Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    122s
  • max time network
    127s
  • platform
    windows7_x64
  • resource
    win7-20231020-en
  • resource tags

    arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
  • submitted
    22/10/2023, 15:32

General

  • Target

    NEAS.7444ca9be507f7fa198023822cc1a620_JC.dll

  • Size

    120KB

  • MD5

    7444ca9be507f7fa198023822cc1a620

  • SHA1

    7ed05d2244091f15b793b28a9e646f3baf0e86df

  • SHA256

    edf6405fadb1f3931a8119f5cfdad3f89f023898837345bf546d815b36be7d62

  • SHA512

    0bee40b8c8ee3d3cfad93dccdadd3d40cf9ac05c5289ab14e3687c6239721b68fbbaa763f0af140e183c30932c33371c54d8978501d57d3b6479ed98fa0ac1c7

  • SSDEEP

    3072:zyil/H99lEtGCp0m5kJ8OMFiFY5Cy6/fz:eitHDytl0sINfZyo

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Signatures

  • Modifies firewall policy service 2 TTPs 3 IoCs
  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

  • UAC bypass 3 TTPs 1 IoCs
  • Windows security bypass 2 TTPs 6 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 6 IoCs
  • UPX packed file 22 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Windows security modification 2 TTPs 7 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Enumerates connected drives 3 TTPs 8 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 21 IoCs
  • Suspicious use of WriteProcessMemory 33 IoCs
  • System policy modification 1 TTPs 1 IoCs

Processes

  • C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    1⤵
      PID:1152
    • C:\Windows\Explorer.EXE
      C:\Windows\Explorer.EXE
      1⤵
        PID:1300
        • C:\Windows\system32\rundll32.exe
          rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.7444ca9be507f7fa198023822cc1a620_JC.dll,#1
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:3032
          • C:\Windows\SysWOW64\rundll32.exe
            rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.7444ca9be507f7fa198023822cc1a620_JC.dll,#1
            3⤵
            • Loads dropped DLL
            • Suspicious use of WriteProcessMemory
            PID:1616
            • C:\Users\Admin\AppData\Local\Temp\f768804.exe
              C:\Users\Admin\AppData\Local\Temp\f768804.exe
              4⤵
              • Modifies firewall policy service
              • UAC bypass
              • Windows security bypass
              • Executes dropped EXE
              • Windows security modification
              • Checks whether UAC is enabled
              • Enumerates connected drives
              • Drops file in Windows directory
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              • System policy modification
              PID:2252
            • C:\Users\Admin\AppData\Local\Temp\f769138.exe
              C:\Users\Admin\AppData\Local\Temp\f769138.exe
              4⤵
              • Executes dropped EXE
              PID:1028
            • C:\Users\Admin\AppData\Local\Temp\f76a209.exe
              C:\Users\Admin\AppData\Local\Temp\f76a209.exe
              4⤵
              • Executes dropped EXE
              PID:2304
      • C:\Windows\system32\DllHost.exe
        C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
        1⤵
          PID:1956
        • C:\Windows\system32\Dwm.exe
          "C:\Windows\system32\Dwm.exe"
          1⤵
            PID:1232

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\f768804.exe

            Filesize

            97KB

            MD5

            db5cdc3f3373cf7cfc4f483b75bb3016

            SHA1

            30e9cb4cd8b233bd9d3c0f05139d5758aa2c2533

            SHA256

            0338996034b265b34211ec5bec3908cac6bcfc082c7b964ead43a2f92537861c

            SHA512

            871cf9cd382c31b5d883795f24b97a92d70145bef592b560d9a3da1a7e25d31d155648633917a0b357510a7afa061523348681694f12e7d61cabae74cec74de4

          • C:\Users\Admin\AppData\Local\Temp\f768804.exe

            Filesize

            97KB

            MD5

            db5cdc3f3373cf7cfc4f483b75bb3016

            SHA1

            30e9cb4cd8b233bd9d3c0f05139d5758aa2c2533

            SHA256

            0338996034b265b34211ec5bec3908cac6bcfc082c7b964ead43a2f92537861c

            SHA512

            871cf9cd382c31b5d883795f24b97a92d70145bef592b560d9a3da1a7e25d31d155648633917a0b357510a7afa061523348681694f12e7d61cabae74cec74de4

          • C:\Users\Admin\AppData\Local\Temp\f769138.exe

            Filesize

            97KB

            MD5

            db5cdc3f3373cf7cfc4f483b75bb3016

            SHA1

            30e9cb4cd8b233bd9d3c0f05139d5758aa2c2533

            SHA256

            0338996034b265b34211ec5bec3908cac6bcfc082c7b964ead43a2f92537861c

            SHA512

            871cf9cd382c31b5d883795f24b97a92d70145bef592b560d9a3da1a7e25d31d155648633917a0b357510a7afa061523348681694f12e7d61cabae74cec74de4

          • C:\Users\Admin\AppData\Local\Temp\f76a209.exe

            Filesize

            97KB

            MD5

            db5cdc3f3373cf7cfc4f483b75bb3016

            SHA1

            30e9cb4cd8b233bd9d3c0f05139d5758aa2c2533

            SHA256

            0338996034b265b34211ec5bec3908cac6bcfc082c7b964ead43a2f92537861c

            SHA512

            871cf9cd382c31b5d883795f24b97a92d70145bef592b560d9a3da1a7e25d31d155648633917a0b357510a7afa061523348681694f12e7d61cabae74cec74de4

          • \Users\Admin\AppData\Local\Temp\f768804.exe

            Filesize

            97KB

            MD5

            db5cdc3f3373cf7cfc4f483b75bb3016

            SHA1

            30e9cb4cd8b233bd9d3c0f05139d5758aa2c2533

            SHA256

            0338996034b265b34211ec5bec3908cac6bcfc082c7b964ead43a2f92537861c

            SHA512

            871cf9cd382c31b5d883795f24b97a92d70145bef592b560d9a3da1a7e25d31d155648633917a0b357510a7afa061523348681694f12e7d61cabae74cec74de4

          • \Users\Admin\AppData\Local\Temp\f768804.exe

            Filesize

            97KB

            MD5

            db5cdc3f3373cf7cfc4f483b75bb3016

            SHA1

            30e9cb4cd8b233bd9d3c0f05139d5758aa2c2533

            SHA256

            0338996034b265b34211ec5bec3908cac6bcfc082c7b964ead43a2f92537861c

            SHA512

            871cf9cd382c31b5d883795f24b97a92d70145bef592b560d9a3da1a7e25d31d155648633917a0b357510a7afa061523348681694f12e7d61cabae74cec74de4

          • \Users\Admin\AppData\Local\Temp\f769138.exe

            Filesize

            97KB

            MD5

            db5cdc3f3373cf7cfc4f483b75bb3016

            SHA1

            30e9cb4cd8b233bd9d3c0f05139d5758aa2c2533

            SHA256

            0338996034b265b34211ec5bec3908cac6bcfc082c7b964ead43a2f92537861c

            SHA512

            871cf9cd382c31b5d883795f24b97a92d70145bef592b560d9a3da1a7e25d31d155648633917a0b357510a7afa061523348681694f12e7d61cabae74cec74de4

          • \Users\Admin\AppData\Local\Temp\f769138.exe

            Filesize

            97KB

            MD5

            db5cdc3f3373cf7cfc4f483b75bb3016

            SHA1

            30e9cb4cd8b233bd9d3c0f05139d5758aa2c2533

            SHA256

            0338996034b265b34211ec5bec3908cac6bcfc082c7b964ead43a2f92537861c

            SHA512

            871cf9cd382c31b5d883795f24b97a92d70145bef592b560d9a3da1a7e25d31d155648633917a0b357510a7afa061523348681694f12e7d61cabae74cec74de4

          • \Users\Admin\AppData\Local\Temp\f76a209.exe

            Filesize

            97KB

            MD5

            db5cdc3f3373cf7cfc4f483b75bb3016

            SHA1

            30e9cb4cd8b233bd9d3c0f05139d5758aa2c2533

            SHA256

            0338996034b265b34211ec5bec3908cac6bcfc082c7b964ead43a2f92537861c

            SHA512

            871cf9cd382c31b5d883795f24b97a92d70145bef592b560d9a3da1a7e25d31d155648633917a0b357510a7afa061523348681694f12e7d61cabae74cec74de4

          • \Users\Admin\AppData\Local\Temp\f76a209.exe

            Filesize

            97KB

            MD5

            db5cdc3f3373cf7cfc4f483b75bb3016

            SHA1

            30e9cb4cd8b233bd9d3c0f05139d5758aa2c2533

            SHA256

            0338996034b265b34211ec5bec3908cac6bcfc082c7b964ead43a2f92537861c

            SHA512

            871cf9cd382c31b5d883795f24b97a92d70145bef592b560d9a3da1a7e25d31d155648633917a0b357510a7afa061523348681694f12e7d61cabae74cec74de4

          • memory/1028-97-0x0000000000360000-0x0000000000362000-memory.dmp

            Filesize

            8KB

          • memory/1028-99-0x00000000003B0000-0x00000000003B1000-memory.dmp

            Filesize

            4KB

          • memory/1028-47-0x0000000000400000-0x0000000000412000-memory.dmp

            Filesize

            72KB

          • memory/1028-98-0x0000000000360000-0x0000000000362000-memory.dmp

            Filesize

            8KB

          • memory/1028-139-0x0000000000360000-0x0000000000362000-memory.dmp

            Filesize

            8KB

          • memory/1152-17-0x00000000004F0000-0x00000000004F2000-memory.dmp

            Filesize

            8KB

          • memory/1616-11-0x00000000000B0000-0x00000000000C2000-memory.dmp

            Filesize

            72KB

          • memory/1616-44-0x0000000000310000-0x0000000000322000-memory.dmp

            Filesize

            72KB

          • memory/1616-46-0x0000000000310000-0x0000000000322000-memory.dmp

            Filesize

            72KB

          • memory/1616-33-0x00000000001C0000-0x00000000001C1000-memory.dmp

            Filesize

            4KB

          • memory/1616-30-0x00000000001A0000-0x00000000001A2000-memory.dmp

            Filesize

            8KB

          • memory/1616-28-0x00000000001C0000-0x00000000001C1000-memory.dmp

            Filesize

            4KB

          • memory/1616-27-0x00000000001A0000-0x00000000001A2000-memory.dmp

            Filesize

            8KB

          • memory/1616-78-0x0000000000310000-0x0000000000322000-memory.dmp

            Filesize

            72KB

          • memory/1616-151-0x0000000000310000-0x0000000000322000-memory.dmp

            Filesize

            72KB

          • memory/1616-77-0x00000000000B0000-0x00000000000B6000-memory.dmp

            Filesize

            24KB

          • memory/1616-4-0x00000000000B0000-0x00000000000C2000-memory.dmp

            Filesize

            72KB

          • memory/1616-72-0x00000000001A0000-0x00000000001A2000-memory.dmp

            Filesize

            8KB

          • memory/1616-1-0x0000000010000000-0x0000000010020000-memory.dmp

            Filesize

            128KB

          • memory/2252-61-0x0000000000520000-0x00000000015DA000-memory.dmp

            Filesize

            16.7MB

          • memory/2252-85-0x00000000037C0000-0x00000000037C2000-memory.dmp

            Filesize

            8KB

          • memory/2252-62-0x0000000000520000-0x00000000015DA000-memory.dmp

            Filesize

            16.7MB

          • memory/2252-63-0x0000000000520000-0x00000000015DA000-memory.dmp

            Filesize

            16.7MB

          • memory/2252-64-0x0000000000520000-0x00000000015DA000-memory.dmp

            Filesize

            16.7MB

          • memory/2252-59-0x0000000000520000-0x00000000015DA000-memory.dmp

            Filesize

            16.7MB

          • memory/2252-50-0x0000000000520000-0x00000000015DA000-memory.dmp

            Filesize

            16.7MB

          • memory/2252-55-0x00000000037C0000-0x00000000037C2000-memory.dmp

            Filesize

            8KB

          • memory/2252-25-0x0000000000520000-0x00000000015DA000-memory.dmp

            Filesize

            16.7MB

          • memory/2252-76-0x0000000000520000-0x00000000015DA000-memory.dmp

            Filesize

            16.7MB

          • memory/2252-10-0x0000000000400000-0x0000000000412000-memory.dmp

            Filesize

            72KB

          • memory/2252-52-0x0000000003910000-0x0000000003911000-memory.dmp

            Filesize

            4KB

          • memory/2252-32-0x0000000000520000-0x00000000015DA000-memory.dmp

            Filesize

            16.7MB

          • memory/2252-81-0x0000000000520000-0x00000000015DA000-memory.dmp

            Filesize

            16.7MB

          • memory/2252-83-0x0000000000520000-0x00000000015DA000-memory.dmp

            Filesize

            16.7MB

          • memory/2252-60-0x0000000000520000-0x00000000015DA000-memory.dmp

            Filesize

            16.7MB

          • memory/2252-84-0x0000000000520000-0x00000000015DA000-memory.dmp

            Filesize

            16.7MB

          • memory/2252-86-0x0000000000520000-0x00000000015DA000-memory.dmp

            Filesize

            16.7MB

          • memory/2252-88-0x0000000000520000-0x00000000015DA000-memory.dmp

            Filesize

            16.7MB

          • memory/2252-20-0x0000000000520000-0x00000000015DA000-memory.dmp

            Filesize

            16.7MB

          • memory/2252-16-0x0000000000520000-0x00000000015DA000-memory.dmp

            Filesize

            16.7MB

          • memory/2252-15-0x0000000000520000-0x00000000015DA000-memory.dmp

            Filesize

            16.7MB

          • memory/2252-144-0x0000000000520000-0x00000000015DA000-memory.dmp

            Filesize

            16.7MB

          • memory/2252-145-0x0000000000400000-0x0000000000412000-memory.dmp

            Filesize

            72KB

          • memory/2252-108-0x0000000000520000-0x00000000015DA000-memory.dmp

            Filesize

            16.7MB

          • memory/2252-110-0x0000000000520000-0x00000000015DA000-memory.dmp

            Filesize

            16.7MB

          • memory/2252-13-0x0000000000520000-0x00000000015DA000-memory.dmp

            Filesize

            16.7MB

          • memory/2304-107-0x00000000003F0000-0x00000000003F1000-memory.dmp

            Filesize

            4KB

          • memory/2304-105-0x00000000003E0000-0x00000000003E2000-memory.dmp

            Filesize

            8KB

          • memory/2304-146-0x00000000003E0000-0x00000000003E2000-memory.dmp

            Filesize

            8KB

          • memory/2304-150-0x0000000000400000-0x0000000000412000-memory.dmp

            Filesize

            72KB

          • memory/2304-79-0x0000000000400000-0x0000000000412000-memory.dmp

            Filesize

            72KB