Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
06/09/2024, 04:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1444ea2dd5972f5e86fa7b8ca98e2700N.dll
Resource
win7-20240708-en
windows7-x64
16 signatures
120 seconds
General
-
Target
1444ea2dd5972f5e86fa7b8ca98e2700N.dll
-
Size
120KB
-
MD5
1444ea2dd5972f5e86fa7b8ca98e2700
-
SHA1
d79bd89c9e24d2deef801bf18748cab8175dbea7
-
SHA256
81da399dda18727a982507e2cc6b97c163516cf806bd18287c1d445ab7c2720e
-
SHA512
192328bfa659b375614392d4158cde6873487d46e815d657caed9dd2fcf86476d4b3cd95504bd66ebcc2f61a5b22364327dbcca019dc96c7418030c332169c82
-
SSDEEP
3072:FgByluorQYApydIRDolEFq1wYxpKen6pIK:FIyLBAOEFqeYxIeA
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f76b145.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f76b145.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f76b145.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f76b2db.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f76b2db.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f76b2db.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76b145.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76b2db.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76b145.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76b145.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76b145.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76b145.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76b2db.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76b2db.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76b145.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76b145.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76b2db.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76b2db.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76b2db.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76b2db.exe -
Executes dropped EXE 3 IoCs
pid Process 2168 f76b145.exe 2900 f76b2db.exe 2240 f76cd2e.exe -
Loads dropped DLL 6 IoCs
pid Process 1928 rundll32.exe 1928 rundll32.exe 1928 rundll32.exe 1928 rundll32.exe 1928 rundll32.exe 1928 rundll32.exe -
resource yara_rule behavioral1/memory/2168-12-0x00000000005D0000-0x000000000168A000-memory.dmp upx behavioral1/memory/2168-16-0x00000000005D0000-0x000000000168A000-memory.dmp upx behavioral1/memory/2168-20-0x00000000005D0000-0x000000000168A000-memory.dmp upx behavioral1/memory/2168-21-0x00000000005D0000-0x000000000168A000-memory.dmp upx behavioral1/memory/2168-15-0x00000000005D0000-0x000000000168A000-memory.dmp upx behavioral1/memory/2168-22-0x00000000005D0000-0x000000000168A000-memory.dmp upx behavioral1/memory/2168-19-0x00000000005D0000-0x000000000168A000-memory.dmp upx behavioral1/memory/2168-17-0x00000000005D0000-0x000000000168A000-memory.dmp upx behavioral1/memory/2168-14-0x00000000005D0000-0x000000000168A000-memory.dmp upx behavioral1/memory/2168-18-0x00000000005D0000-0x000000000168A000-memory.dmp upx behavioral1/memory/2168-62-0x00000000005D0000-0x000000000168A000-memory.dmp upx behavioral1/memory/2168-63-0x00000000005D0000-0x000000000168A000-memory.dmp upx behavioral1/memory/2168-64-0x00000000005D0000-0x000000000168A000-memory.dmp upx behavioral1/memory/2168-65-0x00000000005D0000-0x000000000168A000-memory.dmp upx behavioral1/memory/2168-66-0x00000000005D0000-0x000000000168A000-memory.dmp upx behavioral1/memory/2168-68-0x00000000005D0000-0x000000000168A000-memory.dmp upx behavioral1/memory/2168-69-0x00000000005D0000-0x000000000168A000-memory.dmp upx behavioral1/memory/2168-84-0x00000000005D0000-0x000000000168A000-memory.dmp upx behavioral1/memory/2168-85-0x00000000005D0000-0x000000000168A000-memory.dmp upx behavioral1/memory/2168-87-0x00000000005D0000-0x000000000168A000-memory.dmp upx behavioral1/memory/2168-158-0x00000000005D0000-0x000000000168A000-memory.dmp upx behavioral1/memory/2900-163-0x0000000000970000-0x0000000001A2A000-memory.dmp upx behavioral1/memory/2900-201-0x0000000000970000-0x0000000001A2A000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76b2db.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76b2db.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76b2db.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76b145.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76b145.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76b145.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f76b145.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76b2db.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76b2db.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76b145.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76b145.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76b2db.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f76b2db.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76b145.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76b145.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76b2db.exe -
Enumerates connected drives 3 TTPs 15 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: f76b145.exe File opened (read-only) \??\I: f76b145.exe File opened (read-only) \??\M: f76b145.exe File opened (read-only) \??\R: f76b145.exe File opened (read-only) \??\T: f76b145.exe File opened (read-only) \??\H: f76b145.exe File opened (read-only) \??\J: f76b145.exe File opened (read-only) \??\O: f76b145.exe File opened (read-only) \??\P: f76b145.exe File opened (read-only) \??\G: f76b145.exe File opened (read-only) \??\L: f76b145.exe File opened (read-only) \??\N: f76b145.exe File opened (read-only) \??\K: f76b145.exe File opened (read-only) \??\Q: f76b145.exe File opened (read-only) \??\S: f76b145.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\f76b193 f76b145.exe File opened for modification C:\Windows\SYSTEM.INI f76b145.exe File created C:\Windows\f770232 f76b2db.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f76b145.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f76b2db.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2168 f76b145.exe 2168 f76b145.exe 2900 f76b2db.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeDebugPrivilege 2168 f76b145.exe Token: SeDebugPrivilege 2168 f76b145.exe Token: SeDebugPrivilege 2168 f76b145.exe Token: SeDebugPrivilege 2168 f76b145.exe Token: SeDebugPrivilege 2168 f76b145.exe Token: SeDebugPrivilege 2168 f76b145.exe Token: SeDebugPrivilege 2168 f76b145.exe Token: SeDebugPrivilege 2168 f76b145.exe Token: SeDebugPrivilege 2168 f76b145.exe Token: SeDebugPrivilege 2168 f76b145.exe Token: SeDebugPrivilege 2168 f76b145.exe Token: SeDebugPrivilege 2168 f76b145.exe Token: SeDebugPrivilege 2168 f76b145.exe Token: SeDebugPrivilege 2168 f76b145.exe Token: SeDebugPrivilege 2168 f76b145.exe Token: SeDebugPrivilege 2168 f76b145.exe Token: SeDebugPrivilege 2168 f76b145.exe Token: SeDebugPrivilege 2168 f76b145.exe Token: SeDebugPrivilege 2168 f76b145.exe Token: SeDebugPrivilege 2168 f76b145.exe Token: SeDebugPrivilege 2168 f76b145.exe Token: SeDebugPrivilege 2168 f76b145.exe Token: SeDebugPrivilege 2168 f76b145.exe Token: SeDebugPrivilege 2168 f76b145.exe Token: SeDebugPrivilege 2900 f76b2db.exe Token: SeDebugPrivilege 2900 f76b2db.exe Token: SeDebugPrivilege 2900 f76b2db.exe Token: SeDebugPrivilege 2900 f76b2db.exe Token: SeDebugPrivilege 2900 f76b2db.exe Token: SeDebugPrivilege 2900 f76b2db.exe Token: SeDebugPrivilege 2900 f76b2db.exe Token: SeDebugPrivilege 2900 f76b2db.exe Token: SeDebugPrivilege 2900 f76b2db.exe Token: SeDebugPrivilege 2900 f76b2db.exe Token: SeDebugPrivilege 2900 f76b2db.exe Token: SeDebugPrivilege 2900 f76b2db.exe Token: SeDebugPrivilege 2900 f76b2db.exe Token: SeDebugPrivilege 2900 f76b2db.exe Token: SeDebugPrivilege 2900 f76b2db.exe Token: SeDebugPrivilege 2900 f76b2db.exe Token: SeDebugPrivilege 2900 f76b2db.exe Token: SeDebugPrivilege 2900 f76b2db.exe Token: SeDebugPrivilege 2900 f76b2db.exe Token: SeDebugPrivilege 2900 f76b2db.exe Token: SeDebugPrivilege 2900 f76b2db.exe Token: SeDebugPrivilege 2900 f76b2db.exe -
Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 1380 wrote to memory of 1928 1380 rundll32.exe 30 PID 1380 wrote to memory of 1928 1380 rundll32.exe 30 PID 1380 wrote to memory of 1928 1380 rundll32.exe 30 PID 1380 wrote to memory of 1928 1380 rundll32.exe 30 PID 1380 wrote to memory of 1928 1380 rundll32.exe 30 PID 1380 wrote to memory of 1928 1380 rundll32.exe 30 PID 1380 wrote to memory of 1928 1380 rundll32.exe 30 PID 1928 wrote to memory of 2168 1928 rundll32.exe 31 PID 1928 wrote to memory of 2168 1928 rundll32.exe 31 PID 1928 wrote to memory of 2168 1928 rundll32.exe 31 PID 1928 wrote to memory of 2168 1928 rundll32.exe 31 PID 2168 wrote to memory of 1124 2168 f76b145.exe 19 PID 2168 wrote to memory of 1176 2168 f76b145.exe 20 PID 2168 wrote to memory of 1272 2168 f76b145.exe 21 PID 2168 wrote to memory of 1228 2168 f76b145.exe 23 PID 2168 wrote to memory of 1380 2168 f76b145.exe 29 PID 2168 wrote to memory of 1928 2168 f76b145.exe 30 PID 2168 wrote to memory of 1928 2168 f76b145.exe 30 PID 1928 wrote to memory of 2900 1928 rundll32.exe 32 PID 1928 wrote to memory of 2900 1928 rundll32.exe 32 PID 1928 wrote to memory of 2900 1928 rundll32.exe 32 PID 1928 wrote to memory of 2900 1928 rundll32.exe 32 PID 1928 wrote to memory of 2240 1928 rundll32.exe 34 PID 1928 wrote to memory of 2240 1928 rundll32.exe 34 PID 1928 wrote to memory of 2240 1928 rundll32.exe 34 PID 1928 wrote to memory of 2240 1928 rundll32.exe 34 PID 2168 wrote to memory of 1124 2168 f76b145.exe 19 PID 2168 wrote to memory of 1176 2168 f76b145.exe 20 PID 2168 wrote to memory of 1272 2168 f76b145.exe 21 PID 2168 wrote to memory of 1228 2168 f76b145.exe 23 PID 2168 wrote to memory of 2900 2168 f76b145.exe 32 PID 2168 wrote to memory of 2900 2168 f76b145.exe 32 PID 2168 wrote to memory of 2240 2168 f76b145.exe 34 PID 2168 wrote to memory of 2240 2168 f76b145.exe 34 PID 2900 wrote to memory of 1124 2900 f76b2db.exe 19 PID 2900 wrote to memory of 1176 2900 f76b2db.exe 20 PID 2900 wrote to memory of 1272 2900 f76b2db.exe 21 PID 2900 wrote to memory of 1228 2900 f76b2db.exe 23 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76b2db.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76b145.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1124
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1176
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1272
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1444ea2dd5972f5e86fa7b8ca98e2700N.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:1380 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1444ea2dd5972f5e86fa7b8ca98e2700N.dll,#13⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\f76b145.exeC:\Users\Admin\AppData\Local\Temp\f76b145.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2168
-
-
C:\Users\Admin\AppData\Local\Temp\f76b2db.exeC:\Users\Admin\AppData\Local\Temp\f76b2db.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2900
-
-
C:\Users\Admin\AppData\Local\Temp\f76cd2e.exeC:\Users\Admin\AppData\Local\Temp\f76cd2e.exe4⤵
- Executes dropped EXE
PID:2240
-
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1228
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
257B
MD515b94017f7b158846fbb087495012f8a
SHA17b8e8d6ff4b4a0a8baee52f53043f6ab09b59c5b
SHA256f25a5f83984a676b7956dc8ae756cc384dc17dd560357b4c3530e609ac6c49a4
SHA5121bf4acf0ab01d193be4370234a883da09a71ecf1bc70241b3d8255371623b63e561dff909221c0fe78979ccf0e96deb8d8cd519e3f43dbbce9a31f31868191b1
-
Filesize
97KB
MD5fbb942f8db7c8cb0cec86194b6fac79e
SHA1f8cbd2bda17a7d59a3b23c1d092648eb01a6c8aa
SHA2561f560e6c7580236aee4de4a4b78b15e49a22adc8e81242f4ba8b9d660a782a38
SHA5123810e2e7e53baf5d23b599167573074e58fc5fdf6a3314064eebe9cb142144494237211c9ec00cfce195690a7bc0b763ecb6ab430672f0b700e694116efb71e8