Analysis
-
max time kernel
122s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
30/09/2023, 12:52
Static task
static1
Behavioral task
behavioral1
Sample
d00431e68be1cd7db0143c3d7264c36f_JC.exe
Resource
win7-20230831-en
General
-
Target
d00431e68be1cd7db0143c3d7264c36f_JC.exe
-
Size
65KB
-
MD5
d00431e68be1cd7db0143c3d7264c36f
-
SHA1
21b2a963797449e3353077166c5f5b1f60185028
-
SHA256
cdd8d870feb9a60b7999db48cc7d050b8e6ab142f94bc870455ae802240c87b1
-
SHA512
bb02fa55d26631ec7cb63f915d252d30f646150417fe792a2314f5a67afe122783e104e6bc4ebb832463fe5a4a186ed9f1d14b0d69892125634df4bff7499b05
-
SSDEEP
1536:UPHeemlYhVsG5aH15WVq2/LYzjkpliWB6OxGRIwJ4AEPApz:UlmlYhUqqPjkplh0OURvJf
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 2 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" d00431e68be1cd7db0143c3d7264c36f_JC.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" d00431e68be1cd7db0143c3d7264c36f_JC.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" d00431e68be1cd7db0143c3d7264c36f_JC.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d00431e68be1cd7db0143c3d7264c36f_JC.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" d00431e68be1cd7db0143c3d7264c36f_JC.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" d00431e68be1cd7db0143c3d7264c36f_JC.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" d00431e68be1cd7db0143c3d7264c36f_JC.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" d00431e68be1cd7db0143c3d7264c36f_JC.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" d00431e68be1cd7db0143c3d7264c36f_JC.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" d00431e68be1cd7db0143c3d7264c36f_JC.exe -
resource yara_rule behavioral1/memory/2200-1-0x0000000000620000-0x00000000016DA000-memory.dmp upx behavioral1/memory/2200-3-0x0000000000620000-0x00000000016DA000-memory.dmp upx behavioral1/memory/2200-4-0x0000000000620000-0x00000000016DA000-memory.dmp upx behavioral1/memory/2200-7-0x0000000000620000-0x00000000016DA000-memory.dmp upx behavioral1/memory/2200-10-0x0000000000620000-0x00000000016DA000-memory.dmp upx behavioral1/memory/2200-14-0x0000000000620000-0x00000000016DA000-memory.dmp upx behavioral1/memory/2200-18-0x0000000000620000-0x00000000016DA000-memory.dmp upx behavioral1/memory/2200-27-0x0000000000620000-0x00000000016DA000-memory.dmp upx behavioral1/memory/2200-28-0x0000000000620000-0x00000000016DA000-memory.dmp upx behavioral1/memory/2200-29-0x0000000000620000-0x00000000016DA000-memory.dmp upx behavioral1/memory/2200-31-0x0000000000620000-0x00000000016DA000-memory.dmp upx behavioral1/memory/2200-32-0x0000000000620000-0x00000000016DA000-memory.dmp upx behavioral1/memory/2200-33-0x0000000000620000-0x00000000016DA000-memory.dmp upx behavioral1/memory/2200-34-0x0000000000620000-0x00000000016DA000-memory.dmp upx behavioral1/memory/2200-36-0x0000000000620000-0x00000000016DA000-memory.dmp upx behavioral1/memory/2200-37-0x0000000000620000-0x00000000016DA000-memory.dmp upx behavioral1/memory/2200-38-0x0000000000620000-0x00000000016DA000-memory.dmp upx behavioral1/memory/2200-44-0x0000000000620000-0x00000000016DA000-memory.dmp upx behavioral1/memory/2200-47-0x0000000000620000-0x00000000016DA000-memory.dmp upx behavioral1/memory/2200-49-0x0000000000620000-0x00000000016DA000-memory.dmp upx behavioral1/memory/2200-53-0x0000000000620000-0x00000000016DA000-memory.dmp upx behavioral1/memory/2200-57-0x0000000000620000-0x00000000016DA000-memory.dmp upx behavioral1/memory/2200-59-0x0000000000620000-0x00000000016DA000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" d00431e68be1cd7db0143c3d7264c36f_JC.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" d00431e68be1cd7db0143c3d7264c36f_JC.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" d00431e68be1cd7db0143c3d7264c36f_JC.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" d00431e68be1cd7db0143c3d7264c36f_JC.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" d00431e68be1cd7db0143c3d7264c36f_JC.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" d00431e68be1cd7db0143c3d7264c36f_JC.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc d00431e68be1cd7db0143c3d7264c36f_JC.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d00431e68be1cd7db0143c3d7264c36f_JC.exe -
Enumerates connected drives 3 TTPs 8 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\K: d00431e68be1cd7db0143c3d7264c36f_JC.exe File opened (read-only) \??\L: d00431e68be1cd7db0143c3d7264c36f_JC.exe File opened (read-only) \??\M: d00431e68be1cd7db0143c3d7264c36f_JC.exe File opened (read-only) \??\E: d00431e68be1cd7db0143c3d7264c36f_JC.exe File opened (read-only) \??\G: d00431e68be1cd7db0143c3d7264c36f_JC.exe File opened (read-only) \??\H: d00431e68be1cd7db0143c3d7264c36f_JC.exe File opened (read-only) \??\I: d00431e68be1cd7db0143c3d7264c36f_JC.exe File opened (read-only) \??\J: d00431e68be1cd7db0143c3d7264c36f_JC.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\f76450c d00431e68be1cd7db0143c3d7264c36f_JC.exe File opened for modification C:\Windows\SYSTEM.INI d00431e68be1cd7db0143c3d7264c36f_JC.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2200 d00431e68be1cd7db0143c3d7264c36f_JC.exe 2200 d00431e68be1cd7db0143c3d7264c36f_JC.exe -
Suspicious use of AdjustPrivilegeToken 21 IoCs
description pid Process Token: SeDebugPrivilege 2200 d00431e68be1cd7db0143c3d7264c36f_JC.exe Token: SeDebugPrivilege 2200 d00431e68be1cd7db0143c3d7264c36f_JC.exe Token: SeDebugPrivilege 2200 d00431e68be1cd7db0143c3d7264c36f_JC.exe Token: SeDebugPrivilege 2200 d00431e68be1cd7db0143c3d7264c36f_JC.exe Token: SeDebugPrivilege 2200 d00431e68be1cd7db0143c3d7264c36f_JC.exe Token: SeDebugPrivilege 2200 d00431e68be1cd7db0143c3d7264c36f_JC.exe Token: SeDebugPrivilege 2200 d00431e68be1cd7db0143c3d7264c36f_JC.exe Token: SeDebugPrivilege 2200 d00431e68be1cd7db0143c3d7264c36f_JC.exe Token: SeDebugPrivilege 2200 d00431e68be1cd7db0143c3d7264c36f_JC.exe Token: SeDebugPrivilege 2200 d00431e68be1cd7db0143c3d7264c36f_JC.exe Token: SeDebugPrivilege 2200 d00431e68be1cd7db0143c3d7264c36f_JC.exe Token: SeDebugPrivilege 2200 d00431e68be1cd7db0143c3d7264c36f_JC.exe Token: SeDebugPrivilege 2200 d00431e68be1cd7db0143c3d7264c36f_JC.exe Token: SeDebugPrivilege 2200 d00431e68be1cd7db0143c3d7264c36f_JC.exe Token: SeDebugPrivilege 2200 d00431e68be1cd7db0143c3d7264c36f_JC.exe Token: SeDebugPrivilege 2200 d00431e68be1cd7db0143c3d7264c36f_JC.exe Token: SeDebugPrivilege 2200 d00431e68be1cd7db0143c3d7264c36f_JC.exe Token: SeDebugPrivilege 2200 d00431e68be1cd7db0143c3d7264c36f_JC.exe Token: SeDebugPrivilege 2200 d00431e68be1cd7db0143c3d7264c36f_JC.exe Token: SeDebugPrivilege 2200 d00431e68be1cd7db0143c3d7264c36f_JC.exe Token: SeDebugPrivilege 2200 d00431e68be1cd7db0143c3d7264c36f_JC.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2200 wrote to memory of 1136 2200 d00431e68be1cd7db0143c3d7264c36f_JC.exe 14 PID 2200 wrote to memory of 1200 2200 d00431e68be1cd7db0143c3d7264c36f_JC.exe 18 PID 2200 wrote to memory of 1264 2200 d00431e68be1cd7db0143c3d7264c36f_JC.exe 21 PID 2200 wrote to memory of 1648 2200 d00431e68be1cd7db0143c3d7264c36f_JC.exe 22 PID 2200 wrote to memory of 1136 2200 d00431e68be1cd7db0143c3d7264c36f_JC.exe 14 PID 2200 wrote to memory of 1200 2200 d00431e68be1cd7db0143c3d7264c36f_JC.exe 18 PID 2200 wrote to memory of 1264 2200 d00431e68be1cd7db0143c3d7264c36f_JC.exe 21 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d00431e68be1cd7db0143c3d7264c36f_JC.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1136
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1200
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1264
-
C:\Users\Admin\AppData\Local\Temp\d00431e68be1cd7db0143c3d7264c36f_JC.exe"C:\Users\Admin\AppData\Local\Temp\d00431e68be1cd7db0143c3d7264c36f_JC.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2200
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1648
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5