Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
29/02/2024, 05:41
Static task
static1
Behavioral task
behavioral1
Sample
add36b5b21f775d2ea11c57c78fe7947.exe
Resource
win7-20240221-en
General
-
Target
add36b5b21f775d2ea11c57c78fe7947.exe
-
Size
96KB
-
MD5
add36b5b21f775d2ea11c57c78fe7947
-
SHA1
3ec05dfe7a3fdc01c17f74aac6daf39116eab6ef
-
SHA256
6dec06440131cf4c255ee5e482aca9ad4d913576091502fac8ab5b038887a281
-
SHA512
3e0f7eb44c7139f56914297cf2bb6a51b326b8953a0a4a8623ad694c8914036b1ff74ff5712306fa060cd91a23966868b6bce7a312dee76d77f57fa1c49f4aa8
-
SSDEEP
3072:dYNKSA4HhT+Tg3H1ysg8HZDUX8RAgtwxwmJ:dYNVAm+Tg3VIr8OwwimJ
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Modifies firewall policy service 2 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" add36b5b21f775d2ea11c57c78fe7947.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" add36b5b21f775d2ea11c57c78fe7947.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" add36b5b21f775d2ea11c57c78fe7947.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" add36b5b21f775d2ea11c57c78fe7947.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" add36b5b21f775d2ea11c57c78fe7947.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" add36b5b21f775d2ea11c57c78fe7947.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" add36b5b21f775d2ea11c57c78fe7947.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" add36b5b21f775d2ea11c57c78fe7947.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" add36b5b21f775d2ea11c57c78fe7947.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" add36b5b21f775d2ea11c57c78fe7947.exe -
resource yara_rule behavioral1/memory/2104-1-0x0000000001DC0000-0x0000000002E4E000-memory.dmp upx behavioral1/memory/2104-2-0x0000000001DC0000-0x0000000002E4E000-memory.dmp upx behavioral1/memory/2104-5-0x0000000001DC0000-0x0000000002E4E000-memory.dmp upx behavioral1/memory/2104-6-0x0000000001DC0000-0x0000000002E4E000-memory.dmp upx behavioral1/memory/2104-4-0x0000000001DC0000-0x0000000002E4E000-memory.dmp upx behavioral1/memory/2104-7-0x0000000001DC0000-0x0000000002E4E000-memory.dmp upx behavioral1/memory/2104-9-0x0000000001DC0000-0x0000000002E4E000-memory.dmp upx behavioral1/memory/2104-12-0x0000000001DC0000-0x0000000002E4E000-memory.dmp upx behavioral1/memory/2104-14-0x0000000001DC0000-0x0000000002E4E000-memory.dmp upx behavioral1/memory/2104-16-0x0000000001DC0000-0x0000000002E4E000-memory.dmp upx behavioral1/memory/2104-28-0x0000000001DC0000-0x0000000002E4E000-memory.dmp upx behavioral1/memory/2104-27-0x0000000001DC0000-0x0000000002E4E000-memory.dmp upx behavioral1/memory/2104-29-0x0000000001DC0000-0x0000000002E4E000-memory.dmp upx behavioral1/memory/2104-30-0x0000000001DC0000-0x0000000002E4E000-memory.dmp upx behavioral1/memory/2104-31-0x0000000001DC0000-0x0000000002E4E000-memory.dmp upx behavioral1/memory/2104-33-0x0000000001DC0000-0x0000000002E4E000-memory.dmp upx behavioral1/memory/2104-34-0x0000000001DC0000-0x0000000002E4E000-memory.dmp upx behavioral1/memory/2104-35-0x0000000001DC0000-0x0000000002E4E000-memory.dmp upx behavioral1/memory/2104-37-0x0000000001DC0000-0x0000000002E4E000-memory.dmp upx behavioral1/memory/2104-39-0x0000000001DC0000-0x0000000002E4E000-memory.dmp upx behavioral1/memory/2104-41-0x0000000001DC0000-0x0000000002E4E000-memory.dmp upx behavioral1/memory/2104-49-0x0000000001DC0000-0x0000000002E4E000-memory.dmp upx behavioral1/memory/2104-51-0x0000000001DC0000-0x0000000002E4E000-memory.dmp upx behavioral1/memory/2104-53-0x0000000001DC0000-0x0000000002E4E000-memory.dmp upx behavioral1/memory/2104-55-0x0000000001DC0000-0x0000000002E4E000-memory.dmp upx behavioral1/memory/2104-57-0x0000000001DC0000-0x0000000002E4E000-memory.dmp upx behavioral1/memory/2104-59-0x0000000001DC0000-0x0000000002E4E000-memory.dmp upx behavioral1/memory/2104-61-0x0000000001DC0000-0x0000000002E4E000-memory.dmp upx behavioral1/memory/2104-63-0x0000000001DC0000-0x0000000002E4E000-memory.dmp upx behavioral1/memory/2104-65-0x0000000001DC0000-0x0000000002E4E000-memory.dmp upx -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc add36b5b21f775d2ea11c57c78fe7947.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" add36b5b21f775d2ea11c57c78fe7947.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" add36b5b21f775d2ea11c57c78fe7947.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" add36b5b21f775d2ea11c57c78fe7947.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" add36b5b21f775d2ea11c57c78fe7947.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" add36b5b21f775d2ea11c57c78fe7947.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" add36b5b21f775d2ea11c57c78fe7947.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" add36b5b21f775d2ea11c57c78fe7947.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\J: add36b5b21f775d2ea11c57c78fe7947.exe File opened (read-only) \??\M: add36b5b21f775d2ea11c57c78fe7947.exe File opened (read-only) \??\N: add36b5b21f775d2ea11c57c78fe7947.exe File opened (read-only) \??\P: add36b5b21f775d2ea11c57c78fe7947.exe File opened (read-only) \??\U: add36b5b21f775d2ea11c57c78fe7947.exe File opened (read-only) \??\V: add36b5b21f775d2ea11c57c78fe7947.exe File opened (read-only) \??\G: add36b5b21f775d2ea11c57c78fe7947.exe File opened (read-only) \??\H: add36b5b21f775d2ea11c57c78fe7947.exe File opened (read-only) \??\Y: add36b5b21f775d2ea11c57c78fe7947.exe File opened (read-only) \??\T: add36b5b21f775d2ea11c57c78fe7947.exe File opened (read-only) \??\E: add36b5b21f775d2ea11c57c78fe7947.exe File opened (read-only) \??\R: add36b5b21f775d2ea11c57c78fe7947.exe File opened (read-only) \??\O: add36b5b21f775d2ea11c57c78fe7947.exe File opened (read-only) \??\S: add36b5b21f775d2ea11c57c78fe7947.exe File opened (read-only) \??\X: add36b5b21f775d2ea11c57c78fe7947.exe File opened (read-only) \??\Z: add36b5b21f775d2ea11c57c78fe7947.exe File opened (read-only) \??\I: add36b5b21f775d2ea11c57c78fe7947.exe File opened (read-only) \??\L: add36b5b21f775d2ea11c57c78fe7947.exe File opened (read-only) \??\W: add36b5b21f775d2ea11c57c78fe7947.exe File opened (read-only) \??\K: add36b5b21f775d2ea11c57c78fe7947.exe File opened (read-only) \??\Q: add36b5b21f775d2ea11c57c78fe7947.exe -
Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\autorun.inf add36b5b21f775d2ea11c57c78fe7947.exe File opened for modification F:\autorun.inf add36b5b21f775d2ea11c57c78fe7947.exe -
Drops file in Program Files directory 5 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe add36b5b21f775d2ea11c57c78fe7947.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7z.exe add36b5b21f775d2ea11c57c78fe7947.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zFM.exe add36b5b21f775d2ea11c57c78fe7947.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zG.exe add36b5b21f775d2ea11c57c78fe7947.exe File opened for modification C:\PROGRAM FILES\7-ZIP\Uninstall.exe add36b5b21f775d2ea11c57c78fe7947.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI add36b5b21f775d2ea11c57c78fe7947.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 2104 add36b5b21f775d2ea11c57c78fe7947.exe 2104 add36b5b21f775d2ea11c57c78fe7947.exe 2104 add36b5b21f775d2ea11c57c78fe7947.exe 2104 add36b5b21f775d2ea11c57c78fe7947.exe 2104 add36b5b21f775d2ea11c57c78fe7947.exe 2104 add36b5b21f775d2ea11c57c78fe7947.exe 2104 add36b5b21f775d2ea11c57c78fe7947.exe 2104 add36b5b21f775d2ea11c57c78fe7947.exe 2104 add36b5b21f775d2ea11c57c78fe7947.exe 2104 add36b5b21f775d2ea11c57c78fe7947.exe 2104 add36b5b21f775d2ea11c57c78fe7947.exe 2104 add36b5b21f775d2ea11c57c78fe7947.exe -
Suspicious use of AdjustPrivilegeToken 32 IoCs
description pid Process Token: SeDebugPrivilege 2104 add36b5b21f775d2ea11c57c78fe7947.exe Token: SeDebugPrivilege 2104 add36b5b21f775d2ea11c57c78fe7947.exe Token: SeDebugPrivilege 2104 add36b5b21f775d2ea11c57c78fe7947.exe Token: SeDebugPrivilege 2104 add36b5b21f775d2ea11c57c78fe7947.exe Token: SeDebugPrivilege 2104 add36b5b21f775d2ea11c57c78fe7947.exe Token: SeDebugPrivilege 2104 add36b5b21f775d2ea11c57c78fe7947.exe Token: SeDebugPrivilege 2104 add36b5b21f775d2ea11c57c78fe7947.exe Token: SeDebugPrivilege 2104 add36b5b21f775d2ea11c57c78fe7947.exe Token: SeDebugPrivilege 2104 add36b5b21f775d2ea11c57c78fe7947.exe Token: SeDebugPrivilege 2104 add36b5b21f775d2ea11c57c78fe7947.exe Token: SeDebugPrivilege 2104 add36b5b21f775d2ea11c57c78fe7947.exe Token: SeDebugPrivilege 2104 add36b5b21f775d2ea11c57c78fe7947.exe Token: SeDebugPrivilege 2104 add36b5b21f775d2ea11c57c78fe7947.exe Token: SeDebugPrivilege 2104 add36b5b21f775d2ea11c57c78fe7947.exe Token: SeDebugPrivilege 2104 add36b5b21f775d2ea11c57c78fe7947.exe Token: SeDebugPrivilege 2104 add36b5b21f775d2ea11c57c78fe7947.exe Token: SeDebugPrivilege 2104 add36b5b21f775d2ea11c57c78fe7947.exe Token: SeDebugPrivilege 2104 add36b5b21f775d2ea11c57c78fe7947.exe Token: SeDebugPrivilege 2104 add36b5b21f775d2ea11c57c78fe7947.exe Token: SeDebugPrivilege 2104 add36b5b21f775d2ea11c57c78fe7947.exe Token: SeDebugPrivilege 2104 add36b5b21f775d2ea11c57c78fe7947.exe Token: SeDebugPrivilege 2104 add36b5b21f775d2ea11c57c78fe7947.exe Token: SeDebugPrivilege 2104 add36b5b21f775d2ea11c57c78fe7947.exe Token: SeDebugPrivilege 2104 add36b5b21f775d2ea11c57c78fe7947.exe Token: SeDebugPrivilege 2104 add36b5b21f775d2ea11c57c78fe7947.exe Token: SeDebugPrivilege 2104 add36b5b21f775d2ea11c57c78fe7947.exe Token: SeDebugPrivilege 2104 add36b5b21f775d2ea11c57c78fe7947.exe Token: SeDebugPrivilege 2104 add36b5b21f775d2ea11c57c78fe7947.exe Token: SeDebugPrivilege 2104 add36b5b21f775d2ea11c57c78fe7947.exe Token: SeDebugPrivilege 2104 add36b5b21f775d2ea11c57c78fe7947.exe Token: SeDebugPrivilege 2104 add36b5b21f775d2ea11c57c78fe7947.exe Token: SeDebugPrivilege 2104 add36b5b21f775d2ea11c57c78fe7947.exe -
Suspicious use of WriteProcessMemory 37 IoCs
description pid Process procid_target PID 2104 wrote to memory of 1104 2104 add36b5b21f775d2ea11c57c78fe7947.exe 17 PID 2104 wrote to memory of 1172 2104 add36b5b21f775d2ea11c57c78fe7947.exe 10 PID 2104 wrote to memory of 1196 2104 add36b5b21f775d2ea11c57c78fe7947.exe 16 PID 2104 wrote to memory of 2268 2104 add36b5b21f775d2ea11c57c78fe7947.exe 14 PID 2104 wrote to memory of 1104 2104 add36b5b21f775d2ea11c57c78fe7947.exe 17 PID 2104 wrote to memory of 1172 2104 add36b5b21f775d2ea11c57c78fe7947.exe 10 PID 2104 wrote to memory of 1196 2104 add36b5b21f775d2ea11c57c78fe7947.exe 16 PID 2104 wrote to memory of 1104 2104 add36b5b21f775d2ea11c57c78fe7947.exe 17 PID 2104 wrote to memory of 1172 2104 add36b5b21f775d2ea11c57c78fe7947.exe 10 PID 2104 wrote to memory of 1196 2104 add36b5b21f775d2ea11c57c78fe7947.exe 16 PID 2104 wrote to memory of 1104 2104 add36b5b21f775d2ea11c57c78fe7947.exe 17 PID 2104 wrote to memory of 1172 2104 add36b5b21f775d2ea11c57c78fe7947.exe 10 PID 2104 wrote to memory of 1196 2104 add36b5b21f775d2ea11c57c78fe7947.exe 16 PID 2104 wrote to memory of 1104 2104 add36b5b21f775d2ea11c57c78fe7947.exe 17 PID 2104 wrote to memory of 1172 2104 add36b5b21f775d2ea11c57c78fe7947.exe 10 PID 2104 wrote to memory of 1196 2104 add36b5b21f775d2ea11c57c78fe7947.exe 16 PID 2104 wrote to memory of 1104 2104 add36b5b21f775d2ea11c57c78fe7947.exe 17 PID 2104 wrote to memory of 1172 2104 add36b5b21f775d2ea11c57c78fe7947.exe 10 PID 2104 wrote to memory of 1196 2104 add36b5b21f775d2ea11c57c78fe7947.exe 16 PID 2104 wrote to memory of 1104 2104 add36b5b21f775d2ea11c57c78fe7947.exe 17 PID 2104 wrote to memory of 1172 2104 add36b5b21f775d2ea11c57c78fe7947.exe 10 PID 2104 wrote to memory of 1196 2104 add36b5b21f775d2ea11c57c78fe7947.exe 16 PID 2104 wrote to memory of 1104 2104 add36b5b21f775d2ea11c57c78fe7947.exe 17 PID 2104 wrote to memory of 1172 2104 add36b5b21f775d2ea11c57c78fe7947.exe 10 PID 2104 wrote to memory of 1196 2104 add36b5b21f775d2ea11c57c78fe7947.exe 16 PID 2104 wrote to memory of 1104 2104 add36b5b21f775d2ea11c57c78fe7947.exe 17 PID 2104 wrote to memory of 1172 2104 add36b5b21f775d2ea11c57c78fe7947.exe 10 PID 2104 wrote to memory of 1196 2104 add36b5b21f775d2ea11c57c78fe7947.exe 16 PID 2104 wrote to memory of 1104 2104 add36b5b21f775d2ea11c57c78fe7947.exe 17 PID 2104 wrote to memory of 1172 2104 add36b5b21f775d2ea11c57c78fe7947.exe 10 PID 2104 wrote to memory of 1196 2104 add36b5b21f775d2ea11c57c78fe7947.exe 16 PID 2104 wrote to memory of 1104 2104 add36b5b21f775d2ea11c57c78fe7947.exe 17 PID 2104 wrote to memory of 1172 2104 add36b5b21f775d2ea11c57c78fe7947.exe 10 PID 2104 wrote to memory of 1196 2104 add36b5b21f775d2ea11c57c78fe7947.exe 16 PID 2104 wrote to memory of 1104 2104 add36b5b21f775d2ea11c57c78fe7947.exe 17 PID 2104 wrote to memory of 1172 2104 add36b5b21f775d2ea11c57c78fe7947.exe 10 PID 2104 wrote to memory of 1196 2104 add36b5b21f775d2ea11c57c78fe7947.exe 16 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" add36b5b21f775d2ea11c57c78fe7947.exe
Processes
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1172
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:2268
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1196
-
C:\Users\Admin\AppData\Local\Temp\add36b5b21f775d2ea11c57c78fe7947.exe"C:\Users\Admin\AppData\Local\Temp\add36b5b21f775d2ea11c57c78fe7947.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2104
-
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1104
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
96KB
MD55cc4a4bea86325d9d2281bfcba2ed34f
SHA1850f7c7bb87c162d9b305d1405d53d170b38c45e
SHA2566399456c05b8d7aa84b2847a5c34b6417aa3a30f69d39a7daa785dc76a512e5a
SHA51229350d1107dc397b0ce5903bb5edf7a74aa84b4039c6c3e3c7ecf78cebbce89abe9b834081208d9b6d0c87c47877696ae59f896ddca1061a3befa0567cf1f591