Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    27s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    14/10/2023, 19:13

General

  • Target

    NEAS.cc34cf099c81695a866d4a1061ed1500.exe

  • Size

    736KB

  • MD5

    cc34cf099c81695a866d4a1061ed1500

  • SHA1

    73f4b40a446b9fcb9f3b9d3539a38e851d4997cd

  • SHA256

    8e81fdae85838d7e65ffb64e02b04942d0da8cf080ad70a19099079f7857b386

  • SHA512

    85f92c6b21e28bfac86d6f223fb3da7be6c21ff3278776435f28a4952009347f9c78681cae313c62da7216e314aa70ab16b87e02976d6081122bd20b2a72eda1

  • SSDEEP

    12288:zTyjXW+48qWywrU4kGFezOAVuJ5PIGww7F5DO3HYffPRLG7Hn:vIXW/8yw1ez54lIYF5SXYHxGb

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

Signatures

  • Modifies firewall policy service 2 TTPs 6 IoCs
  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

  • UAC bypass 3 TTPs 2 IoCs
  • Windows security bypass 2 TTPs 12 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 27 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Windows security modification 2 TTPs 14 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 40 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs
  • System policy modification 1 TTPs 2 IoCs

Processes

  • C:\Windows\system32\Dwm.exe
    "C:\Windows\system32\Dwm.exe"
    1⤵
      PID:1176
    • C:\Windows\system32\DllHost.exe
      C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
      1⤵
        PID:1872
      • C:\Windows\Explorer.EXE
        C:\Windows\Explorer.EXE
        1⤵
          PID:1232
          • C:\Users\Admin\AppData\Local\Temp\NEAS.cc34cf099c81695a866d4a1061ed1500.exe
            "C:\Users\Admin\AppData\Local\Temp\NEAS.cc34cf099c81695a866d4a1061ed1500.exe"
            2⤵
            • Modifies firewall policy service
            • Modifies visibility of file extensions in Explorer
            • Modifies visiblity of hidden/system files in Explorer
            • UAC bypass
            • Windows security bypass
            • Loads dropped DLL
            • Windows security modification
            • Adds Run key to start application
            • Checks whether UAC is enabled
            • Drops file in Windows directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            • System policy modification
            PID:2900
            • C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe
              C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe
              3⤵
              • Modifies firewall policy service
              • Modifies visiblity of hidden/system files in Explorer
              • UAC bypass
              • Windows security bypass
              • Executes dropped EXE
              • Windows security modification
              • Checks whether UAC is enabled
              • Enumerates connected drives
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              • System policy modification
              PID:2732
        • C:\Windows\system32\taskhost.exe
          "taskhost.exe"
          1⤵
            PID:1116

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\0F76BE7F_Rar\rundll32.exe

            Filesize

            664KB

            MD5

            2eb5d76180ce7b3241b281fa79ab3483

            SHA1

            06293dea80e39c7eb7ee2bdb00d60b58d932fa8a

            SHA256

            e1b9beb4617a720d55afaec364941bb18ea2c456a8b06b30a736f0cbb5c297e8

            SHA512

            35f553c76fc67afb88a6a090fcbad6af3e2faae154c9c84bd869714194012525a2d42b76dad855805f107a37c351f0de08fd9a03d8ddc1dd400d64640d81b90b

          • C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe

            Filesize

            736KB

            MD5

            cc34cf099c81695a866d4a1061ed1500

            SHA1

            73f4b40a446b9fcb9f3b9d3539a38e851d4997cd

            SHA256

            8e81fdae85838d7e65ffb64e02b04942d0da8cf080ad70a19099079f7857b386

            SHA512

            85f92c6b21e28bfac86d6f223fb3da7be6c21ff3278776435f28a4952009347f9c78681cae313c62da7216e314aa70ab16b87e02976d6081122bd20b2a72eda1

          • C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe

            Filesize

            736KB

            MD5

            cc34cf099c81695a866d4a1061ed1500

            SHA1

            73f4b40a446b9fcb9f3b9d3539a38e851d4997cd

            SHA256

            8e81fdae85838d7e65ffb64e02b04942d0da8cf080ad70a19099079f7857b386

            SHA512

            85f92c6b21e28bfac86d6f223fb3da7be6c21ff3278776435f28a4952009347f9c78681cae313c62da7216e314aa70ab16b87e02976d6081122bd20b2a72eda1

          • C:\Windows\SYSTEM.INI

            Filesize

            257B

            MD5

            dc86d2678205ca7bd7dca4967c671564

            SHA1

            ea216fa2bd4f1418cbb15a17a6e8671eefafd979

            SHA256

            cece7c4d6a206cc906fe9a6da5bd7d7cc19eaca0a7e4a310de1b7b4600acaaeb

            SHA512

            417268a156e14b14c65e048a2f7fa9600479d206cc025f1bd2cdd7d445f6d064668b669dba02a4fa3996e39088685a501400666990718122f50019ec95508684

          • C:\ichak.exe

            Filesize

            100KB

            MD5

            206bd7787f757c8b9c0718d7d9e6b817

            SHA1

            237c531360a3441c622d2f8d73f5fd3f14160e43

            SHA256

            f8b9027f3057a63d1072ae5d7c528faa5a92d5336566cd3df0b549765832ba6f

            SHA512

            4342f2840b7e726d615ccfde6f27aaa82ed28d6f9bdddb5434cbee80bc8a699ffef1e411b8469f83fa3a81423f68aa4e4b2954e2b224623915ccba776e83df73

          • \Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe

            Filesize

            736KB

            MD5

            cc34cf099c81695a866d4a1061ed1500

            SHA1

            73f4b40a446b9fcb9f3b9d3539a38e851d4997cd

            SHA256

            8e81fdae85838d7e65ffb64e02b04942d0da8cf080ad70a19099079f7857b386

            SHA512

            85f92c6b21e28bfac86d6f223fb3da7be6c21ff3278776435f28a4952009347f9c78681cae313c62da7216e314aa70ab16b87e02976d6081122bd20b2a72eda1

          • memory/1116-9-0x0000000001B80000-0x0000000001B82000-memory.dmp

            Filesize

            8KB

          • memory/2732-72-0x0000000003B00000-0x0000000004B8E000-memory.dmp

            Filesize

            16.6MB

          • memory/2732-76-0x0000000003B00000-0x0000000004B8E000-memory.dmp

            Filesize

            16.6MB

          • memory/2732-186-0x0000000003B00000-0x0000000004B8E000-memory.dmp

            Filesize

            16.6MB

          • memory/2732-185-0x0000000000400000-0x00000000004C0000-memory.dmp

            Filesize

            768KB

          • memory/2732-164-0x0000000000400000-0x00000000004C0000-memory.dmp

            Filesize

            768KB

          • memory/2732-90-0x0000000000140000-0x0000000000142000-memory.dmp

            Filesize

            8KB

          • memory/2732-85-0x0000000003B00000-0x0000000004B8E000-memory.dmp

            Filesize

            16.6MB

          • memory/2732-82-0x0000000003B00000-0x0000000004B8E000-memory.dmp

            Filesize

            16.6MB

          • memory/2732-80-0x0000000003B00000-0x0000000004B8E000-memory.dmp

            Filesize

            16.6MB

          • memory/2732-79-0x0000000003B00000-0x0000000004B8E000-memory.dmp

            Filesize

            16.6MB

          • memory/2732-78-0x0000000003B00000-0x0000000004B8E000-memory.dmp

            Filesize

            16.6MB

          • memory/2732-36-0x0000000000400000-0x00000000004C0000-memory.dmp

            Filesize

            768KB

          • memory/2732-77-0x0000000003B00000-0x0000000004B8E000-memory.dmp

            Filesize

            16.6MB

          • memory/2732-75-0x0000000003B00000-0x0000000004B8E000-memory.dmp

            Filesize

            16.6MB

          • memory/2732-71-0x0000000003B00000-0x0000000004B8E000-memory.dmp

            Filesize

            16.6MB

          • memory/2732-70-0x0000000003B00000-0x0000000004B8E000-memory.dmp

            Filesize

            16.6MB

          • memory/2732-54-0x0000000003B00000-0x0000000004B8E000-memory.dmp

            Filesize

            16.6MB

          • memory/2732-63-0x0000000003B00000-0x0000000004B8E000-memory.dmp

            Filesize

            16.6MB

          • memory/2732-53-0x0000000003B00000-0x0000000004B8E000-memory.dmp

            Filesize

            16.6MB

          • memory/2732-55-0x0000000003B00000-0x0000000004B8E000-memory.dmp

            Filesize

            16.6MB

          • memory/2732-58-0x0000000003B00000-0x0000000004B8E000-memory.dmp

            Filesize

            16.6MB

          • memory/2732-67-0x0000000000140000-0x0000000000142000-memory.dmp

            Filesize

            8KB

          • memory/2732-69-0x0000000000290000-0x0000000000291000-memory.dmp

            Filesize

            4KB

          • memory/2900-14-0x00000000026B0000-0x000000000373E000-memory.dmp

            Filesize

            16.6MB

          • memory/2900-19-0x0000000000170000-0x0000000000171000-memory.dmp

            Filesize

            4KB

          • memory/2900-49-0x0000000000400000-0x00000000004C0000-memory.dmp

            Filesize

            768KB

          • memory/2900-0-0x0000000000400000-0x00000000004C0000-memory.dmp

            Filesize

            768KB

          • memory/2900-34-0x00000000026B0000-0x000000000373E000-memory.dmp

            Filesize

            16.6MB

          • memory/2900-18-0x00000000026B0000-0x000000000373E000-memory.dmp

            Filesize

            16.6MB

          • memory/2900-17-0x0000000000130000-0x0000000000132000-memory.dmp

            Filesize

            8KB

          • memory/2900-37-0x0000000000130000-0x0000000000132000-memory.dmp

            Filesize

            8KB

          • memory/2900-8-0x00000000026B0000-0x000000000373E000-memory.dmp

            Filesize

            16.6MB

          • memory/2900-28-0x00000000026B0000-0x000000000373E000-memory.dmp

            Filesize

            16.6MB

          • memory/2900-7-0x00000000026B0000-0x000000000373E000-memory.dmp

            Filesize

            16.6MB

          • memory/2900-27-0x00000000026B0000-0x000000000373E000-memory.dmp

            Filesize

            16.6MB

          • memory/2900-26-0x00000000026B0000-0x000000000373E000-memory.dmp

            Filesize

            16.6MB

          • memory/2900-5-0x00000000026B0000-0x000000000373E000-memory.dmp

            Filesize

            16.6MB

          • memory/2900-23-0x00000000026B0000-0x000000000373E000-memory.dmp

            Filesize

            16.6MB

          • memory/2900-22-0x0000000000170000-0x0000000000171000-memory.dmp

            Filesize

            4KB

          • memory/2900-20-0x0000000000130000-0x0000000000132000-memory.dmp

            Filesize

            8KB