AppData\Local\Temp\6c1259.exe
                C:\Users\Admin\AppData\Local\Temp\6c1259.exe
                4⤵
                • Executes dropped EXE
                PID:828
              • C:\Users\Admin\AppData\Local\Temp\6c2b75.exe
                C:\Users\Admin\AppData\Local\Temp\6c2b75.exe
                4⤵
                • Executes dropped EXE
                PID:604

        Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\6c0d98.exe

          Filesize

          97KB

          MD5

          58570beb55948965cf653e558ffe1eca

          SHA1

          d78fdcaa0aa9cd81a6b4160156127d5465bbdab2

          SHA256

          5a85aef13a037352ad95973b26c37b244aed14396b3cd76ccec098dbc54d209f

          SHA512

          2064e11e2644748e9214b3039f76845432aef7a517d5bc1bb67c0912f6f12fbfe1d4d85fcdc987327808aafb952e8cc41b3a006edfcc7a3a712a8cde0bb30146

        • C:\Users\Admin\AppData\Local\Temp\6c1259.exe

          Filesize

          97KB

          MD5

          58570beb55948965cf653e558ffe1eca

          SHA1

          d78fdcaa0aa9cd81a6b4160156127d5465bbdab2

          SHA256

          5a85aef13a037352ad95973b26c37b244aed14396b3cd76ccec098dbc54d209f

          SHA512

          2064e11e2644748e9214b3039f76845432aef7a517d5bc1bb67c0912f6f12fbfe1d4d85fcdc987327808aafb952e8cc41b3a006edfcc7a3a712a8cde0bb30146

        • C:\Users\Admin\AppData\Local\Temp\6c2b75.exe

          Filesize

          97KB

          MD5

          58570beb55948965cf653e558ffe1eca

          SHA1

          d78fdcaa0aa9cd81a6b4160156127d5465bbdab2

          SHA256

          5a85aef13a037352ad95973b26c37b244aed14396b3cd76ccec098dbc54d209f

          SHA512

          2064e11e2644748e9214b3039f76845432aef7a517d5bc1bb67c0912f6f12fbfe1d4d85fcdc987327808aafb952e8cc41b3a006edfcc7a3a712a8cde0bb30146

        • \Users\Admin\AppData\Local\Temp\6c0d98.exe

          Filesize

          97KB

          MD5

          58570beb55948965cf653e558ffe1eca

          SHA1

          d78fdcaa0aa9cd81a6b4160156127d5465bbdab2

          SHA256

          5a85aef13a037352ad95973b26c37b244aed14396b3cd76ccec098dbc54d209f

          SHA512

          2064e11e2644748e9214b3039f76845432aef7a517d5bc1bb67c0912f6f12fbfe1d4d85fcdc987327808aafb952e8cc41b3a006edfcc7a3a712a8cde0bb30146

        • \Users\Admin\AppData\Local\Temp\6c0d98.exe

          Filesize

          97KB

          MD5

          58570beb55948965cf653e558ffe1eca

          SHA1

          d78fdcaa0aa9cd81a6b4160156127d5465bbdab2

          SHA256

          5a85aef13a037352ad95973b26c37b244aed14396b3cd76ccec098dbc54d209f

          SHA512

          2064e11e2644748e9214b3039f76845432aef7a517d5bc1bb67c0912f6f12fbfe1d4d85fcdc987327808aafb952e8cc41b3a006edfcc7a3a712a8cde0bb30146

        • \Users\Admin\AppData\Local\Temp\6c1259.exe

          Filesize

          97KB

          MD5

          58570beb55948965cf653e558ffe1eca

          SHA1

          d78fdcaa0aa9cd81a6b4160156127d5465bbdab2

          SHA256

          5a85aef13a037352ad95973b26c37b244aed14396b3cd76ccec098dbc54d209f

          SHA512

          2064e11e2644748e9214b3039f76845432aef7a517d5bc1bb67c0912f6f12fbfe1d4d85fcdc987327808aafb952e8cc41b3a006edfcc7a3a712a8cde0bb30146

        • \Users\Admin\AppData\Local\Temp\6c1259.exe

          Filesize

          97KB

          MD5

          58570beb55948965cf653e558ffe1eca

          SHA1

          d78fdcaa0aa9cd81a6b4160156127d5465bbdab2

          SHA256

          5a85aef13a037352ad95973b26c37b244aed14396b3cd76ccec098dbc54d209f

          SHA512

          2064e11e2644748e9214b3039f76845432aef7a517d5bc1bb67c0912f6f12fbfe1d4d85fcdc987327808aafb952e8cc41b3a006edfcc7a3a712a8cde0bb30146

        • \Users\Admin\AppData\Local\Temp\6c2b75.exe

          Filesize

          97KB

          MD5

          58570beb55948965cf653e558ffe1eca

          SHA1

          d78fdcaa0aa9cd81a6b4160156127d5465bbdab2

          SHA256

          5a85aef13a037352ad95973b26c37b244aed14396b3cd76ccec098dbc54d209f

          SHA512

          2064e11e2644748e9214b3039f76845432aef7a517d5bc1bb67c0912f6f12fbfe1d4d85fcdc987327808aafb952e8cc41b3a006edfcc7a3a712a8cde0bb30146

        • \Users\Admin\AppData\Local\Temp\6c2b75.exe

          Filesize

          97KB

          MD5

          58570beb55948965cf653e558ffe1eca

          SHA1

          d78fdcaa0aa9cd81a6b4160156127d5465bbdab2

          SHA256

          5a85aef13a037352ad95973b26c37b244aed14396b3cd76ccec098dbc54d209f

          SHA512

          2064e11e2644748e9214b3039f76845432aef7a517d5bc1bb67c0912f6f12fbfe1d4d85fcdc987327808aafb952e8cc41b3a006edfcc7a3a712a8cde0bb30146

        • memory/604-89-0x0000000000400000-0x0000000000412000-memory.dmp

          Filesize

          72KB

        • memory/604-80-0x0000000000400000-0x0000000000412000-memory.dmp

          Filesize

          72KB

        • memory/604-82-0x0000000000260000-0x0000000000262000-memory.dmp

          Filesize

          8KB

        • memory/828-74-0x0000000000400000-0x0000000000412000-memory.dmp

          Filesize

          72KB

        • memory/828-88-0x0000000000400000-0x0000000000412000-memory.dmp

          Filesize

          72KB

        • memory/828-81-0x00000000001F0000-0x00000000001F2000-memory.dmp

          Filesize

          8KB

        • memory/828-87-0x0000000000910000-0x00000000019CA000-memory.dmp

          Filesize

          16.7MB

        • memory/1684-67-0x0000000000160000-0x0000000000172000-memory.dmp

          Filesize

          72KB

        • memory/1684-73-0x0000000000210000-0x0000000000222000-memory.dmp

          Filesize

          72KB

        • memory/1684-72-0x00000000001E0000-0x00000000001E2000-memory.dmp

          Filesize

          8KB

        • memory/1684-56-0x0000000010000000-0x0000000010020000-memory.dmp

          Filesize

          128KB

        • memory/1684-79-0x0000000000160000-0x0000000000166000-memory.dmp

          Filesize

          24KB

        • memory/1684-55-0x0000000076AE1000-0x0000000076AE3000-memory.dmp

          Filesize

          8KB

        • memory/1684-68-0x0000000000160000-0x0000000000172000-memory.dmp

          Filesize

          72KB

        • memory/2012-71-0x0000000001700000-0x0000000001702000-memory.dmp

          Filesize

          8KB

        • memory/2012-83-0x00000000005B0000-0x000000000166A000-memory.dmp

          Filesize

          16.7MB

        • memory/2012-84-0x0000000001700000-0x0000000001702000-memory.dmp

          Filesize

          8KB

        • memory/2012-85-0x00000000005B0000-0x000000000166A000-memory.dmp

          Filesize

          16.7MB

        • memory/2012-70-0x00000000005B0000-0x000000000166A000-memory.dmp

          Filesize

          16.7MB

        • memory/2012-69-0x0000000000400000-0x0000000000412000-memory.dmp

          Filesize

          72KB

        • memory/2012-62-0x00000000005B0000-0x000000000166A000-memory.dmp

          Filesize

          16.7MB