Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    28s
  • max time network
    16s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    19/09/2024, 00:06

General

  • Target

    99dea991bf7691d21511f80d85f3f9be14149cf554821a27e38bde79e74727fbN.dll

  • Size

    120KB

  • MD5

    8d774e7dbebae07f2fa78cdbab27edc0

  • SHA1

    ac62dad926c673b40915ebc2f8633318dfbcdee5

  • SHA256

    99dea991bf7691d21511f80d85f3f9be14149cf554821a27e38bde79e74727fb

  • SHA512

    3dcc6c61f73a95645b27502ee88f8550e2e3967bd6390fce6d57f2b18a9dfc83b3c6ceaddd52489fb3ecf1d846e445463b332a3b077fa8a7af2551c0b779e46d

  • SSDEEP

    1536:giXYpwlDVoqnt8FpxujfxpDyp3cvG2RvG4cBZtp/B6zUZhhBJsGV6GcavPh9EWVo:zXXVoaynujJNypMtdcntZBH0yD7RVjc

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Signatures

  • Modifies firewall policy service 3 TTPs 6 IoCs
  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

  • UAC bypass 3 TTPs 2 IoCs
  • Windows security bypass 2 TTPs 12 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 6 IoCs
  • UPX packed file 25 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Windows security modification 2 TTPs 14 IoCs
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
  • Enumerates connected drives 3 TTPs 12 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 46 IoCs
  • Suspicious use of WriteProcessMemory 38 IoCs
  • System policy modification 1 TTPs 2 IoCs

Processes

  • C:\Windows\system32\Dwm.exe
    "C:\Windows\system32\Dwm.exe"
    1⤵
      PID:1044
    • C:\Windows\system32\taskhost.exe
      "taskhost.exe"
      1⤵
        PID:1068
      • C:\Windows\Explorer.EXE
        C:\Windows\Explorer.EXE
        1⤵
          PID:1128
          • C:\Windows\system32\rundll32.exe
            rundll32.exe C:\Users\Admin\AppData\Local\Temp\99dea991bf7691d21511f80d85f3f9be14149cf554821a27e38bde79e74727fbN.dll,#1
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:2112
            • C:\Windows\SysWOW64\rundll32.exe
              rundll32.exe C:\Users\Admin\AppData\Local\Temp\99dea991bf7691d21511f80d85f3f9be14149cf554821a27e38bde79e74727fbN.dll,#1
              3⤵
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:1864
              • C:\Users\Admin\AppData\Local\Temp\f76aca4.exe
                C:\Users\Admin\AppData\Local\Temp\f76aca4.exe
                4⤵
                • Modifies firewall policy service
                • UAC bypass
                • Windows security bypass
                • Executes dropped EXE
                • Windows security modification
                • Checks whether UAC is enabled
                • Enumerates connected drives
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                • System policy modification
                PID:2904
              • C:\Users\Admin\AppData\Local\Temp\f76ae68.exe
                C:\Users\Admin\AppData\Local\Temp\f76ae68.exe
                4⤵
                • Modifies firewall policy service
                • UAC bypass
                • Windows security bypass
                • Executes dropped EXE
                • Windows security modification
                • Checks whether UAC is enabled
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                • System policy modification
                PID:2612
              • C:\Users\Admin\AppData\Local\Temp\f76cde9.exe
                C:\Users\Admin\AppData\Local\Temp\f76cde9.exe
                4⤵
                • Executes dropped EXE
                PID:2528
        • C:\Windows\system32\DllHost.exe
          C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
          1⤵
            PID:1996

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Windows\SYSTEM.INI

            Filesize

            257B

            MD5

            6b601239b2ba4e0adb0d9c06ce1d2b31

            SHA1

            245320c5f1e64637ebefd30c11ae8d5df1334250

            SHA256

            c60534522d2e69a0a2b9818c2f3f6779b0eda997e5c1b75fb7f0f9a48fcb82f5

            SHA512

            25ec6ae3c8bb5cb8bda04f2a0954479ae94c16061dd42215bb7af621e4f761f1aa0618d6568079cc8070d632f60a8095800657102204598cd524fe476486b3c2

          • \Users\Admin\AppData\Local\Temp\f76aca4.exe

            Filesize

            97KB

            MD5

            f5f30081b87865ff7c46fe7c5029e0df

            SHA1

            1cbbc681e6b7d66e49293577201eaf2c6c16ee3e

            SHA256

            79b46816aae06497aa071fa22ca166845377a2c56ad866c16edadff3c1b5f94f

            SHA512

            498c41adbc69b83367f6b7f0c8a9de61c43dba5f735f81510c7b4dad10bfd089be0d99cc6807f925f18ccbddd2d15e0d2379b5b35712a5cf8ca1ded2db6a4870

          • memory/1044-27-0x0000000001E20000-0x0000000001E22000-memory.dmp

            Filesize

            8KB

          • memory/1864-78-0x0000000000230000-0x0000000000242000-memory.dmp

            Filesize

            72KB

          • memory/1864-1-0x0000000010000000-0x0000000010020000-memory.dmp

            Filesize

            128KB

          • memory/1864-76-0x00000000001B0000-0x00000000001B2000-memory.dmp

            Filesize

            8KB

          • memory/1864-44-0x00000000001C0000-0x00000000001C1000-memory.dmp

            Filesize

            4KB

          • memory/1864-79-0x0000000000170000-0x0000000000172000-memory.dmp

            Filesize

            8KB

          • memory/1864-75-0x0000000000230000-0x0000000000242000-memory.dmp

            Filesize

            72KB

          • memory/1864-55-0x00000000001B0000-0x00000000001B2000-memory.dmp

            Filesize

            8KB

          • memory/1864-56-0x0000000000210000-0x0000000000222000-memory.dmp

            Filesize

            72KB

          • memory/1864-57-0x00000000001B0000-0x00000000001B2000-memory.dmp

            Filesize

            8KB

          • memory/1864-9-0x0000000000170000-0x0000000000182000-memory.dmp

            Filesize

            72KB

          • memory/1864-35-0x00000000001C0000-0x00000000001C1000-memory.dmp

            Filesize

            4KB

          • memory/1864-34-0x00000000001B0000-0x00000000001B2000-memory.dmp

            Filesize

            8KB

          • memory/2528-102-0x00000000003E0000-0x00000000003E2000-memory.dmp

            Filesize

            8KB

          • memory/2528-103-0x00000000003E0000-0x00000000003E2000-memory.dmp

            Filesize

            8KB

          • memory/2528-195-0x0000000000400000-0x0000000000412000-memory.dmp

            Filesize

            72KB

          • memory/2528-81-0x0000000000400000-0x0000000000412000-memory.dmp

            Filesize

            72KB

          • memory/2528-101-0x00000000003F0000-0x00000000003F1000-memory.dmp

            Filesize

            4KB

          • memory/2528-130-0x00000000003E0000-0x00000000003E2000-memory.dmp

            Filesize

            8KB

          • memory/2612-165-0x0000000000A60000-0x0000000001B1A000-memory.dmp

            Filesize

            16.7MB

          • memory/2612-59-0x0000000000400000-0x0000000000412000-memory.dmp

            Filesize

            72KB

          • memory/2612-122-0x0000000000360000-0x0000000000362000-memory.dmp

            Filesize

            8KB

          • memory/2612-191-0x0000000000A60000-0x0000000001B1A000-memory.dmp

            Filesize

            16.7MB

          • memory/2612-190-0x0000000000400000-0x0000000000412000-memory.dmp

            Filesize

            72KB

          • memory/2612-93-0x00000000003B0000-0x00000000003B1000-memory.dmp

            Filesize

            4KB

          • memory/2612-94-0x0000000000360000-0x0000000000362000-memory.dmp

            Filesize

            8KB

          • memory/2612-95-0x0000000000360000-0x0000000000362000-memory.dmp

            Filesize

            8KB

          • memory/2904-83-0x0000000000690000-0x000000000174A000-memory.dmp

            Filesize

            16.7MB

          • memory/2904-11-0x0000000000690000-0x000000000174A000-memory.dmp

            Filesize

            16.7MB

          • memory/2904-14-0x0000000000690000-0x000000000174A000-memory.dmp

            Filesize

            16.7MB

          • memory/2904-82-0x00000000002B0000-0x00000000002B2000-memory.dmp

            Filesize

            8KB

          • memory/2904-66-0x0000000000690000-0x000000000174A000-memory.dmp

            Filesize

            16.7MB

          • memory/2904-19-0x0000000000690000-0x000000000174A000-memory.dmp

            Filesize

            16.7MB

          • memory/2904-15-0x0000000000690000-0x000000000174A000-memory.dmp

            Filesize

            16.7MB

          • memory/2904-45-0x0000000000300000-0x0000000000301000-memory.dmp

            Filesize

            4KB

          • memory/2904-84-0x0000000000690000-0x000000000174A000-memory.dmp

            Filesize

            16.7MB

          • memory/2904-64-0x0000000000690000-0x000000000174A000-memory.dmp

            Filesize

            16.7MB

          • memory/2904-63-0x0000000000690000-0x000000000174A000-memory.dmp

            Filesize

            16.7MB

          • memory/2904-62-0x0000000000690000-0x000000000174A000-memory.dmp

            Filesize

            16.7MB

          • memory/2904-61-0x0000000000690000-0x000000000174A000-memory.dmp

            Filesize

            16.7MB

          • memory/2904-13-0x0000000000690000-0x000000000174A000-memory.dmp

            Filesize

            16.7MB

          • memory/2904-60-0x0000000000690000-0x000000000174A000-memory.dmp

            Filesize

            16.7MB

          • memory/2904-104-0x0000000000690000-0x000000000174A000-memory.dmp

            Filesize

            16.7MB

          • memory/2904-106-0x0000000000690000-0x000000000174A000-memory.dmp

            Filesize

            16.7MB

          • memory/2904-108-0x0000000000690000-0x000000000174A000-memory.dmp

            Filesize

            16.7MB

          • memory/2904-109-0x0000000000690000-0x000000000174A000-memory.dmp

            Filesize

            16.7MB

          • memory/2904-16-0x0000000000690000-0x000000000174A000-memory.dmp

            Filesize

            16.7MB

          • memory/2904-18-0x0000000000690000-0x000000000174A000-memory.dmp

            Filesize

            16.7MB

          • memory/2904-152-0x0000000000690000-0x000000000174A000-memory.dmp

            Filesize

            16.7MB

          • memory/2904-151-0x0000000000400000-0x0000000000412000-memory.dmp

            Filesize

            72KB

          • memory/2904-10-0x0000000000400000-0x0000000000412000-memory.dmp

            Filesize

            72KB

          • memory/2904-20-0x0000000000690000-0x000000000174A000-memory.dmp

            Filesize

            16.7MB

          • memory/2904-21-0x0000000000690000-0x000000000174A000-memory.dmp

            Filesize

            16.7MB

          • memory/2904-17-0x0000000000690000-0x000000000174A000-memory.dmp

            Filesize

            16.7MB

          • memory/2904-48-0x00000000002B0000-0x00000000002B2000-memory.dmp

            Filesize

            8KB