Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
24/01/2024, 19:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
72cea29e255463df01abadebbdf7c1cc.dll
Resource
win7-20231215-en
windows7-x64
15 signatures
150 seconds
General
-
Target
72cea29e255463df01abadebbdf7c1cc.dll
-
Size
120KB
-
MD5
72cea29e255463df01abadebbdf7c1cc
-
SHA1
a3b262ea81470b24bf5b3ecee0654d35a205a3b0
-
SHA256
24bf148b673055be29eebb75c4e996a1954ab49eeacc8a53447b65c54834ebbc
-
SHA512
7a7c83d27e4ec852ac3277405143998213ff41d67c925dfddb3e810a3ec419d02766126bc9dadaa9d528b869f20f9bbdd0c73cc3013557db983a47f691d91e4c
-
SSDEEP
3072:if2B+9LW/7QEzTBVFR55u4P5ieokfI9vw6:U2o5+7QsTBg0ieoSWvw6
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f76120a.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f76120a.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f762de4.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f762de4.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f762de4.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f76120a.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76120a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f762de4.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76120a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76120a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76120a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76120a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f762de4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f762de4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f762de4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76120a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76120a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f762de4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f762de4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f762de4.exe -
Executes dropped EXE 3 IoCs
pid Process 2736 f76120a.exe 2596 f761832.exe 2840 f762de4.exe -
Loads dropped DLL 6 IoCs
pid Process 2496 rundll32.exe 2496 rundll32.exe 2496 rundll32.exe 2496 rundll32.exe 2496 rundll32.exe 2496 rundll32.exe -
resource yara_rule behavioral1/memory/2736-11-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2736-14-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2736-15-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2736-16-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2736-18-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2736-21-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2736-23-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2736-26-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2736-30-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2736-33-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2736-59-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2736-60-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2736-61-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2736-62-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2736-63-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2736-65-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2736-79-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2736-82-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2736-84-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2736-86-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2736-105-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2736-147-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2840-152-0x0000000000930000-0x00000000019EA000-memory.dmp upx behavioral1/memory/2840-192-0x0000000000930000-0x00000000019EA000-memory.dmp upx -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f76120a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f762de4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f762de4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f762de4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76120a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f762de4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76120a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76120a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f762de4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76120a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76120a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76120a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f762de4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f762de4.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76120a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f762de4.exe -
Enumerates connected drives 3 TTPs 14 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: f76120a.exe File opened (read-only) \??\I: f76120a.exe File opened (read-only) \??\G: f76120a.exe File opened (read-only) \??\O: f76120a.exe File opened (read-only) \??\P: f76120a.exe File opened (read-only) \??\E: f762de4.exe File opened (read-only) \??\H: f76120a.exe File opened (read-only) \??\J: f76120a.exe File opened (read-only) \??\K: f76120a.exe File opened (read-only) \??\N: f76120a.exe File opened (read-only) \??\Q: f76120a.exe File opened (read-only) \??\L: f76120a.exe File opened (read-only) \??\M: f76120a.exe File opened (read-only) \??\R: f76120a.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\f7612d5 f76120a.exe File opened for modification C:\Windows\SYSTEM.INI f76120a.exe File created C:\Windows\f7668e1 f762de4.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2736 f76120a.exe 2736 f76120a.exe 2840 f762de4.exe -
Suspicious use of AdjustPrivilegeToken 41 IoCs
description pid Process Token: SeDebugPrivilege 2736 f76120a.exe Token: SeDebugPrivilege 2736 f76120a.exe Token: SeDebugPrivilege 2736 f76120a.exe Token: SeDebugPrivilege 2736 f76120a.exe Token: SeDebugPrivilege 2736 f76120a.exe Token: SeDebugPrivilege 2736 f76120a.exe Token: SeDebugPrivilege 2736 f76120a.exe Token: SeDebugPrivilege 2736 f76120a.exe Token: SeDebugPrivilege 2736 f76120a.exe Token: SeDebugPrivilege 2736 f76120a.exe Token: SeDebugPrivilege 2736 f76120a.exe Token: SeDebugPrivilege 2736 f76120a.exe Token: SeDebugPrivilege 2736 f76120a.exe Token: SeDebugPrivilege 2736 f76120a.exe Token: SeDebugPrivilege 2736 f76120a.exe Token: SeDebugPrivilege 2736 f76120a.exe Token: SeDebugPrivilege 2736 f76120a.exe Token: SeDebugPrivilege 2736 f76120a.exe Token: SeDebugPrivilege 2736 f76120a.exe Token: SeDebugPrivilege 2736 f76120a.exe Token: SeDebugPrivilege 2736 f76120a.exe Token: SeDebugPrivilege 2840 f762de4.exe Token: SeDebugPrivilege 2840 f762de4.exe Token: SeDebugPrivilege 2840 f762de4.exe Token: SeDebugPrivilege 2840 f762de4.exe Token: SeDebugPrivilege 2840 f762de4.exe Token: SeDebugPrivilege 2840 f762de4.exe Token: SeDebugPrivilege 2840 f762de4.exe Token: SeDebugPrivilege 2840 f762de4.exe Token: SeDebugPrivilege 2840 f762de4.exe Token: SeDebugPrivilege 2840 f762de4.exe Token: SeDebugPrivilege 2840 f762de4.exe Token: SeDebugPrivilege 2840 f762de4.exe Token: SeDebugPrivilege 2840 f762de4.exe Token: SeDebugPrivilege 2840 f762de4.exe Token: SeDebugPrivilege 2840 f762de4.exe Token: SeDebugPrivilege 2840 f762de4.exe Token: SeDebugPrivilege 2840 f762de4.exe Token: SeDebugPrivilege 2840 f762de4.exe Token: SeDebugPrivilege 2840 f762de4.exe Token: SeDebugPrivilege 2840 f762de4.exe -
Suspicious use of WriteProcessMemory 36 IoCs
description pid Process procid_target PID 2440 wrote to memory of 2496 2440 rundll32.exe 28 PID 2440 wrote to memory of 2496 2440 rundll32.exe 28 PID 2440 wrote to memory of 2496 2440 rundll32.exe 28 PID 2440 wrote to memory of 2496 2440 rundll32.exe 28 PID 2440 wrote to memory of 2496 2440 rundll32.exe 28 PID 2440 wrote to memory of 2496 2440 rundll32.exe 28 PID 2440 wrote to memory of 2496 2440 rundll32.exe 28 PID 2496 wrote to memory of 2736 2496 rundll32.exe 29 PID 2496 wrote to memory of 2736 2496 rundll32.exe 29 PID 2496 wrote to memory of 2736 2496 rundll32.exe 29 PID 2496 wrote to memory of 2736 2496 rundll32.exe 29 PID 2736 wrote to memory of 1040 2736 f76120a.exe 11 PID 2736 wrote to memory of 1068 2736 f76120a.exe 9 PID 2736 wrote to memory of 1092 2736 f76120a.exe 8 PID 2736 wrote to memory of 1616 2736 f76120a.exe 4 PID 2736 wrote to memory of 2440 2736 f76120a.exe 10 PID 2736 wrote to memory of 2496 2736 f76120a.exe 28 PID 2736 wrote to memory of 2496 2736 f76120a.exe 28 PID 2496 wrote to memory of 2596 2496 rundll32.exe 30 PID 2496 wrote to memory of 2596 2496 rundll32.exe 30 PID 2496 wrote to memory of 2596 2496 rundll32.exe 30 PID 2496 wrote to memory of 2596 2496 rundll32.exe 30 PID 2496 wrote to memory of 2840 2496 rundll32.exe 31 PID 2496 wrote to memory of 2840 2496 rundll32.exe 31 PID 2496 wrote to memory of 2840 2496 rundll32.exe 31 PID 2496 wrote to memory of 2840 2496 rundll32.exe 31 PID 2736 wrote to memory of 1040 2736 f76120a.exe 11 PID 2736 wrote to memory of 1068 2736 f76120a.exe 9 PID 2736 wrote to memory of 1092 2736 f76120a.exe 8 PID 2736 wrote to memory of 2596 2736 f76120a.exe 30 PID 2736 wrote to memory of 2596 2736 f76120a.exe 30 PID 2736 wrote to memory of 2840 2736 f76120a.exe 31 PID 2736 wrote to memory of 2840 2736 f76120a.exe 31 PID 2840 wrote to memory of 1040 2840 f762de4.exe 11 PID 2840 wrote to memory of 1068 2840 f762de4.exe 9 PID 2840 wrote to memory of 1092 2840 f762de4.exe 8 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76120a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f762de4.exe
Processes
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1616
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1092
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1068
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\72cea29e255463df01abadebbdf7c1cc.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\72cea29e255463df01abadebbdf7c1cc.dll,#13⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\f76120a.exeC:\Users\Admin\AppData\Local\Temp\f76120a.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2736
-
-
C:\Users\Admin\AppData\Local\Temp\f761832.exeC:\Users\Admin\AppData\Local\Temp\f761832.exe4⤵
- Executes dropped EXE
PID:2596
-
-
C:\Users\Admin\AppData\Local\Temp\f762de4.exeC:\Users\Admin\AppData\Local\Temp\f762de4.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2840
-
-
-
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1040
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD5af754273beeeadce4adb00c0dbd7e947
SHA146c2590810b412ab115916f85164ef20c37dfb84
SHA256623009614fcf78620facf231a4f12ae5039a969fd089240c660c156a4217cf72
SHA5127a91098f58f52c234452ed3364153c429ccc431f8320d15d1ac5290c879f7232279d21b61d8354eba29c05374f01e1bfb71ed55e8fd782f9d90f478274ef305c
-
Filesize
257B
MD534199ce81c36603fba0a5a5b2fb1c397
SHA1d704767766eec0a2eb887cae4a5ad0c4e0b296e2
SHA256e2c8db94b8eb8583d88c3ea696eec71eb5edbe30b227fc584f92434ff08d929b
SHA512e545d4cde55efb749d78015ec2d7aa6fd2334f0c49093de57fa5eb08047791d5a4f3484222fcd0c4243bed564d230cab647fbad24ffb86cc547243b06adeabd4