Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19-09-2024 06:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a4f5e3a560c341052e58beec624270ed21ed57d50ba2e53dd629312131a9cc96N.dll
Resource
win7-20240903-en
windows7-x64
16 signatures
120 seconds
General
-
Target
a4f5e3a560c341052e58beec624270ed21ed57d50ba2e53dd629312131a9cc96N.dll
-
Size
120KB
-
MD5
d3261a098753109d413c4141984cf6b0
-
SHA1
a9df9164bde9c766c9421456eb4543672186b431
-
SHA256
a4f5e3a560c341052e58beec624270ed21ed57d50ba2e53dd629312131a9cc96
-
SHA512
65e91c017de91fe33df6ae4305aac7c403c8189769caf4e7ad903a2bdf086d031265fa67b3916a31f705690b14d50fa66449fc6c9f12edf6626a21b107c10b0c
-
SSDEEP
3072:HlXeFazaLsJgelwL7nV5XmBeRX1ClrQXZJ:Hg4aKgelwfbXm2gyXZ
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f76aad0.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f76a969.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f76a969.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f76a969.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f76aad0.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f76aad0.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76a969.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76aad0.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76aad0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76aad0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76a969.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76a969.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76a969.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76a969.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76a969.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76aad0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76aad0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76a969.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76aad0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76aad0.exe -
Executes dropped EXE 3 IoCs
pid Process 2696 f76a969.exe 2732 f76aad0.exe 2736 f76c7c2.exe -
Loads dropped DLL 6 IoCs
pid Process 536 rundll32.exe 536 rundll32.exe 536 rundll32.exe 536 rundll32.exe 536 rundll32.exe 536 rundll32.exe -
resource yara_rule behavioral1/memory/2696-19-0x00000000005D0000-0x000000000168A000-memory.dmp upx behavioral1/memory/2696-23-0x00000000005D0000-0x000000000168A000-memory.dmp upx behavioral1/memory/2696-20-0x00000000005D0000-0x000000000168A000-memory.dmp upx behavioral1/memory/2696-25-0x00000000005D0000-0x000000000168A000-memory.dmp upx behavioral1/memory/2696-18-0x00000000005D0000-0x000000000168A000-memory.dmp upx behavioral1/memory/2696-17-0x00000000005D0000-0x000000000168A000-memory.dmp upx behavioral1/memory/2696-26-0x00000000005D0000-0x000000000168A000-memory.dmp upx behavioral1/memory/2696-24-0x00000000005D0000-0x000000000168A000-memory.dmp upx behavioral1/memory/2696-22-0x00000000005D0000-0x000000000168A000-memory.dmp upx behavioral1/memory/2696-21-0x00000000005D0000-0x000000000168A000-memory.dmp upx behavioral1/memory/2696-65-0x00000000005D0000-0x000000000168A000-memory.dmp upx behavioral1/memory/2696-66-0x00000000005D0000-0x000000000168A000-memory.dmp upx behavioral1/memory/2696-67-0x00000000005D0000-0x000000000168A000-memory.dmp upx behavioral1/memory/2696-68-0x00000000005D0000-0x000000000168A000-memory.dmp upx behavioral1/memory/2696-69-0x00000000005D0000-0x000000000168A000-memory.dmp upx behavioral1/memory/2696-72-0x00000000005D0000-0x000000000168A000-memory.dmp upx behavioral1/memory/2696-73-0x00000000005D0000-0x000000000168A000-memory.dmp upx behavioral1/memory/2696-74-0x00000000005D0000-0x000000000168A000-memory.dmp upx behavioral1/memory/2696-89-0x00000000005D0000-0x000000000168A000-memory.dmp upx behavioral1/memory/2696-155-0x00000000005D0000-0x000000000168A000-memory.dmp upx behavioral1/memory/2732-163-0x0000000000910000-0x00000000019CA000-memory.dmp upx behavioral1/memory/2732-193-0x0000000000910000-0x00000000019CA000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76a969.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f76aad0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76a969.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76a969.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76aad0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76aad0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76a969.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f76a969.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76aad0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76a969.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76aad0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76aad0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76aad0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76a969.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76aad0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76a969.exe -
Enumerates connected drives 3 TTPs 15 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\R: f76a969.exe File opened (read-only) \??\I: f76a969.exe File opened (read-only) \??\M: f76a969.exe File opened (read-only) \??\N: f76a969.exe File opened (read-only) \??\K: f76a969.exe File opened (read-only) \??\P: f76a969.exe File opened (read-only) \??\T: f76a969.exe File opened (read-only) \??\E: f76a969.exe File opened (read-only) \??\G: f76a969.exe File opened (read-only) \??\J: f76a969.exe File opened (read-only) \??\Q: f76a969.exe File opened (read-only) \??\S: f76a969.exe File opened (read-only) \??\H: f76a969.exe File opened (read-only) \??\L: f76a969.exe File opened (read-only) \??\O: f76a969.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI f76a969.exe File created C:\Windows\f76fa37 f76aad0.exe File created C:\Windows\f76a9a7 f76a969.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f76a969.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f76aad0.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2696 f76a969.exe 2696 f76a969.exe 2732 f76aad0.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeDebugPrivilege 2696 f76a969.exe Token: SeDebugPrivilege 2696 f76a969.exe Token: SeDebugPrivilege 2696 f76a969.exe Token: SeDebugPrivilege 2696 f76a969.exe Token: SeDebugPrivilege 2696 f76a969.exe Token: SeDebugPrivilege 2696 f76a969.exe Token: SeDebugPrivilege 2696 f76a969.exe Token: SeDebugPrivilege 2696 f76a969.exe Token: SeDebugPrivilege 2696 f76a969.exe Token: SeDebugPrivilege 2696 f76a969.exe Token: SeDebugPrivilege 2696 f76a969.exe Token: SeDebugPrivilege 2696 f76a969.exe Token: SeDebugPrivilege 2696 f76a969.exe Token: SeDebugPrivilege 2696 f76a969.exe Token: SeDebugPrivilege 2696 f76a969.exe Token: SeDebugPrivilege 2696 f76a969.exe Token: SeDebugPrivilege 2696 f76a969.exe Token: SeDebugPrivilege 2696 f76a969.exe Token: SeDebugPrivilege 2696 f76a969.exe Token: SeDebugPrivilege 2696 f76a969.exe Token: SeDebugPrivilege 2696 f76a969.exe Token: SeDebugPrivilege 2696 f76a969.exe Token: SeDebugPrivilege 2696 f76a969.exe Token: SeDebugPrivilege 2696 f76a969.exe Token: SeDebugPrivilege 2732 f76aad0.exe Token: SeDebugPrivilege 2732 f76aad0.exe Token: SeDebugPrivilege 2732 f76aad0.exe Token: SeDebugPrivilege 2732 f76aad0.exe Token: SeDebugPrivilege 2732 f76aad0.exe Token: SeDebugPrivilege 2732 f76aad0.exe Token: SeDebugPrivilege 2732 f76aad0.exe Token: SeDebugPrivilege 2732 f76aad0.exe Token: SeDebugPrivilege 2732 f76aad0.exe Token: SeDebugPrivilege 2732 f76aad0.exe Token: SeDebugPrivilege 2732 f76aad0.exe Token: SeDebugPrivilege 2732 f76aad0.exe Token: SeDebugPrivilege 2732 f76aad0.exe Token: SeDebugPrivilege 2732 f76aad0.exe Token: SeDebugPrivilege 2732 f76aad0.exe Token: SeDebugPrivilege 2732 f76aad0.exe Token: SeDebugPrivilege 2732 f76aad0.exe Token: SeDebugPrivilege 2732 f76aad0.exe Token: SeDebugPrivilege 2732 f76aad0.exe Token: SeDebugPrivilege 2732 f76aad0.exe Token: SeDebugPrivilege 2732 f76aad0.exe Token: SeDebugPrivilege 2732 f76aad0.exe -
Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 600 wrote to memory of 536 600 rundll32.exe 30 PID 600 wrote to memory of 536 600 rundll32.exe 30 PID 600 wrote to memory of 536 600 rundll32.exe 30 PID 600 wrote to memory of 536 600 rundll32.exe 30 PID 600 wrote to memory of 536 600 rundll32.exe 30 PID 600 wrote to memory of 536 600 rundll32.exe 30 PID 600 wrote to memory of 536 600 rundll32.exe 30 PID 536 wrote to memory of 2696 536 rundll32.exe 31 PID 536 wrote to memory of 2696 536 rundll32.exe 31 PID 536 wrote to memory of 2696 536 rundll32.exe 31 PID 536 wrote to memory of 2696 536 rundll32.exe 31 PID 2696 wrote to memory of 1112 2696 f76a969.exe 19 PID 2696 wrote to memory of 1164 2696 f76a969.exe 20 PID 2696 wrote to memory of 1192 2696 f76a969.exe 21 PID 2696 wrote to memory of 1868 2696 f76a969.exe 25 PID 2696 wrote to memory of 600 2696 f76a969.exe 29 PID 2696 wrote to memory of 536 2696 f76a969.exe 30 PID 2696 wrote to memory of 536 2696 f76a969.exe 30 PID 536 wrote to memory of 2732 536 rundll32.exe 32 PID 536 wrote to memory of 2732 536 rundll32.exe 32 PID 536 wrote to memory of 2732 536 rundll32.exe 32 PID 536 wrote to memory of 2732 536 rundll32.exe 32 PID 536 wrote to memory of 2736 536 rundll32.exe 33 PID 536 wrote to memory of 2736 536 rundll32.exe 33 PID 536 wrote to memory of 2736 536 rundll32.exe 33 PID 536 wrote to memory of 2736 536 rundll32.exe 33 PID 2696 wrote to memory of 1112 2696 f76a969.exe 19 PID 2696 wrote to memory of 1164 2696 f76a969.exe 20 PID 2696 wrote to memory of 1192 2696 f76a969.exe 21 PID 2696 wrote to memory of 1868 2696 f76a969.exe 25 PID 2696 wrote to memory of 2732 2696 f76a969.exe 32 PID 2696 wrote to memory of 2732 2696 f76a969.exe 32 PID 2696 wrote to memory of 2736 2696 f76a969.exe 33 PID 2696 wrote to memory of 2736 2696 f76a969.exe 33 PID 2732 wrote to memory of 1112 2732 f76aad0.exe 19 PID 2732 wrote to memory of 1164 2732 f76aad0.exe 20 PID 2732 wrote to memory of 1192 2732 f76aad0.exe 21 PID 2732 wrote to memory of 1868 2732 f76aad0.exe 25 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76aad0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76a969.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1112
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1164
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1192
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a4f5e3a560c341052e58beec624270ed21ed57d50ba2e53dd629312131a9cc96N.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:600 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a4f5e3a560c341052e58beec624270ed21ed57d50ba2e53dd629312131a9cc96N.dll,#13⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:536 -
C:\Users\Admin\AppData\Local\Temp\f76a969.exeC:\Users\Admin\AppData\Local\Temp\f76a969.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2696
-
-
C:\Users\Admin\AppData\Local\Temp\f76aad0.exeC:\Users\Admin\AppData\Local\Temp\f76aad0.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2732
-
-
C:\Users\Admin\AppData\Local\Temp\f76c7c2.exeC:\Users\Admin\AppData\Local\Temp\f76c7c2.exe4⤵
- Executes dropped EXE
PID:2736
-
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1868
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
257B
MD559d82f5c4b8b3809efae1cafb31e8dfc
SHA118f5826fe261c565a5fe008db36aac16c82d1807
SHA256bd0fa5c13a2b6227fdb0d0a325ed5069b7b26fb3ba615034ad31ecf6745309e8
SHA512faa136184a0507798190ffc4fa6b1e8daba5093015835684e56fc5cac136d9421f27018bf982a2ba010a0bbd741c9b683ceefb10c889c54af5571573cb4b8fc5
-
Filesize
97KB
MD58b66ba524901db0e2ce873477b784deb
SHA112fda2d8217a029713dbd79f3a31e4b48bf04364
SHA2565123da186d1ad2e382d8e3de696c7ca12be34c409061c134a540b05c816a6a2e
SHA512b211d64d8e6e21d7cdda6efac25d1dc1c8c466371484e45c213ebab375e5d2998e90ea41f05f6f9b7bd864c0f1f52e2b8560f4e464f0cc54acbfc424f360f2b2