Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
23-05-2024 00:08
Static task
static1
Behavioral task
behavioral1
Sample
8b6e1831c9d954605fa504e03a0d91b5091253827abd68c18479584f44acd10e.exe
Resource
win7-20240221-en
General
-
Target
8b6e1831c9d954605fa504e03a0d91b5091253827abd68c18479584f44acd10e.exe
-
Size
960KB
-
MD5
b63aa3120f4e31d0aa5ad70ac3dc6613
-
SHA1
010ca4f43956127221f89718250d03d78e82f33e
-
SHA256
8b6e1831c9d954605fa504e03a0d91b5091253827abd68c18479584f44acd10e
-
SHA512
63b7d11f7c7275f5d8eef93ff22fa285adec6c4a264598a62a514b311a184cc2fdc35532a852c6a7119c2629bbe629e7ec4ef17e7801f9a1dd3bade959a45fc8
-
SSDEEP
24576:uHzLPM7YC8xNQm3cD/cu89jZwUDxgFH3yuiQaXE:uHXMN8xNQlId9+UVgFH3ylbXE
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Modifies firewall policy service 2 TTPs 3 IoCs
Processes:
8b6e1831c9d954605fa504e03a0d91b5091253827abd68c18479584f44acd10e.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 8b6e1831c9d954605fa504e03a0d91b5091253827abd68c18479584f44acd10e.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 8b6e1831c9d954605fa504e03a0d91b5091253827abd68c18479584f44acd10e.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 8b6e1831c9d954605fa504e03a0d91b5091253827abd68c18479584f44acd10e.exe -
Processes:
8b6e1831c9d954605fa504e03a0d91b5091253827abd68c18479584f44acd10e.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 8b6e1831c9d954605fa504e03a0d91b5091253827abd68c18479584f44acd10e.exe -
Processes:
8b6e1831c9d954605fa504e03a0d91b5091253827abd68c18479584f44acd10e.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 8b6e1831c9d954605fa504e03a0d91b5091253827abd68c18479584f44acd10e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 8b6e1831c9d954605fa504e03a0d91b5091253827abd68c18479584f44acd10e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 8b6e1831c9d954605fa504e03a0d91b5091253827abd68c18479584f44acd10e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 8b6e1831c9d954605fa504e03a0d91b5091253827abd68c18479584f44acd10e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 8b6e1831c9d954605fa504e03a0d91b5091253827abd68c18479584f44acd10e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 8b6e1831c9d954605fa504e03a0d91b5091253827abd68c18479584f44acd10e.exe -
Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 18 IoCs
Processes:
resource yara_rule behavioral1/memory/1800-2-0x0000000001F40000-0x0000000002FCE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/1800-5-0x0000000001F40000-0x0000000002FCE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/1800-8-0x0000000001F40000-0x0000000002FCE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/1800-11-0x0000000001F40000-0x0000000002FCE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/1800-7-0x0000000001F40000-0x0000000002FCE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/1800-10-0x0000000001F40000-0x0000000002FCE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/1800-13-0x0000000001F40000-0x0000000002FCE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/1800-12-0x0000000001F40000-0x0000000002FCE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/1800-9-0x0000000001F40000-0x0000000002FCE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/1800-6-0x0000000001F40000-0x0000000002FCE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/1800-4-0x0000000001F40000-0x0000000002FCE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/1800-29-0x0000000001F40000-0x0000000002FCE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/1800-30-0x0000000001F40000-0x0000000002FCE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/1800-31-0x0000000001F40000-0x0000000002FCE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/1800-33-0x0000000001F40000-0x0000000002FCE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/1800-34-0x0000000001F40000-0x0000000002FCE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/1800-36-0x0000000001F40000-0x0000000002FCE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/1800-54-0x0000000001F40000-0x0000000002FCE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine -
UPX dump on OEP (original entry point) 19 IoCs
Processes:
resource yara_rule behavioral1/memory/1800-2-0x0000000001F40000-0x0000000002FCE000-memory.dmp UPX behavioral1/memory/1800-5-0x0000000001F40000-0x0000000002FCE000-memory.dmp UPX behavioral1/memory/1800-8-0x0000000001F40000-0x0000000002FCE000-memory.dmp UPX behavioral1/memory/1800-11-0x0000000001F40000-0x0000000002FCE000-memory.dmp UPX behavioral1/memory/1800-7-0x0000000001F40000-0x0000000002FCE000-memory.dmp UPX behavioral1/memory/1800-10-0x0000000001F40000-0x0000000002FCE000-memory.dmp UPX behavioral1/memory/1800-13-0x0000000001F40000-0x0000000002FCE000-memory.dmp UPX behavioral1/memory/1800-12-0x0000000001F40000-0x0000000002FCE000-memory.dmp UPX behavioral1/memory/1800-9-0x0000000001F40000-0x0000000002FCE000-memory.dmp UPX behavioral1/memory/1800-6-0x0000000001F40000-0x0000000002FCE000-memory.dmp UPX behavioral1/memory/1800-4-0x0000000001F40000-0x0000000002FCE000-memory.dmp UPX behavioral1/memory/1800-29-0x0000000001F40000-0x0000000002FCE000-memory.dmp UPX behavioral1/memory/1800-30-0x0000000001F40000-0x0000000002FCE000-memory.dmp UPX behavioral1/memory/1800-31-0x0000000001F40000-0x0000000002FCE000-memory.dmp UPX behavioral1/memory/1800-33-0x0000000001F40000-0x0000000002FCE000-memory.dmp UPX behavioral1/memory/1800-34-0x0000000001F40000-0x0000000002FCE000-memory.dmp UPX behavioral1/memory/1800-36-0x0000000001F40000-0x0000000002FCE000-memory.dmp UPX behavioral1/memory/1800-55-0x0000000000400000-0x00000000005F1000-memory.dmp UPX behavioral1/memory/1800-54-0x0000000001F40000-0x0000000002FCE000-memory.dmp UPX -
Processes:
resource yara_rule behavioral1/memory/1800-2-0x0000000001F40000-0x0000000002FCE000-memory.dmp upx behavioral1/memory/1800-5-0x0000000001F40000-0x0000000002FCE000-memory.dmp upx behavioral1/memory/1800-8-0x0000000001F40000-0x0000000002FCE000-memory.dmp upx behavioral1/memory/1800-11-0x0000000001F40000-0x0000000002FCE000-memory.dmp upx behavioral1/memory/1800-7-0x0000000001F40000-0x0000000002FCE000-memory.dmp upx behavioral1/memory/1800-10-0x0000000001F40000-0x0000000002FCE000-memory.dmp upx behavioral1/memory/1800-13-0x0000000001F40000-0x0000000002FCE000-memory.dmp upx behavioral1/memory/1800-12-0x0000000001F40000-0x0000000002FCE000-memory.dmp upx behavioral1/memory/1800-9-0x0000000001F40000-0x0000000002FCE000-memory.dmp upx behavioral1/memory/1800-6-0x0000000001F40000-0x0000000002FCE000-memory.dmp upx behavioral1/memory/1800-4-0x0000000001F40000-0x0000000002FCE000-memory.dmp upx behavioral1/memory/1800-29-0x0000000001F40000-0x0000000002FCE000-memory.dmp upx behavioral1/memory/1800-30-0x0000000001F40000-0x0000000002FCE000-memory.dmp upx behavioral1/memory/1800-31-0x0000000001F40000-0x0000000002FCE000-memory.dmp upx behavioral1/memory/1800-33-0x0000000001F40000-0x0000000002FCE000-memory.dmp upx behavioral1/memory/1800-34-0x0000000001F40000-0x0000000002FCE000-memory.dmp upx behavioral1/memory/1800-36-0x0000000001F40000-0x0000000002FCE000-memory.dmp upx behavioral1/memory/1800-54-0x0000000001F40000-0x0000000002FCE000-memory.dmp upx -
Processes:
8b6e1831c9d954605fa504e03a0d91b5091253827abd68c18479584f44acd10e.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 8b6e1831c9d954605fa504e03a0d91b5091253827abd68c18479584f44acd10e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 8b6e1831c9d954605fa504e03a0d91b5091253827abd68c18479584f44acd10e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc 8b6e1831c9d954605fa504e03a0d91b5091253827abd68c18479584f44acd10e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 8b6e1831c9d954605fa504e03a0d91b5091253827abd68c18479584f44acd10e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 8b6e1831c9d954605fa504e03a0d91b5091253827abd68c18479584f44acd10e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 8b6e1831c9d954605fa504e03a0d91b5091253827abd68c18479584f44acd10e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 8b6e1831c9d954605fa504e03a0d91b5091253827abd68c18479584f44acd10e.exe -
Processes:
8b6e1831c9d954605fa504e03a0d91b5091253827abd68c18479584f44acd10e.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 8b6e1831c9d954605fa504e03a0d91b5091253827abd68c18479584f44acd10e.exe -
Enumerates connected drives 3 TTPs 3 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
8b6e1831c9d954605fa504e03a0d91b5091253827abd68c18479584f44acd10e.exedescription ioc process File opened (read-only) \??\E: 8b6e1831c9d954605fa504e03a0d91b5091253827abd68c18479584f44acd10e.exe File opened (read-only) \??\G: 8b6e1831c9d954605fa504e03a0d91b5091253827abd68c18479584f44acd10e.exe File opened (read-only) \??\H: 8b6e1831c9d954605fa504e03a0d91b5091253827abd68c18479584f44acd10e.exe -
Drops file in Windows directory 1 IoCs
Processes:
8b6e1831c9d954605fa504e03a0d91b5091253827abd68c18479584f44acd10e.exedescription ioc process File opened for modification C:\Windows\SYSTEM.INI 8b6e1831c9d954605fa504e03a0d91b5091253827abd68c18479584f44acd10e.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
8b6e1831c9d954605fa504e03a0d91b5091253827abd68c18479584f44acd10e.exepid process 1800 8b6e1831c9d954605fa504e03a0d91b5091253827abd68c18479584f44acd10e.exe -
Suspicious use of AdjustPrivilegeToken 20 IoCs
Processes:
8b6e1831c9d954605fa504e03a0d91b5091253827abd68c18479584f44acd10e.exedescription pid process Token: SeDebugPrivilege 1800 8b6e1831c9d954605fa504e03a0d91b5091253827abd68c18479584f44acd10e.exe Token: SeDebugPrivilege 1800 8b6e1831c9d954605fa504e03a0d91b5091253827abd68c18479584f44acd10e.exe Token: SeDebugPrivilege 1800 8b6e1831c9d954605fa504e03a0d91b5091253827abd68c18479584f44acd10e.exe Token: SeDebugPrivilege 1800 8b6e1831c9d954605fa504e03a0d91b5091253827abd68c18479584f44acd10e.exe Token: SeDebugPrivilege 1800 8b6e1831c9d954605fa504e03a0d91b5091253827abd68c18479584f44acd10e.exe Token: SeDebugPrivilege 1800 8b6e1831c9d954605fa504e03a0d91b5091253827abd68c18479584f44acd10e.exe Token: SeDebugPrivilege 1800 8b6e1831c9d954605fa504e03a0d91b5091253827abd68c18479584f44acd10e.exe Token: SeDebugPrivilege 1800 8b6e1831c9d954605fa504e03a0d91b5091253827abd68c18479584f44acd10e.exe Token: SeDebugPrivilege 1800 8b6e1831c9d954605fa504e03a0d91b5091253827abd68c18479584f44acd10e.exe Token: SeDebugPrivilege 1800 8b6e1831c9d954605fa504e03a0d91b5091253827abd68c18479584f44acd10e.exe Token: SeDebugPrivilege 1800 8b6e1831c9d954605fa504e03a0d91b5091253827abd68c18479584f44acd10e.exe Token: SeDebugPrivilege 1800 8b6e1831c9d954605fa504e03a0d91b5091253827abd68c18479584f44acd10e.exe Token: SeDebugPrivilege 1800 8b6e1831c9d954605fa504e03a0d91b5091253827abd68c18479584f44acd10e.exe Token: SeDebugPrivilege 1800 8b6e1831c9d954605fa504e03a0d91b5091253827abd68c18479584f44acd10e.exe Token: SeDebugPrivilege 1800 8b6e1831c9d954605fa504e03a0d91b5091253827abd68c18479584f44acd10e.exe Token: SeDebugPrivilege 1800 8b6e1831c9d954605fa504e03a0d91b5091253827abd68c18479584f44acd10e.exe Token: SeDebugPrivilege 1800 8b6e1831c9d954605fa504e03a0d91b5091253827abd68c18479584f44acd10e.exe Token: SeDebugPrivilege 1800 8b6e1831c9d954605fa504e03a0d91b5091253827abd68c18479584f44acd10e.exe Token: SeDebugPrivilege 1800 8b6e1831c9d954605fa504e03a0d91b5091253827abd68c18479584f44acd10e.exe Token: SeDebugPrivilege 1800 8b6e1831c9d954605fa504e03a0d91b5091253827abd68c18479584f44acd10e.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
8b6e1831c9d954605fa504e03a0d91b5091253827abd68c18479584f44acd10e.exedescription pid process target process PID 1800 wrote to memory of 1108 1800 8b6e1831c9d954605fa504e03a0d91b5091253827abd68c18479584f44acd10e.exe taskhost.exe PID 1800 wrote to memory of 1168 1800 8b6e1831c9d954605fa504e03a0d91b5091253827abd68c18479584f44acd10e.exe Dwm.exe PID 1800 wrote to memory of 1204 1800 8b6e1831c9d954605fa504e03a0d91b5091253827abd68c18479584f44acd10e.exe Explorer.EXE PID 1800 wrote to memory of 2384 1800 8b6e1831c9d954605fa504e03a0d91b5091253827abd68c18479584f44acd10e.exe DllHost.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
8b6e1831c9d954605fa504e03a0d91b5091253827abd68c18479584f44acd10e.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 8b6e1831c9d954605fa504e03a0d91b5091253827abd68c18479584f44acd10e.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1108
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1168
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1204
-
C:\Users\Admin\AppData\Local\Temp\8b6e1831c9d954605fa504e03a0d91b5091253827abd68c18479584f44acd10e.exe"C:\Users\Admin\AppData\Local\Temp\8b6e1831c9d954605fa504e03a0d91b5091253827abd68c18479584f44acd10e.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1800
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:2384
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1108-14-0x0000000002070000-0x0000000002072000-memory.dmpFilesize
8KB
-
memory/1800-10-0x0000000001F40000-0x0000000002FCE000-memory.dmpFilesize
16.6MB
-
memory/1800-7-0x0000000001F40000-0x0000000002FCE000-memory.dmpFilesize
16.6MB
-
memory/1800-13-0x0000000001F40000-0x0000000002FCE000-memory.dmpFilesize
16.6MB
-
memory/1800-11-0x0000000001F40000-0x0000000002FCE000-memory.dmpFilesize
16.6MB
-
memory/1800-12-0x0000000001F40000-0x0000000002FCE000-memory.dmpFilesize
16.6MB
-
memory/1800-1-0x0000000000400000-0x00000000005F1000-memory.dmpFilesize
1.9MB
-
memory/1800-27-0x00000000003E0000-0x00000000003E2000-memory.dmpFilesize
8KB
-
memory/1800-9-0x0000000001F40000-0x0000000002FCE000-memory.dmpFilesize
16.6MB
-
memory/1800-26-0x00000000003F0000-0x00000000003F1000-memory.dmpFilesize
4KB
-
memory/1800-24-0x00000000003F0000-0x00000000003F1000-memory.dmpFilesize
4KB
-
memory/1800-23-0x00000000003E0000-0x00000000003E2000-memory.dmpFilesize
8KB
-
memory/1800-2-0x0000000001F40000-0x0000000002FCE000-memory.dmpFilesize
16.6MB
-
memory/1800-8-0x0000000001F40000-0x0000000002FCE000-memory.dmpFilesize
16.6MB
-
memory/1800-5-0x0000000001F40000-0x0000000002FCE000-memory.dmpFilesize
16.6MB
-
memory/1800-28-0x00000000003E0000-0x00000000003E2000-memory.dmpFilesize
8KB
-
memory/1800-6-0x0000000001F40000-0x0000000002FCE000-memory.dmpFilesize
16.6MB
-
memory/1800-4-0x0000000001F40000-0x0000000002FCE000-memory.dmpFilesize
16.6MB
-
memory/1800-29-0x0000000001F40000-0x0000000002FCE000-memory.dmpFilesize
16.6MB
-
memory/1800-30-0x0000000001F40000-0x0000000002FCE000-memory.dmpFilesize
16.6MB
-
memory/1800-31-0x0000000001F40000-0x0000000002FCE000-memory.dmpFilesize
16.6MB
-
memory/1800-33-0x0000000001F40000-0x0000000002FCE000-memory.dmpFilesize
16.6MB
-
memory/1800-34-0x0000000001F40000-0x0000000002FCE000-memory.dmpFilesize
16.6MB
-
memory/1800-36-0x0000000001F40000-0x0000000002FCE000-memory.dmpFilesize
16.6MB
-
memory/1800-55-0x0000000000400000-0x00000000005F1000-memory.dmpFilesize
1.9MB
-
memory/1800-54-0x0000000001F40000-0x0000000002FCE000-memory.dmpFilesize
16.6MB