Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
18-05-2024 09:57
Static task
static1
Behavioral task
behavioral1
Sample
01d090802835895bc7c3a6860115c730.exe.bin.dll
Resource
win7-20240220-en
General
-
Target
01d090802835895bc7c3a6860115c730.exe.bin.dll
-
Size
120KB
-
MD5
01d090802835895bc7c3a6860115c730
-
SHA1
bb598478345187510263c2c2077764c00ab7bd50
-
SHA256
79e563193f0e1c271a4e7355fb2689e0f107477e2220aaba8af7a735e2a06c72
-
SHA512
de07da9f781028087835bb9dd24439a3eba28f87f9e0525c653e6eee0170a2d6077486168f6f861db6af2056039ea35bc8ab3b200aa4197a0bbed0881e0fbd13
-
SSDEEP
3072:3HFMoPetZLNacwvRkFkIoE6FBgJyINi1QUfHOMr0E:33SZTwvRkyBdFBgotHOMr
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 2 TTPs 3 IoCs
Processes:
f7616bc.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f7616bc.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f7616bc.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f7616bc.exe -
Processes:
f7616bc.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f7616bc.exe -
Processes:
f7616bc.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f7616bc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f7616bc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f7616bc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f7616bc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f7616bc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f7616bc.exe -
Executes dropped EXE 3 IoCs
Processes:
f7616bc.exef761870.exef7632a4.exepid process 2940 f7616bc.exe 2460 f761870.exe 2604 f7632a4.exe -
Loads dropped DLL 6 IoCs
Processes:
rundll32.exepid process 2388 rundll32.exe 2388 rundll32.exe 2388 rundll32.exe 2388 rundll32.exe 2388 rundll32.exe 2388 rundll32.exe -
Processes:
resource yara_rule behavioral1/memory/2940-12-0x0000000000700000-0x00000000017BA000-memory.dmp upx behavioral1/memory/2940-19-0x0000000000700000-0x00000000017BA000-memory.dmp upx behavioral1/memory/2940-17-0x0000000000700000-0x00000000017BA000-memory.dmp upx behavioral1/memory/2940-18-0x0000000000700000-0x00000000017BA000-memory.dmp upx behavioral1/memory/2940-15-0x0000000000700000-0x00000000017BA000-memory.dmp upx behavioral1/memory/2940-20-0x0000000000700000-0x00000000017BA000-memory.dmp upx behavioral1/memory/2940-21-0x0000000000700000-0x00000000017BA000-memory.dmp upx behavioral1/memory/2940-22-0x0000000000700000-0x00000000017BA000-memory.dmp upx behavioral1/memory/2940-14-0x0000000000700000-0x00000000017BA000-memory.dmp upx behavioral1/memory/2940-16-0x0000000000700000-0x00000000017BA000-memory.dmp upx behavioral1/memory/2940-60-0x0000000000700000-0x00000000017BA000-memory.dmp upx behavioral1/memory/2940-61-0x0000000000700000-0x00000000017BA000-memory.dmp upx behavioral1/memory/2940-62-0x0000000000700000-0x00000000017BA000-memory.dmp upx behavioral1/memory/2940-63-0x0000000000700000-0x00000000017BA000-memory.dmp upx behavioral1/memory/2940-64-0x0000000000700000-0x00000000017BA000-memory.dmp upx behavioral1/memory/2940-66-0x0000000000700000-0x00000000017BA000-memory.dmp upx behavioral1/memory/2940-67-0x0000000000700000-0x00000000017BA000-memory.dmp upx behavioral1/memory/2940-80-0x0000000000700000-0x00000000017BA000-memory.dmp upx behavioral1/memory/2940-82-0x0000000000700000-0x00000000017BA000-memory.dmp upx behavioral1/memory/2940-84-0x0000000000700000-0x00000000017BA000-memory.dmp upx behavioral1/memory/2940-103-0x0000000000700000-0x00000000017BA000-memory.dmp upx behavioral1/memory/2940-104-0x0000000000700000-0x00000000017BA000-memory.dmp upx behavioral1/memory/2940-117-0x0000000000700000-0x00000000017BA000-memory.dmp upx behavioral1/memory/2940-147-0x0000000000700000-0x00000000017BA000-memory.dmp upx -
Processes:
f7616bc.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f7616bc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f7616bc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f7616bc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f7616bc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f7616bc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f7616bc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f7616bc.exe -
Processes:
f7616bc.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f7616bc.exe -
Enumerates connected drives 3 TTPs 15 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
f7616bc.exedescription ioc process File opened (read-only) \??\O: f7616bc.exe File opened (read-only) \??\R: f7616bc.exe File opened (read-only) \??\E: f7616bc.exe File opened (read-only) \??\H: f7616bc.exe File opened (read-only) \??\I: f7616bc.exe File opened (read-only) \??\M: f7616bc.exe File opened (read-only) \??\N: f7616bc.exe File opened (read-only) \??\G: f7616bc.exe File opened (read-only) \??\L: f7616bc.exe File opened (read-only) \??\P: f7616bc.exe File opened (read-only) \??\T: f7616bc.exe File opened (read-only) \??\K: f7616bc.exe File opened (read-only) \??\Q: f7616bc.exe File opened (read-only) \??\S: f7616bc.exe File opened (read-only) \??\J: f7616bc.exe -
Drops file in Windows directory 2 IoCs
Processes:
f7616bc.exedescription ioc process File created C:\Windows\f761729 f7616bc.exe File opened for modification C:\Windows\SYSTEM.INI f7616bc.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
f7616bc.exepid process 2940 f7616bc.exe 2940 f7616bc.exe -
Suspicious use of AdjustPrivilegeToken 21 IoCs
Processes:
f7616bc.exedescription pid process Token: SeDebugPrivilege 2940 f7616bc.exe Token: SeDebugPrivilege 2940 f7616bc.exe Token: SeDebugPrivilege 2940 f7616bc.exe Token: SeDebugPrivilege 2940 f7616bc.exe Token: SeDebugPrivilege 2940 f7616bc.exe Token: SeDebugPrivilege 2940 f7616bc.exe Token: SeDebugPrivilege 2940 f7616bc.exe Token: SeDebugPrivilege 2940 f7616bc.exe Token: SeDebugPrivilege 2940 f7616bc.exe Token: SeDebugPrivilege 2940 f7616bc.exe Token: SeDebugPrivilege 2940 f7616bc.exe Token: SeDebugPrivilege 2940 f7616bc.exe Token: SeDebugPrivilege 2940 f7616bc.exe Token: SeDebugPrivilege 2940 f7616bc.exe Token: SeDebugPrivilege 2940 f7616bc.exe Token: SeDebugPrivilege 2940 f7616bc.exe Token: SeDebugPrivilege 2940 f7616bc.exe Token: SeDebugPrivilege 2940 f7616bc.exe Token: SeDebugPrivilege 2940 f7616bc.exe Token: SeDebugPrivilege 2940 f7616bc.exe Token: SeDebugPrivilege 2940 f7616bc.exe -
Suspicious use of WriteProcessMemory 33 IoCs
Processes:
rundll32.exerundll32.exef7616bc.exedescription pid process target process PID 2904 wrote to memory of 2388 2904 rundll32.exe rundll32.exe PID 2904 wrote to memory of 2388 2904 rundll32.exe rundll32.exe PID 2904 wrote to memory of 2388 2904 rundll32.exe rundll32.exe PID 2904 wrote to memory of 2388 2904 rundll32.exe rundll32.exe PID 2904 wrote to memory of 2388 2904 rundll32.exe rundll32.exe PID 2904 wrote to memory of 2388 2904 rundll32.exe rundll32.exe PID 2904 wrote to memory of 2388 2904 rundll32.exe rundll32.exe PID 2388 wrote to memory of 2940 2388 rundll32.exe f7616bc.exe PID 2388 wrote to memory of 2940 2388 rundll32.exe f7616bc.exe PID 2388 wrote to memory of 2940 2388 rundll32.exe f7616bc.exe PID 2388 wrote to memory of 2940 2388 rundll32.exe f7616bc.exe PID 2940 wrote to memory of 1112 2940 f7616bc.exe taskhost.exe PID 2940 wrote to memory of 1168 2940 f7616bc.exe Dwm.exe PID 2940 wrote to memory of 1204 2940 f7616bc.exe Explorer.EXE PID 2940 wrote to memory of 1640 2940 f7616bc.exe DllHost.exe PID 2940 wrote to memory of 2904 2940 f7616bc.exe rundll32.exe PID 2940 wrote to memory of 2388 2940 f7616bc.exe rundll32.exe PID 2940 wrote to memory of 2388 2940 f7616bc.exe rundll32.exe PID 2388 wrote to memory of 2460 2388 rundll32.exe f761870.exe PID 2388 wrote to memory of 2460 2388 rundll32.exe f761870.exe PID 2388 wrote to memory of 2460 2388 rundll32.exe f761870.exe PID 2388 wrote to memory of 2460 2388 rundll32.exe f761870.exe PID 2388 wrote to memory of 2604 2388 rundll32.exe f7632a4.exe PID 2388 wrote to memory of 2604 2388 rundll32.exe f7632a4.exe PID 2388 wrote to memory of 2604 2388 rundll32.exe f7632a4.exe PID 2388 wrote to memory of 2604 2388 rundll32.exe f7632a4.exe PID 2940 wrote to memory of 1112 2940 f7616bc.exe taskhost.exe PID 2940 wrote to memory of 1168 2940 f7616bc.exe Dwm.exe PID 2940 wrote to memory of 1204 2940 f7616bc.exe Explorer.EXE PID 2940 wrote to memory of 2460 2940 f7616bc.exe f761870.exe PID 2940 wrote to memory of 2460 2940 f7616bc.exe f761870.exe PID 2940 wrote to memory of 2604 2940 f7616bc.exe f7632a4.exe PID 2940 wrote to memory of 2604 2940 f7616bc.exe f7632a4.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
f7616bc.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f7616bc.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1112
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1168
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1204
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\01d090802835895bc7c3a6860115c730.exe.bin.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\01d090802835895bc7c3a6860115c730.exe.bin.dll,#13⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\f7616bc.exeC:\Users\Admin\AppData\Local\Temp\f7616bc.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\f761870.exeC:\Users\Admin\AppData\Local\Temp\f761870.exe4⤵
- Executes dropped EXE
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\f7632a4.exeC:\Users\Admin\AppData\Local\Temp\f7632a4.exe4⤵
- Executes dropped EXE
PID:2604
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1640
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\f7616bc.exeFilesize
97KB
MD55c20a3bb3405daab1863b4dbd111294e
SHA12a9fa7ffb8b37fc93f00ce7517df554265b1459c
SHA256fdb6cf7b3dc8027d5d6aae0f4cabde66fee8a219ff51017d398779f3e1e5acba
SHA5123ba530eed93ad3ed1463707c7d77e98b42ae35d1b4f18464caac3e1013b68d108689ec86cea8983891c46781e526a07d3b1589a665df72ea4efe4c68ca52c067
-
memory/1112-28-0x0000000000420000-0x0000000000422000-memory.dmpFilesize
8KB
-
memory/2388-35-0x00000000001F0000-0x00000000001F2000-memory.dmpFilesize
8KB
-
memory/2388-55-0x00000000001F0000-0x00000000001F2000-memory.dmpFilesize
8KB
-
memory/2388-9-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2388-57-0x00000000001F0000-0x00000000001F2000-memory.dmpFilesize
8KB
-
memory/2388-75-0x00000000001F0000-0x00000000001F2000-memory.dmpFilesize
8KB
-
memory/2388-10-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2388-36-0x0000000000200000-0x0000000000201000-memory.dmpFilesize
4KB
-
memory/2388-1-0x0000000010000000-0x0000000010020000-memory.dmpFilesize
128KB
-
memory/2388-45-0x0000000000200000-0x0000000000201000-memory.dmpFilesize
4KB
-
memory/2460-101-0x0000000000260000-0x0000000000262000-memory.dmpFilesize
8KB
-
memory/2460-94-0x0000000000260000-0x0000000000262000-memory.dmpFilesize
8KB
-
memory/2460-93-0x00000000002B0000-0x00000000002B1000-memory.dmpFilesize
4KB
-
memory/2460-59-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2460-151-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2604-102-0x0000000000260000-0x0000000000262000-memory.dmpFilesize
8KB
-
memory/2604-79-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2604-100-0x0000000000260000-0x0000000000262000-memory.dmpFilesize
8KB
-
memory/2604-99-0x00000000002B0000-0x00000000002B1000-memory.dmpFilesize
4KB
-
memory/2604-155-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2940-16-0x0000000000700000-0x00000000017BA000-memory.dmpFilesize
16.7MB
-
memory/2940-84-0x0000000000700000-0x00000000017BA000-memory.dmpFilesize
16.7MB
-
memory/2940-14-0x0000000000700000-0x00000000017BA000-memory.dmpFilesize
16.7MB
-
memory/2940-56-0x00000000003F0000-0x00000000003F2000-memory.dmpFilesize
8KB
-
memory/2940-60-0x0000000000700000-0x00000000017BA000-memory.dmpFilesize
16.7MB
-
memory/2940-61-0x0000000000700000-0x00000000017BA000-memory.dmpFilesize
16.7MB
-
memory/2940-62-0x0000000000700000-0x00000000017BA000-memory.dmpFilesize
16.7MB
-
memory/2940-63-0x0000000000700000-0x00000000017BA000-memory.dmpFilesize
16.7MB
-
memory/2940-64-0x0000000000700000-0x00000000017BA000-memory.dmpFilesize
16.7MB
-
memory/2940-66-0x0000000000700000-0x00000000017BA000-memory.dmpFilesize
16.7MB
-
memory/2940-67-0x0000000000700000-0x00000000017BA000-memory.dmpFilesize
16.7MB
-
memory/2940-21-0x0000000000700000-0x00000000017BA000-memory.dmpFilesize
16.7MB
-
memory/2940-48-0x00000000003F0000-0x00000000003F2000-memory.dmpFilesize
8KB
-
memory/2940-80-0x0000000000700000-0x00000000017BA000-memory.dmpFilesize
16.7MB
-
memory/2940-82-0x0000000000700000-0x00000000017BA000-memory.dmpFilesize
16.7MB
-
memory/2940-22-0x0000000000700000-0x00000000017BA000-memory.dmpFilesize
16.7MB
-
memory/2940-46-0x00000000004E0000-0x00000000004E1000-memory.dmpFilesize
4KB
-
memory/2940-20-0x0000000000700000-0x00000000017BA000-memory.dmpFilesize
16.7MB
-
memory/2940-15-0x0000000000700000-0x00000000017BA000-memory.dmpFilesize
16.7MB
-
memory/2940-18-0x0000000000700000-0x00000000017BA000-memory.dmpFilesize
16.7MB
-
memory/2940-103-0x0000000000700000-0x00000000017BA000-memory.dmpFilesize
16.7MB
-
memory/2940-104-0x0000000000700000-0x00000000017BA000-memory.dmpFilesize
16.7MB
-
memory/2940-17-0x0000000000700000-0x00000000017BA000-memory.dmpFilesize
16.7MB
-
memory/2940-19-0x0000000000700000-0x00000000017BA000-memory.dmpFilesize
16.7MB
-
memory/2940-117-0x0000000000700000-0x00000000017BA000-memory.dmpFilesize
16.7MB
-
memory/2940-147-0x0000000000700000-0x00000000017BA000-memory.dmpFilesize
16.7MB
-
memory/2940-146-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2940-12-0x0000000000700000-0x00000000017BA000-memory.dmpFilesize
16.7MB
-
memory/2940-11-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB