Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
05/10/2024, 19:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2b262c712bb6ef02721aded9e38e3282ab2af5c247ce01a174ce51036146c5ad.dll
Resource
win7-20240708-en
windows7-x64
16 signatures
150 seconds
General
-
Target
2b262c712bb6ef02721aded9e38e3282ab2af5c247ce01a174ce51036146c5ad.dll
-
Size
120KB
-
MD5
b58af988bb6b08ead9db4307422a38d2
-
SHA1
e8ebe1936972a6b9d74eba676620231fb1a47087
-
SHA256
2b262c712bb6ef02721aded9e38e3282ab2af5c247ce01a174ce51036146c5ad
-
SHA512
3fc301fbccde1f79c8278b77635e3df0da17c6516327704fc950b5a416886f3db06a5489aa03c6c8fe878aac6bdde2930177e867381ed0583a20efe043a6aff3
-
SSDEEP
3072:zioao5+7imXyx6i1f2xY7SpvC0u4SgRyTiJc:+oao5mXjuGpq0XS1Ti
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f76a13f.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f76a13f.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f76bd18.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f76bd18.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f76bd18.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f76a13f.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76a13f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76bd18.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76bd18.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76bd18.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76a13f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76a13f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76bd18.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76bd18.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76a13f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76a13f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76a13f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76a13f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76bd18.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76bd18.exe -
Executes dropped EXE 3 IoCs
pid Process 3012 f76a13f.exe 2708 f76a2c5.exe 1784 f76bd18.exe -
Loads dropped DLL 6 IoCs
pid Process 2984 rundll32.exe 2984 rundll32.exe 2984 rundll32.exe 2984 rundll32.exe 2984 rundll32.exe 2984 rundll32.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76a13f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76a13f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76a13f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76bd18.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76bd18.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76a13f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f76a13f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76bd18.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76bd18.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76a13f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76a13f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76bd18.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76bd18.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f76bd18.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76a13f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76bd18.exe -
Enumerates connected drives 3 TTPs 17 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\M: f76a13f.exe File opened (read-only) \??\O: f76a13f.exe File opened (read-only) \??\T: f76a13f.exe File opened (read-only) \??\E: f76bd18.exe File opened (read-only) \??\G: f76bd18.exe File opened (read-only) \??\I: f76a13f.exe File opened (read-only) \??\K: f76a13f.exe File opened (read-only) \??\P: f76a13f.exe File opened (read-only) \??\R: f76a13f.exe File opened (read-only) \??\S: f76a13f.exe File opened (read-only) \??\E: f76a13f.exe File opened (read-only) \??\G: f76a13f.exe File opened (read-only) \??\H: f76a13f.exe File opened (read-only) \??\J: f76a13f.exe File opened (read-only) \??\L: f76a13f.exe File opened (read-only) \??\N: f76a13f.exe File opened (read-only) \??\Q: f76a13f.exe -
resource yara_rule behavioral1/memory/3012-12-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/3012-17-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/3012-19-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/3012-15-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/3012-22-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/3012-21-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/3012-20-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/3012-23-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/3012-16-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/3012-14-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/3012-18-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/3012-64-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/3012-63-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/3012-65-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/3012-67-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/3012-66-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/3012-69-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/3012-70-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/3012-83-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/3012-84-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/3012-88-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/3012-89-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/3012-155-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/1784-167-0x0000000000970000-0x0000000001A2A000-memory.dmp upx behavioral1/memory/1784-208-0x0000000000970000-0x0000000001A2A000-memory.dmp upx -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI f76a13f.exe File created C:\Windows\f76f1af f76bd18.exe File created C:\Windows\f76a17d f76a13f.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f76a13f.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f76bd18.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 3012 f76a13f.exe 3012 f76a13f.exe 1784 f76bd18.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeDebugPrivilege 3012 f76a13f.exe Token: SeDebugPrivilege 3012 f76a13f.exe Token: SeDebugPrivilege 3012 f76a13f.exe Token: SeDebugPrivilege 3012 f76a13f.exe Token: SeDebugPrivilege 3012 f76a13f.exe Token: SeDebugPrivilege 3012 f76a13f.exe Token: SeDebugPrivilege 3012 f76a13f.exe Token: SeDebugPrivilege 3012 f76a13f.exe Token: SeDebugPrivilege 3012 f76a13f.exe Token: SeDebugPrivilege 3012 f76a13f.exe Token: SeDebugPrivilege 3012 f76a13f.exe Token: SeDebugPrivilege 3012 f76a13f.exe Token: SeDebugPrivilege 3012 f76a13f.exe Token: SeDebugPrivilege 3012 f76a13f.exe Token: SeDebugPrivilege 3012 f76a13f.exe Token: SeDebugPrivilege 3012 f76a13f.exe Token: SeDebugPrivilege 3012 f76a13f.exe Token: SeDebugPrivilege 3012 f76a13f.exe Token: SeDebugPrivilege 3012 f76a13f.exe Token: SeDebugPrivilege 3012 f76a13f.exe Token: SeDebugPrivilege 3012 f76a13f.exe Token: SeDebugPrivilege 3012 f76a13f.exe Token: SeDebugPrivilege 3012 f76a13f.exe Token: SeDebugPrivilege 1784 f76bd18.exe Token: SeDebugPrivilege 1784 f76bd18.exe Token: SeDebugPrivilege 1784 f76bd18.exe Token: SeDebugPrivilege 1784 f76bd18.exe Token: SeDebugPrivilege 1784 f76bd18.exe Token: SeDebugPrivilege 1784 f76bd18.exe Token: SeDebugPrivilege 1784 f76bd18.exe Token: SeDebugPrivilege 1784 f76bd18.exe Token: SeDebugPrivilege 1784 f76bd18.exe Token: SeDebugPrivilege 1784 f76bd18.exe Token: SeDebugPrivilege 1784 f76bd18.exe Token: SeDebugPrivilege 1784 f76bd18.exe Token: SeDebugPrivilege 1784 f76bd18.exe Token: SeDebugPrivilege 1784 f76bd18.exe Token: SeDebugPrivilege 1784 f76bd18.exe Token: SeDebugPrivilege 1784 f76bd18.exe Token: SeDebugPrivilege 1784 f76bd18.exe Token: SeDebugPrivilege 1784 f76bd18.exe Token: SeDebugPrivilege 1784 f76bd18.exe Token: SeDebugPrivilege 1784 f76bd18.exe Token: SeDebugPrivilege 1784 f76bd18.exe Token: SeDebugPrivilege 1784 f76bd18.exe Token: SeDebugPrivilege 1784 f76bd18.exe -
Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 2964 wrote to memory of 2984 2964 rundll32.exe 30 PID 2964 wrote to memory of 2984 2964 rundll32.exe 30 PID 2964 wrote to memory of 2984 2964 rundll32.exe 30 PID 2964 wrote to memory of 2984 2964 rundll32.exe 30 PID 2964 wrote to memory of 2984 2964 rundll32.exe 30 PID 2964 wrote to memory of 2984 2964 rundll32.exe 30 PID 2964 wrote to memory of 2984 2964 rundll32.exe 30 PID 2984 wrote to memory of 3012 2984 rundll32.exe 31 PID 2984 wrote to memory of 3012 2984 rundll32.exe 31 PID 2984 wrote to memory of 3012 2984 rundll32.exe 31 PID 2984 wrote to memory of 3012 2984 rundll32.exe 31 PID 3012 wrote to memory of 1112 3012 f76a13f.exe 19 PID 3012 wrote to memory of 1164 3012 f76a13f.exe 20 PID 3012 wrote to memory of 1200 3012 f76a13f.exe 21 PID 3012 wrote to memory of 1416 3012 f76a13f.exe 25 PID 3012 wrote to memory of 2964 3012 f76a13f.exe 29 PID 3012 wrote to memory of 2984 3012 f76a13f.exe 30 PID 3012 wrote to memory of 2984 3012 f76a13f.exe 30 PID 2984 wrote to memory of 2708 2984 rundll32.exe 32 PID 2984 wrote to memory of 2708 2984 rundll32.exe 32 PID 2984 wrote to memory of 2708 2984 rundll32.exe 32 PID 2984 wrote to memory of 2708 2984 rundll32.exe 32 PID 2984 wrote to memory of 1784 2984 rundll32.exe 33 PID 2984 wrote to memory of 1784 2984 rundll32.exe 33 PID 2984 wrote to memory of 1784 2984 rundll32.exe 33 PID 2984 wrote to memory of 1784 2984 rundll32.exe 33 PID 3012 wrote to memory of 1112 3012 f76a13f.exe 19 PID 3012 wrote to memory of 1164 3012 f76a13f.exe 20 PID 3012 wrote to memory of 1200 3012 f76a13f.exe 21 PID 3012 wrote to memory of 1416 3012 f76a13f.exe 25 PID 3012 wrote to memory of 2708 3012 f76a13f.exe 32 PID 3012 wrote to memory of 2708 3012 f76a13f.exe 32 PID 3012 wrote to memory of 1784 3012 f76a13f.exe 33 PID 3012 wrote to memory of 1784 3012 f76a13f.exe 33 PID 1784 wrote to memory of 1112 1784 f76bd18.exe 19 PID 1784 wrote to memory of 1164 1784 f76bd18.exe 20 PID 1784 wrote to memory of 1200 1784 f76bd18.exe 21 PID 1784 wrote to memory of 1416 1784 f76bd18.exe 25 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76a13f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76bd18.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1112
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1164
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1200
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b262c712bb6ef02721aded9e38e3282ab2af5c247ce01a174ce51036146c5ad.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b262c712bb6ef02721aded9e38e3282ab2af5c247ce01a174ce51036146c5ad.dll,#13⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\f76a13f.exeC:\Users\Admin\AppData\Local\Temp\f76a13f.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3012
-
-
C:\Users\Admin\AppData\Local\Temp\f76a2c5.exeC:\Users\Admin\AppData\Local\Temp\f76a2c5.exe4⤵
- Executes dropped EXE
PID:2708
-
-
C:\Users\Admin\AppData\Local\Temp\f76bd18.exeC:\Users\Admin\AppData\Local\Temp\f76bd18.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1784
-
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1416
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
257B
MD5e9f43150eaf68a0a0af967539d7f7b57
SHA1337915509893b7efd70387b0c5ca5bca746b3b7b
SHA256d3d38765a4b4548eb7fc1815f97aa0b6190019e33c3c21fe36bfd80ffdd0962b
SHA51236732329f96292b572ecc5a71121cf68fc15fb9876306b41fdfffa0b8e564c871fb6a0e98224d5e6844e8d00c8eb1fdc27f4eaf32eed1cf1639747d0834f6b23
-
Filesize
97KB
MD5cf9a207fef9057573f6b59d1bdcff9cc
SHA1799d340ac9332bb2829879a4e5afb21842da879d
SHA2568fcf1abca814bf8b2232b471315e1ffa893bd0dd7714fa20b596e131024838dd
SHA5128f47a1fc3e00c609a184b3e49a7af6e33d6bf99006a42c47b232eb14e558d16c380073ae30b2f5dcdd7b6f51dc3db88ec9ce56f6419734e310e0633f0b580295