Analysis
-
max time kernel
117s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
04/11/2024, 04:48
Static task
static1
Behavioral task
behavioral1
Sample
cbcc142fa4a7e960109f9643e56edcb989ad47063539aa6c20348a05355dc827N.dll
Resource
win7-20240903-en
General
-
Target
cbcc142fa4a7e960109f9643e56edcb989ad47063539aa6c20348a05355dc827N.dll
-
Size
120KB
-
MD5
a14fecf5587b5f5d06ff34b9c28b57b0
-
SHA1
5ec813098a0440e845b1f6d42314f2338a123b66
-
SHA256
cbcc142fa4a7e960109f9643e56edcb989ad47063539aa6c20348a05355dc827
-
SHA512
d2fe024e613b6a6ae690af1990ab56a464803328cf6603f8343e80b94ac3dfe336a38e4e0b80333990f618a646554356957cde177667da1b4e67c822517f9bff
-
SSDEEP
3072:ZzPH4V6YWortvX5Q2em3+rzRK+JxonS2LwE:ZzQVCortvpQc3+HRRJxonSw
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f770290.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f770290.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f770500.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f770500.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f770500.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f770290.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f770290.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f770500.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f770500.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f770500.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f770290.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f770290.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f770290.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f770290.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f770290.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f770500.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f770500.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f770500.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f770290.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f770500.exe -
Executes dropped EXE 3 IoCs
pid Process 2800 f770290.exe 2628 f770500.exe 2128 f771ddd.exe -
Loads dropped DLL 6 IoCs
pid Process 2144 rundll32.exe 2144 rundll32.exe 2144 rundll32.exe 2144 rundll32.exe 2144 rundll32.exe 2144 rundll32.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f770290.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f770290.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f770500.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f770500.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f770290.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f770290.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f770500.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f770500.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f770500.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f770500.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f770290.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f770290.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f770290.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f770500.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f770290.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f770500.exe -
Enumerates connected drives 3 TTPs 14 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: f770290.exe File opened (read-only) \??\I: f770290.exe File opened (read-only) \??\L: f770290.exe File opened (read-only) \??\Q: f770290.exe File opened (read-only) \??\S: f770290.exe File opened (read-only) \??\O: f770290.exe File opened (read-only) \??\H: f770290.exe File opened (read-only) \??\J: f770290.exe File opened (read-only) \??\K: f770290.exe File opened (read-only) \??\M: f770290.exe File opened (read-only) \??\N: f770290.exe File opened (read-only) \??\G: f770290.exe File opened (read-only) \??\P: f770290.exe File opened (read-only) \??\R: f770290.exe -
resource yara_rule behavioral1/memory/2800-15-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2800-17-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2800-22-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2800-43-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2800-23-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2800-21-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2800-44-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2800-20-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2800-19-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2800-18-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2800-66-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2800-65-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2800-67-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2800-68-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2800-69-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2800-71-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2800-84-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2800-85-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2800-87-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2800-90-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2800-156-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2628-175-0x0000000000910000-0x00000000019CA000-memory.dmp upx behavioral1/memory/2628-184-0x0000000000910000-0x00000000019CA000-memory.dmp upx -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\f77034b f770290.exe File opened for modification C:\Windows\SYSTEM.INI f770290.exe File created C:\Windows\f7753cb f770500.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f770290.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2800 f770290.exe 2800 f770290.exe 2628 f770500.exe -
Suspicious use of AdjustPrivilegeToken 23 IoCs
description pid Process Token: SeDebugPrivilege 2800 f770290.exe Token: SeDebugPrivilege 2800 f770290.exe Token: SeDebugPrivilege 2800 f770290.exe Token: SeDebugPrivilege 2800 f770290.exe Token: SeDebugPrivilege 2800 f770290.exe Token: SeDebugPrivilege 2800 f770290.exe Token: SeDebugPrivilege 2800 f770290.exe Token: SeDebugPrivilege 2800 f770290.exe Token: SeDebugPrivilege 2800 f770290.exe Token: SeDebugPrivilege 2800 f770290.exe Token: SeDebugPrivilege 2800 f770290.exe Token: SeDebugPrivilege 2800 f770290.exe Token: SeDebugPrivilege 2800 f770290.exe Token: SeDebugPrivilege 2800 f770290.exe Token: SeDebugPrivilege 2800 f770290.exe Token: SeDebugPrivilege 2800 f770290.exe Token: SeDebugPrivilege 2800 f770290.exe Token: SeDebugPrivilege 2800 f770290.exe Token: SeDebugPrivilege 2800 f770290.exe Token: SeDebugPrivilege 2800 f770290.exe Token: SeDebugPrivilege 2800 f770290.exe Token: SeDebugPrivilege 2800 f770290.exe Token: SeDebugPrivilege 2800 f770290.exe -
Suspicious use of WriteProcessMemory 34 IoCs
description pid Process procid_target PID 2644 wrote to memory of 2144 2644 rundll32.exe 30 PID 2644 wrote to memory of 2144 2644 rundll32.exe 30 PID 2644 wrote to memory of 2144 2644 rundll32.exe 30 PID 2644 wrote to memory of 2144 2644 rundll32.exe 30 PID 2644 wrote to memory of 2144 2644 rundll32.exe 30 PID 2644 wrote to memory of 2144 2644 rundll32.exe 30 PID 2644 wrote to memory of 2144 2644 rundll32.exe 30 PID 2144 wrote to memory of 2800 2144 rundll32.exe 31 PID 2144 wrote to memory of 2800 2144 rundll32.exe 31 PID 2144 wrote to memory of 2800 2144 rundll32.exe 31 PID 2144 wrote to memory of 2800 2144 rundll32.exe 31 PID 2800 wrote to memory of 1104 2800 f770290.exe 19 PID 2800 wrote to memory of 1172 2800 f770290.exe 20 PID 2800 wrote to memory of 1208 2800 f770290.exe 21 PID 2800 wrote to memory of 1532 2800 f770290.exe 23 PID 2800 wrote to memory of 2644 2800 f770290.exe 29 PID 2800 wrote to memory of 2144 2800 f770290.exe 30 PID 2800 wrote to memory of 2144 2800 f770290.exe 30 PID 2144 wrote to memory of 2628 2144 rundll32.exe 32 PID 2144 wrote to memory of 2628 2144 rundll32.exe 32 PID 2144 wrote to memory of 2628 2144 rundll32.exe 32 PID 2144 wrote to memory of 2628 2144 rundll32.exe 32 PID 2144 wrote to memory of 2128 2144 rundll32.exe 33 PID 2144 wrote to memory of 2128 2144 rundll32.exe 33 PID 2144 wrote to memory of 2128 2144 rundll32.exe 33 PID 2144 wrote to memory of 2128 2144 rundll32.exe 33 PID 2800 wrote to memory of 1104 2800 f770290.exe 19 PID 2800 wrote to memory of 1172 2800 f770290.exe 20 PID 2800 wrote to memory of 1208 2800 f770290.exe 21 PID 2800 wrote to memory of 1532 2800 f770290.exe 23 PID 2800 wrote to memory of 2628 2800 f770290.exe 32 PID 2800 wrote to memory of 2628 2800 f770290.exe 32 PID 2800 wrote to memory of 2128 2800 f770290.exe 33 PID 2800 wrote to memory of 2128 2800 f770290.exe 33 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f770290.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f770500.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1104
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1172
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1208
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cbcc142fa4a7e960109f9643e56edcb989ad47063539aa6c20348a05355dc827N.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cbcc142fa4a7e960109f9643e56edcb989ad47063539aa6c20348a05355dc827N.dll,#13⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\f770290.exeC:\Users\Admin\AppData\Local\Temp\f770290.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2800
-
-
C:\Users\Admin\AppData\Local\Temp\f770500.exeC:\Users\Admin\AppData\Local\Temp\f770500.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- System policy modification
PID:2628
-
-
C:\Users\Admin\AppData\Local\Temp\f771ddd.exeC:\Users\Admin\AppData\Local\Temp\f771ddd.exe4⤵
- Executes dropped EXE
PID:2128
-
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1532
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD53f4855e34ca66d4a8d94da47ea4b3cbc
SHA10ff399f134c2bd145b036be821422c2103d5edb0
SHA25657aaf3e40638ea3b12e7c2b5626d777125d2a484ddefec767271132195842fb0
SHA51242e89070a4dcdaae7368b3543a3bf5a7750872ac3405f66478def13d3a33db9799fee767c312fa1e13190ee9caee8db194e551631900bb868e04f6d6244a7be3
-
Filesize
257B
MD5a0a1ad5c2ee08f1599cd63ce149f3bf7
SHA1cd674e586b411bbc94bf2577944631e8d09c8cd7
SHA256d2d3c6d7b21f83091f34d6cd2806cf8f0c55c1d5043102ce756577179517fd7d
SHA5129b0f95402da0eee0a950594b3295d3e31288558c4352cbc526cb59b0e4acd70a58db467b5a6451567a78258c271fc3033aa0c47164f5c47c0b9fdf117cbd5f4c