Analysis
-
max time kernel
1s -
max time network
53s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
01/01/2024, 09:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c67d131373e5e00778d94b188331362e.exe
Resource
win7-20231215-en
windows7-x64
16 signatures
150 seconds
General
-
Target
c67d131373e5e00778d94b188331362e.exe
-
Size
97KB
-
MD5
c67d131373e5e00778d94b188331362e
-
SHA1
f7b5c808c8d9d2861c1cd564ad7269f58907d6ff
-
SHA256
9a3940f8efd743b121307fc85b52adeb6172d6f2c4f386c3c4cab29f18c2d272
-
SHA512
5c67ed2572f429cfe6991a58b430fde5383210e393d6e611fcf10cfe28475c6e799446db18bedc454452265441fe7f7196f55075e1129ca5d1d12aa3606b6c61
-
SSDEEP
3072:PQbdYqdLQJWYSJlmsTPUMcRK59WrIHhUA:obdYqRY2/QK59WrIHhUA
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 2 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" c67d131373e5e00778d94b188331362e.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" c67d131373e5e00778d94b188331362e.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" c67d131373e5e00778d94b188331362e.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" c67d131373e5e00778d94b188331362e.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" c67d131373e5e00778d94b188331362e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" c67d131373e5e00778d94b188331362e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" c67d131373e5e00778d94b188331362e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" c67d131373e5e00778d94b188331362e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" c67d131373e5e00778d94b188331362e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" c67d131373e5e00778d94b188331362e.exe -
resource yara_rule behavioral2/memory/1716-2-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/1716-4-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/1716-5-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/1716-11-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/1716-8-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/1716-17-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/1716-18-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/1716-19-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/1716-20-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/1716-21-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/1716-22-0x00000000007F0000-0x00000000018AA000-memory.dmp upx -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc c67d131373e5e00778d94b188331362e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" c67d131373e5e00778d94b188331362e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" c67d131373e5e00778d94b188331362e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" c67d131373e5e00778d94b188331362e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" c67d131373e5e00778d94b188331362e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" c67d131373e5e00778d94b188331362e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" c67d131373e5e00778d94b188331362e.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" c67d131373e5e00778d94b188331362e.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\e574af3 c67d131373e5e00778d94b188331362e.exe File opened for modification C:\Windows\SYSTEM.INI c67d131373e5e00778d94b188331362e.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings c67d131373e5e00778d94b188331362e.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1716 c67d131373e5e00778d94b188331362e.exe 1716 c67d131373e5e00778d94b188331362e.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1716 c67d131373e5e00778d94b188331362e.exe Token: SeDebugPrivilege 1716 c67d131373e5e00778d94b188331362e.exe Token: SeDebugPrivilege 1716 c67d131373e5e00778d94b188331362e.exe Token: SeDebugPrivilege 1716 c67d131373e5e00778d94b188331362e.exe Token: SeDebugPrivilege 1716 c67d131373e5e00778d94b188331362e.exe Token: SeDebugPrivilege 1716 c67d131373e5e00778d94b188331362e.exe Token: SeDebugPrivilege 1716 c67d131373e5e00778d94b188331362e.exe Token: SeDebugPrivilege 1716 c67d131373e5e00778d94b188331362e.exe Token: SeDebugPrivilege 1716 c67d131373e5e00778d94b188331362e.exe Token: SeDebugPrivilege 1716 c67d131373e5e00778d94b188331362e.exe Token: SeDebugPrivilege 1716 c67d131373e5e00778d94b188331362e.exe Token: SeDebugPrivilege 1716 c67d131373e5e00778d94b188331362e.exe Token: SeDebugPrivilege 1716 c67d131373e5e00778d94b188331362e.exe Token: SeDebugPrivilege 1716 c67d131373e5e00778d94b188331362e.exe Token: SeDebugPrivilege 1716 c67d131373e5e00778d94b188331362e.exe Token: SeDebugPrivilege 1716 c67d131373e5e00778d94b188331362e.exe Token: SeDebugPrivilege 1716 c67d131373e5e00778d94b188331362e.exe Token: SeDebugPrivilege 1716 c67d131373e5e00778d94b188331362e.exe Token: SeDebugPrivilege 1716 c67d131373e5e00778d94b188331362e.exe Token: SeDebugPrivilege 1716 c67d131373e5e00778d94b188331362e.exe Token: SeDebugPrivilege 1716 c67d131373e5e00778d94b188331362e.exe Token: SeDebugPrivilege 1716 c67d131373e5e00778d94b188331362e.exe Token: SeDebugPrivilege 1716 c67d131373e5e00778d94b188331362e.exe Token: SeDebugPrivilege 1716 c67d131373e5e00778d94b188331362e.exe Token: SeDebugPrivilege 1716 c67d131373e5e00778d94b188331362e.exe Token: SeDebugPrivilege 1716 c67d131373e5e00778d94b188331362e.exe Token: SeDebugPrivilege 1716 c67d131373e5e00778d94b188331362e.exe Token: SeDebugPrivilege 1716 c67d131373e5e00778d94b188331362e.exe Token: SeDebugPrivilege 1716 c67d131373e5e00778d94b188331362e.exe Token: SeDebugPrivilege 1716 c67d131373e5e00778d94b188331362e.exe Token: SeDebugPrivilege 1716 c67d131373e5e00778d94b188331362e.exe Token: SeDebugPrivilege 1716 c67d131373e5e00778d94b188331362e.exe Token: SeDebugPrivilege 1716 c67d131373e5e00778d94b188331362e.exe Token: SeDebugPrivilege 1716 c67d131373e5e00778d94b188331362e.exe Token: SeDebugPrivilege 1716 c67d131373e5e00778d94b188331362e.exe Token: SeDebugPrivilege 1716 c67d131373e5e00778d94b188331362e.exe Token: SeDebugPrivilege 1716 c67d131373e5e00778d94b188331362e.exe Token: SeDebugPrivilege 1716 c67d131373e5e00778d94b188331362e.exe Token: SeDebugPrivilege 1716 c67d131373e5e00778d94b188331362e.exe Token: SeDebugPrivilege 1716 c67d131373e5e00778d94b188331362e.exe Token: SeDebugPrivilege 1716 c67d131373e5e00778d94b188331362e.exe Token: SeDebugPrivilege 1716 c67d131373e5e00778d94b188331362e.exe Token: SeDebugPrivilege 1716 c67d131373e5e00778d94b188331362e.exe Token: SeDebugPrivilege 1716 c67d131373e5e00778d94b188331362e.exe Token: SeDebugPrivilege 1716 c67d131373e5e00778d94b188331362e.exe Token: SeDebugPrivilege 1716 c67d131373e5e00778d94b188331362e.exe Token: SeDebugPrivilege 1716 c67d131373e5e00778d94b188331362e.exe Token: SeDebugPrivilege 1716 c67d131373e5e00778d94b188331362e.exe Token: SeDebugPrivilege 1716 c67d131373e5e00778d94b188331362e.exe Token: SeDebugPrivilege 1716 c67d131373e5e00778d94b188331362e.exe Token: SeDebugPrivilege 1716 c67d131373e5e00778d94b188331362e.exe Token: SeDebugPrivilege 1716 c67d131373e5e00778d94b188331362e.exe Token: SeDebugPrivilege 1716 c67d131373e5e00778d94b188331362e.exe Token: SeDebugPrivilege 1716 c67d131373e5e00778d94b188331362e.exe Token: SeDebugPrivilege 1716 c67d131373e5e00778d94b188331362e.exe Token: SeDebugPrivilege 1716 c67d131373e5e00778d94b188331362e.exe Token: SeDebugPrivilege 1716 c67d131373e5e00778d94b188331362e.exe Token: SeDebugPrivilege 1716 c67d131373e5e00778d94b188331362e.exe Token: SeDebugPrivilege 1716 c67d131373e5e00778d94b188331362e.exe Token: SeDebugPrivilege 1716 c67d131373e5e00778d94b188331362e.exe Token: SeDebugPrivilege 1716 c67d131373e5e00778d94b188331362e.exe Token: SeDebugPrivilege 1716 c67d131373e5e00778d94b188331362e.exe Token: SeDebugPrivilege 1716 c67d131373e5e00778d94b188331362e.exe Token: SeDebugPrivilege 1716 c67d131373e5e00778d94b188331362e.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 1716 wrote to memory of 768 1716 c67d131373e5e00778d94b188331362e.exe 8 PID 1716 wrote to memory of 772 1716 c67d131373e5e00778d94b188331362e.exe 92 PID 1716 wrote to memory of 64 1716 c67d131373e5e00778d94b188331362e.exe 9 PID 1716 wrote to memory of 2760 1716 c67d131373e5e00778d94b188331362e.exe 53 PID 1716 wrote to memory of 2812 1716 c67d131373e5e00778d94b188331362e.exe 52 PID 1716 wrote to memory of 3048 1716 c67d131373e5e00778d94b188331362e.exe 50 PID 1716 wrote to memory of 3340 1716 c67d131373e5e00778d94b188331362e.exe 47 PID 1716 wrote to memory of 3544 1716 c67d131373e5e00778d94b188331362e.exe 45 PID 1716 wrote to memory of 3728 1716 c67d131373e5e00778d94b188331362e.exe 44 PID 1716 wrote to memory of 3848 1716 c67d131373e5e00778d94b188331362e.exe 43 PID 1716 wrote to memory of 3912 1716 c67d131373e5e00778d94b188331362e.exe 42 PID 1716 wrote to memory of 4000 1716 c67d131373e5e00778d94b188331362e.exe 41 PID 1716 wrote to memory of 3812 1716 c67d131373e5e00778d94b188331362e.exe 40 PID 1716 wrote to memory of 3536 1716 c67d131373e5e00778d94b188331362e.exe 25 PID 1716 wrote to memory of 1284 1716 c67d131373e5e00778d94b188331362e.exe 24 PID 1716 wrote to memory of 3528 1716 c67d131373e5e00778d94b188331362e.exe 16 PID 1716 wrote to memory of 2592 1716 c67d131373e5e00778d94b188331362e.exe 15 PID 1716 wrote to memory of 536 1716 c67d131373e5e00778d94b188331362e.exe 14 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" c67d131373e5e00778d94b188331362e.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:768
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:64
-
C:\Users\Admin\AppData\Local\Temp\c67d131373e5e00778d94b188331362e.exe"C:\Users\Admin\AppData\Local\Temp\c67d131373e5e00778d94b188331362e.exe"1⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1716
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:536
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵PID:2592
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppX53ypgrj20bgndg05hj3tc7z654myszwp.mca1⤵PID:3528
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:1284
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:3536
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3812
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4000
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3912
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3848
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3728
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3544
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3340
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:3048
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2812
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2760
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:772
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1