Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
205s -
max time network
215s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
30/12/2023, 02:26
Static task
static1
Behavioral task
behavioral1
Sample
0b9f199a9c215c6e3a9c44ad7839cc8d.exe
Resource
win7-20231215-en
General
-
Target
0b9f199a9c215c6e3a9c44ad7839cc8d.exe
-
Size
381KB
-
MD5
0b9f199a9c215c6e3a9c44ad7839cc8d
-
SHA1
a4f427e217048484f793b9bd2da72e005c602c76
-
SHA256
57ca6e9274725eb3a67a890366a2d94b9c660302be05961e12fa25dd1302fc63
-
SHA512
55614f51a660953106454c7e55ae51beafe0c333a9294965ac4bc390ccd3454ead94f3f9beecad7bd9810ddae4a153f10ddc061b97b3bd460ef8ff5b2ec9ceae
-
SSDEEP
6144:0ZKlg1Vlhw/aAa1Zg30ZTNWSG6/7aDqWCn54YqcDe/5pXsGKLu8NKuPNcRSZ:020VlhganzrWSG6zzWC5kcDextmxKsNj
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 0b9f199a9c215c6e3a9c44ad7839cc8d.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 0b9f199a9c215c6e3a9c44ad7839cc8d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 0b9f199a9c215c6e3a9c44ad7839cc8d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 0b9f199a9c215c6e3a9c44ad7839cc8d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 0b9f199a9c215c6e3a9c44ad7839cc8d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 0b9f199a9c215c6e3a9c44ad7839cc8d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 0b9f199a9c215c6e3a9c44ad7839cc8d.exe -
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system\DisableRegistryTools = "1" 0b9f199a9c215c6e3a9c44ad7839cc8d.exe -
Disables Task Manager via registry modification
-
Modifies Windows Firewall 1 TTPs 1 IoCs
pid Process 4080 netsh.exe -
resource yara_rule behavioral2/memory/2176-1-0x0000000002350000-0x0000000003383000-memory.dmp upx behavioral2/memory/2176-8-0x0000000002350000-0x0000000003383000-memory.dmp upx behavioral2/memory/2176-9-0x0000000002350000-0x0000000003383000-memory.dmp upx behavioral2/memory/2176-22-0x0000000002350000-0x0000000003383000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 0b9f199a9c215c6e3a9c44ad7839cc8d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 0b9f199a9c215c6e3a9c44ad7839cc8d.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc 0b9f199a9c215c6e3a9c44ad7839cc8d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 0b9f199a9c215c6e3a9c44ad7839cc8d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 0b9f199a9c215c6e3a9c44ad7839cc8d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 0b9f199a9c215c6e3a9c44ad7839cc8d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 0b9f199a9c215c6e3a9c44ad7839cc8d.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 0b9f199a9c215c6e3a9c44ad7839cc8d.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI 0b9f199a9c215c6e3a9c44ad7839cc8d.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2176 0b9f199a9c215c6e3a9c44ad7839cc8d.exe 2176 0b9f199a9c215c6e3a9c44ad7839cc8d.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2176 0b9f199a9c215c6e3a9c44ad7839cc8d.exe Token: SeDebugPrivilege 2176 0b9f199a9c215c6e3a9c44ad7839cc8d.exe Token: SeDebugPrivilege 2176 0b9f199a9c215c6e3a9c44ad7839cc8d.exe Token: SeDebugPrivilege 2176 0b9f199a9c215c6e3a9c44ad7839cc8d.exe Token: SeDebugPrivilege 2176 0b9f199a9c215c6e3a9c44ad7839cc8d.exe Token: SeDebugPrivilege 2176 0b9f199a9c215c6e3a9c44ad7839cc8d.exe Token: SeDebugPrivilege 2176 0b9f199a9c215c6e3a9c44ad7839cc8d.exe Token: SeDebugPrivilege 2176 0b9f199a9c215c6e3a9c44ad7839cc8d.exe Token: SeDebugPrivilege 2176 0b9f199a9c215c6e3a9c44ad7839cc8d.exe Token: SeDebugPrivilege 2176 0b9f199a9c215c6e3a9c44ad7839cc8d.exe Token: SeDebugPrivilege 2176 0b9f199a9c215c6e3a9c44ad7839cc8d.exe Token: SeDebugPrivilege 2176 0b9f199a9c215c6e3a9c44ad7839cc8d.exe Token: SeDebugPrivilege 2176 0b9f199a9c215c6e3a9c44ad7839cc8d.exe Token: SeDebugPrivilege 2176 0b9f199a9c215c6e3a9c44ad7839cc8d.exe Token: SeDebugPrivilege 2176 0b9f199a9c215c6e3a9c44ad7839cc8d.exe Token: SeDebugPrivilege 2176 0b9f199a9c215c6e3a9c44ad7839cc8d.exe Token: SeDebugPrivilege 2176 0b9f199a9c215c6e3a9c44ad7839cc8d.exe Token: SeDebugPrivilege 2176 0b9f199a9c215c6e3a9c44ad7839cc8d.exe Token: SeDebugPrivilege 2176 0b9f199a9c215c6e3a9c44ad7839cc8d.exe Token: SeDebugPrivilege 2176 0b9f199a9c215c6e3a9c44ad7839cc8d.exe Token: SeDebugPrivilege 2176 0b9f199a9c215c6e3a9c44ad7839cc8d.exe Token: SeDebugPrivilege 2176 0b9f199a9c215c6e3a9c44ad7839cc8d.exe Token: SeDebugPrivilege 2176 0b9f199a9c215c6e3a9c44ad7839cc8d.exe Token: SeDebugPrivilege 2176 0b9f199a9c215c6e3a9c44ad7839cc8d.exe Token: SeDebugPrivilege 2176 0b9f199a9c215c6e3a9c44ad7839cc8d.exe Token: SeDebugPrivilege 2176 0b9f199a9c215c6e3a9c44ad7839cc8d.exe Token: SeDebugPrivilege 2176 0b9f199a9c215c6e3a9c44ad7839cc8d.exe Token: SeDebugPrivilege 2176 0b9f199a9c215c6e3a9c44ad7839cc8d.exe Token: SeDebugPrivilege 2176 0b9f199a9c215c6e3a9c44ad7839cc8d.exe Token: SeDebugPrivilege 2176 0b9f199a9c215c6e3a9c44ad7839cc8d.exe Token: SeDebugPrivilege 2176 0b9f199a9c215c6e3a9c44ad7839cc8d.exe Token: SeDebugPrivilege 2176 0b9f199a9c215c6e3a9c44ad7839cc8d.exe Token: SeDebugPrivilege 2176 0b9f199a9c215c6e3a9c44ad7839cc8d.exe Token: SeDebugPrivilege 2176 0b9f199a9c215c6e3a9c44ad7839cc8d.exe Token: SeDebugPrivilege 2176 0b9f199a9c215c6e3a9c44ad7839cc8d.exe Token: SeDebugPrivilege 2176 0b9f199a9c215c6e3a9c44ad7839cc8d.exe Token: SeDebugPrivilege 2176 0b9f199a9c215c6e3a9c44ad7839cc8d.exe Token: SeDebugPrivilege 2176 0b9f199a9c215c6e3a9c44ad7839cc8d.exe Token: SeDebugPrivilege 2176 0b9f199a9c215c6e3a9c44ad7839cc8d.exe Token: SeDebugPrivilege 2176 0b9f199a9c215c6e3a9c44ad7839cc8d.exe Token: SeDebugPrivilege 2176 0b9f199a9c215c6e3a9c44ad7839cc8d.exe Token: SeDebugPrivilege 2176 0b9f199a9c215c6e3a9c44ad7839cc8d.exe Token: SeDebugPrivilege 2176 0b9f199a9c215c6e3a9c44ad7839cc8d.exe Token: SeDebugPrivilege 2176 0b9f199a9c215c6e3a9c44ad7839cc8d.exe Token: SeDebugPrivilege 2176 0b9f199a9c215c6e3a9c44ad7839cc8d.exe Token: SeDebugPrivilege 2176 0b9f199a9c215c6e3a9c44ad7839cc8d.exe Token: SeDebugPrivilege 2176 0b9f199a9c215c6e3a9c44ad7839cc8d.exe Token: SeDebugPrivilege 2176 0b9f199a9c215c6e3a9c44ad7839cc8d.exe Token: SeDebugPrivilege 2176 0b9f199a9c215c6e3a9c44ad7839cc8d.exe Token: SeDebugPrivilege 2176 0b9f199a9c215c6e3a9c44ad7839cc8d.exe Token: SeDebugPrivilege 2176 0b9f199a9c215c6e3a9c44ad7839cc8d.exe Token: SeDebugPrivilege 2176 0b9f199a9c215c6e3a9c44ad7839cc8d.exe Token: SeDebugPrivilege 2176 0b9f199a9c215c6e3a9c44ad7839cc8d.exe Token: SeDebugPrivilege 2176 0b9f199a9c215c6e3a9c44ad7839cc8d.exe Token: SeDebugPrivilege 2176 0b9f199a9c215c6e3a9c44ad7839cc8d.exe Token: SeDebugPrivilege 2176 0b9f199a9c215c6e3a9c44ad7839cc8d.exe Token: SeDebugPrivilege 2176 0b9f199a9c215c6e3a9c44ad7839cc8d.exe Token: SeDebugPrivilege 2176 0b9f199a9c215c6e3a9c44ad7839cc8d.exe Token: SeDebugPrivilege 2176 0b9f199a9c215c6e3a9c44ad7839cc8d.exe Token: SeDebugPrivilege 2176 0b9f199a9c215c6e3a9c44ad7839cc8d.exe Token: SeDebugPrivilege 2176 0b9f199a9c215c6e3a9c44ad7839cc8d.exe Token: SeDebugPrivilege 2176 0b9f199a9c215c6e3a9c44ad7839cc8d.exe Token: SeDebugPrivilege 2176 0b9f199a9c215c6e3a9c44ad7839cc8d.exe Token: SeDebugPrivilege 2176 0b9f199a9c215c6e3a9c44ad7839cc8d.exe -
Suspicious use of WriteProcessMemory 26 IoCs
description pid Process procid_target PID 2176 wrote to memory of 4080 2176 0b9f199a9c215c6e3a9c44ad7839cc8d.exe 91 PID 2176 wrote to memory of 4080 2176 0b9f199a9c215c6e3a9c44ad7839cc8d.exe 91 PID 2176 wrote to memory of 4080 2176 0b9f199a9c215c6e3a9c44ad7839cc8d.exe 91 PID 2176 wrote to memory of 812 2176 0b9f199a9c215c6e3a9c44ad7839cc8d.exe 10 PID 2176 wrote to memory of 820 2176 0b9f199a9c215c6e3a9c44ad7839cc8d.exe 9 PID 2176 wrote to memory of 416 2176 0b9f199a9c215c6e3a9c44ad7839cc8d.exe 3 PID 2176 wrote to memory of 2456 2176 0b9f199a9c215c6e3a9c44ad7839cc8d.exe 27 PID 2176 wrote to memory of 2520 2176 0b9f199a9c215c6e3a9c44ad7839cc8d.exe 66 PID 2176 wrote to memory of 2856 2176 0b9f199a9c215c6e3a9c44ad7839cc8d.exe 64 PID 2176 wrote to memory of 3516 2176 0b9f199a9c215c6e3a9c44ad7839cc8d.exe 32 PID 2176 wrote to memory of 3640 2176 0b9f199a9c215c6e3a9c44ad7839cc8d.exe 59 PID 2176 wrote to memory of 3840 2176 0b9f199a9c215c6e3a9c44ad7839cc8d.exe 58 PID 2176 wrote to memory of 3960 2176 0b9f199a9c215c6e3a9c44ad7839cc8d.exe 34 PID 2176 wrote to memory of 4072 2176 0b9f199a9c215c6e3a9c44ad7839cc8d.exe 33 PID 2176 wrote to memory of 3348 2176 0b9f199a9c215c6e3a9c44ad7839cc8d.exe 57 PID 2176 wrote to memory of 3900 2176 0b9f199a9c215c6e3a9c44ad7839cc8d.exe 56 PID 2176 wrote to memory of 4548 2176 0b9f199a9c215c6e3a9c44ad7839cc8d.exe 46 PID 2176 wrote to memory of 4816 2176 0b9f199a9c215c6e3a9c44ad7839cc8d.exe 45 PID 2176 wrote to memory of 3196 2176 0b9f199a9c215c6e3a9c44ad7839cc8d.exe 39 PID 2176 wrote to memory of 4720 2176 0b9f199a9c215c6e3a9c44ad7839cc8d.exe 38 PID 2176 wrote to memory of 4028 2176 0b9f199a9c215c6e3a9c44ad7839cc8d.exe 37 PID 2176 wrote to memory of 1776 2176 0b9f199a9c215c6e3a9c44ad7839cc8d.exe 89 PID 2176 wrote to memory of 724 2176 0b9f199a9c215c6e3a9c44ad7839cc8d.exe 90 PID 2176 wrote to memory of 4080 2176 0b9f199a9c215c6e3a9c44ad7839cc8d.exe 91 PID 2176 wrote to memory of 4080 2176 0b9f199a9c215c6e3a9c44ad7839cc8d.exe 91 PID 2176 wrote to memory of 4280 2176 0b9f199a9c215c6e3a9c44ad7839cc8d.exe 92 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 0b9f199a9c215c6e3a9c44ad7839cc8d.exe
Processes
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:416
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:820
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:812
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2456
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3516
-
C:\Users\Admin\AppData\Local\Temp\0b9f199a9c215c6e3a9c44ad7839cc8d.exe"C:\Users\Admin\AppData\Local\Temp\0b9f199a9c215c6e3a9c44ad7839cc8d.exe"2⤵
- UAC bypass
- Windows security bypass
- Disables RegEdit via registry modification
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2176 -
C:\Windows\SysWOW64\netsh.exenetsh firewall set opmode disable3⤵
- Modifies Windows Firewall
PID:4080 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵PID:4280
-
-
-
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4072
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3960
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:4028
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵PID:4720
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppX53ypgrj20bgndg05hj3tc7z654myszwp.mca1⤵PID:3196
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4816
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:4548
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3900
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3348
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3840
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3640
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2856
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2520
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:1776
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:724
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
309KB
MD5a8bf5f6592a9d5bfd9b8745a8a6f9628
SHA13051829c67726be090ae86183e14bf0b1f756c16
SHA25603eb924c5bba7c06da505cbae7e1e62756837030e4c5fecb15c6b1c95a9ceb70
SHA51284bbf310f71888f8c0a7361afe6ba8d92f341708b8aae547381e590f12b7ab4367e110df40e83fdfea769a7702f1cfdb26e9425786119c74239650ebd7cc5585