Analysis
-
max time kernel
29s -
max time network
21s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
04/11/2024, 04:52
Static task
static1
Behavioral task
behavioral1
Sample
cbcc142fa4a7e960109f9643e56edcb989ad47063539aa6c20348a05355dc827N.dll
Resource
win7-20240729-en
General
-
Target
cbcc142fa4a7e960109f9643e56edcb989ad47063539aa6c20348a05355dc827N.dll
-
Size
120KB
-
MD5
a14fecf5587b5f5d06ff34b9c28b57b0
-
SHA1
5ec813098a0440e845b1f6d42314f2338a123b66
-
SHA256
cbcc142fa4a7e960109f9643e56edcb989ad47063539aa6c20348a05355dc827
-
SHA512
d2fe024e613b6a6ae690af1990ab56a464803328cf6603f8343e80b94ac3dfe336a38e4e0b80333990f618a646554356957cde177667da1b4e67c822517f9bff
-
SSDEEP
3072:ZzPH4V6YWortvX5Q2em3+rzRK+JxonS2LwE:ZzQVCortvpQc3+HRRJxonSw
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f777d2b.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f775a7f.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f775a7f.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f775a7f.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f777d2b.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f777d2b.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f775a7f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f777d2b.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f775a7f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f777d2b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f777d2b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f775a7f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f775a7f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f775a7f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f777d2b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f777d2b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f777d2b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f777d2b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f775a7f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f775a7f.exe -
Executes dropped EXE 3 IoCs
pid Process 2940 f775a7f.exe 2580 f775d2d.exe 2956 f777d2b.exe -
Loads dropped DLL 6 IoCs
pid Process 2760 rundll32.exe 2760 rundll32.exe 2760 rundll32.exe 2760 rundll32.exe 2760 rundll32.exe 2760 rundll32.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f777d2b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f777d2b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f775a7f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f777d2b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f777d2b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f777d2b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f775a7f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f775a7f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f777d2b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f775a7f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f775a7f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f775a7f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f777d2b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f775a7f.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f775a7f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f777d2b.exe -
Enumerates connected drives 3 TTPs 9 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: f775a7f.exe File opened (read-only) \??\J: f775a7f.exe File opened (read-only) \??\I: f775a7f.exe File opened (read-only) \??\K: f775a7f.exe File opened (read-only) \??\L: f775a7f.exe File opened (read-only) \??\M: f775a7f.exe File opened (read-only) \??\E: f777d2b.exe File opened (read-only) \??\E: f775a7f.exe File opened (read-only) \??\H: f775a7f.exe -
resource yara_rule behavioral1/memory/2940-15-0x0000000000670000-0x000000000172A000-memory.dmp upx behavioral1/memory/2940-51-0x0000000000670000-0x000000000172A000-memory.dmp upx behavioral1/memory/2940-39-0x0000000000670000-0x000000000172A000-memory.dmp upx behavioral1/memory/2940-54-0x0000000000670000-0x000000000172A000-memory.dmp upx behavioral1/memory/2940-38-0x0000000000670000-0x000000000172A000-memory.dmp upx behavioral1/memory/2940-50-0x0000000000670000-0x000000000172A000-memory.dmp upx behavioral1/memory/2940-20-0x0000000000670000-0x000000000172A000-memory.dmp upx behavioral1/memory/2940-19-0x0000000000670000-0x000000000172A000-memory.dmp upx behavioral1/memory/2940-18-0x0000000000670000-0x000000000172A000-memory.dmp upx behavioral1/memory/2940-17-0x0000000000670000-0x000000000172A000-memory.dmp upx behavioral1/memory/2940-62-0x0000000000670000-0x000000000172A000-memory.dmp upx behavioral1/memory/2940-63-0x0000000000670000-0x000000000172A000-memory.dmp upx behavioral1/memory/2940-64-0x0000000000670000-0x000000000172A000-memory.dmp upx behavioral1/memory/2940-67-0x0000000000670000-0x000000000172A000-memory.dmp upx behavioral1/memory/2940-80-0x0000000000670000-0x000000000172A000-memory.dmp upx behavioral1/memory/2940-81-0x0000000000670000-0x000000000172A000-memory.dmp upx behavioral1/memory/2940-98-0x0000000000670000-0x000000000172A000-memory.dmp upx behavioral1/memory/2940-99-0x0000000000670000-0x000000000172A000-memory.dmp upx behavioral1/memory/2940-103-0x0000000000670000-0x000000000172A000-memory.dmp upx behavioral1/memory/2940-104-0x0000000000670000-0x000000000172A000-memory.dmp upx behavioral1/memory/2940-105-0x0000000000670000-0x000000000172A000-memory.dmp upx behavioral1/memory/2940-108-0x0000000000670000-0x000000000172A000-memory.dmp upx behavioral1/memory/2940-111-0x0000000000670000-0x000000000172A000-memory.dmp upx behavioral1/memory/2940-139-0x0000000000670000-0x000000000172A000-memory.dmp upx behavioral1/memory/2956-145-0x0000000000900000-0x00000000019BA000-memory.dmp upx behavioral1/memory/2956-191-0x0000000000900000-0x00000000019BA000-memory.dmp upx -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\f77aef5 f777d2b.exe File created C:\Windows\f775b69 f775a7f.exe File opened for modification C:\Windows\SYSTEM.INI f775a7f.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f775a7f.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f777d2b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2940 f775a7f.exe 2940 f775a7f.exe 2956 f777d2b.exe -
Suspicious use of AdjustPrivilegeToken 45 IoCs
description pid Process Token: SeDebugPrivilege 2940 f775a7f.exe Token: SeDebugPrivilege 2940 f775a7f.exe Token: SeDebugPrivilege 2940 f775a7f.exe Token: SeDebugPrivilege 2940 f775a7f.exe Token: SeDebugPrivilege 2940 f775a7f.exe Token: SeDebugPrivilege 2940 f775a7f.exe Token: SeDebugPrivilege 2940 f775a7f.exe Token: SeDebugPrivilege 2940 f775a7f.exe Token: SeDebugPrivilege 2940 f775a7f.exe Token: SeDebugPrivilege 2940 f775a7f.exe Token: SeDebugPrivilege 2940 f775a7f.exe Token: SeDebugPrivilege 2940 f775a7f.exe Token: SeDebugPrivilege 2940 f775a7f.exe Token: SeDebugPrivilege 2940 f775a7f.exe Token: SeDebugPrivilege 2940 f775a7f.exe Token: SeDebugPrivilege 2940 f775a7f.exe Token: SeDebugPrivilege 2940 f775a7f.exe Token: SeDebugPrivilege 2940 f775a7f.exe Token: SeDebugPrivilege 2940 f775a7f.exe Token: SeDebugPrivilege 2940 f775a7f.exe Token: SeDebugPrivilege 2940 f775a7f.exe Token: SeDebugPrivilege 2940 f775a7f.exe Token: SeDebugPrivilege 2940 f775a7f.exe Token: SeDebugPrivilege 2956 f777d2b.exe Token: SeDebugPrivilege 2956 f777d2b.exe Token: SeDebugPrivilege 2956 f777d2b.exe Token: SeDebugPrivilege 2956 f777d2b.exe Token: SeDebugPrivilege 2956 f777d2b.exe Token: SeDebugPrivilege 2956 f777d2b.exe Token: SeDebugPrivilege 2956 f777d2b.exe Token: SeDebugPrivilege 2956 f777d2b.exe Token: SeDebugPrivilege 2956 f777d2b.exe Token: SeDebugPrivilege 2956 f777d2b.exe Token: SeDebugPrivilege 2956 f777d2b.exe Token: SeDebugPrivilege 2956 f777d2b.exe Token: SeDebugPrivilege 2956 f777d2b.exe Token: SeDebugPrivilege 2956 f777d2b.exe Token: SeDebugPrivilege 2956 f777d2b.exe Token: SeDebugPrivilege 2956 f777d2b.exe Token: SeDebugPrivilege 2956 f777d2b.exe Token: SeDebugPrivilege 2956 f777d2b.exe Token: SeDebugPrivilege 2956 f777d2b.exe Token: SeDebugPrivilege 2956 f777d2b.exe Token: SeDebugPrivilege 2956 f777d2b.exe Token: SeDebugPrivilege 2956 f777d2b.exe -
Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 2656 wrote to memory of 2760 2656 rundll32.exe 30 PID 2656 wrote to memory of 2760 2656 rundll32.exe 30 PID 2656 wrote to memory of 2760 2656 rundll32.exe 30 PID 2656 wrote to memory of 2760 2656 rundll32.exe 30 PID 2656 wrote to memory of 2760 2656 rundll32.exe 30 PID 2656 wrote to memory of 2760 2656 rundll32.exe 30 PID 2656 wrote to memory of 2760 2656 rundll32.exe 30 PID 2760 wrote to memory of 2940 2760 rundll32.exe 31 PID 2760 wrote to memory of 2940 2760 rundll32.exe 31 PID 2760 wrote to memory of 2940 2760 rundll32.exe 31 PID 2760 wrote to memory of 2940 2760 rundll32.exe 31 PID 2940 wrote to memory of 1104 2940 f775a7f.exe 19 PID 2940 wrote to memory of 1180 2940 f775a7f.exe 20 PID 2940 wrote to memory of 1244 2940 f775a7f.exe 21 PID 2940 wrote to memory of 1144 2940 f775a7f.exe 23 PID 2940 wrote to memory of 2656 2940 f775a7f.exe 29 PID 2940 wrote to memory of 2760 2940 f775a7f.exe 30 PID 2940 wrote to memory of 2760 2940 f775a7f.exe 30 PID 2760 wrote to memory of 2580 2760 rundll32.exe 32 PID 2760 wrote to memory of 2580 2760 rundll32.exe 32 PID 2760 wrote to memory of 2580 2760 rundll32.exe 32 PID 2760 wrote to memory of 2580 2760 rundll32.exe 32 PID 2760 wrote to memory of 2956 2760 rundll32.exe 33 PID 2760 wrote to memory of 2956 2760 rundll32.exe 33 PID 2760 wrote to memory of 2956 2760 rundll32.exe 33 PID 2760 wrote to memory of 2956 2760 rundll32.exe 33 PID 2940 wrote to memory of 1104 2940 f775a7f.exe 19 PID 2940 wrote to memory of 1180 2940 f775a7f.exe 20 PID 2940 wrote to memory of 1244 2940 f775a7f.exe 21 PID 2940 wrote to memory of 1144 2940 f775a7f.exe 23 PID 2940 wrote to memory of 2580 2940 f775a7f.exe 32 PID 2940 wrote to memory of 2580 2940 f775a7f.exe 32 PID 2940 wrote to memory of 2956 2940 f775a7f.exe 33 PID 2940 wrote to memory of 2956 2940 f775a7f.exe 33 PID 2956 wrote to memory of 1104 2956 f777d2b.exe 19 PID 2956 wrote to memory of 1180 2956 f777d2b.exe 20 PID 2956 wrote to memory of 1244 2956 f777d2b.exe 21 PID 2956 wrote to memory of 1144 2956 f777d2b.exe 23 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f775a7f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f777d2b.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1104
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1180
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1244
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cbcc142fa4a7e960109f9643e56edcb989ad47063539aa6c20348a05355dc827N.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cbcc142fa4a7e960109f9643e56edcb989ad47063539aa6c20348a05355dc827N.dll,#13⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\f775a7f.exeC:\Users\Admin\AppData\Local\Temp\f775a7f.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2940
-
-
C:\Users\Admin\AppData\Local\Temp\f775d2d.exeC:\Users\Admin\AppData\Local\Temp\f775d2d.exe4⤵
- Executes dropped EXE
PID:2580
-
-
C:\Users\Admin\AppData\Local\Temp\f777d2b.exeC:\Users\Admin\AppData\Local\Temp\f777d2b.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2956
-
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1144
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
257B
MD506e7deb9e488c2d878e4a27e72fec05d
SHA11fde3cfff2e1fbb198317c8d39c9488caf8e91bb
SHA2562751dcbac427f5e2ef1ace30a0e67d39685ac2c75aef4edddf3236f15d4d08ac
SHA512ecde28b9cb210cd5f4a4296737ffa5e5f871c38cf60b57cd995c6b9b0dc2b6bccbbb40e4d45003e4c5139c67cfe3d37f21a3cfe1e8f84831be7480f31f620f69
-
Filesize
97KB
MD53f4855e34ca66d4a8d94da47ea4b3cbc
SHA10ff399f134c2bd145b036be821422c2103d5edb0
SHA25657aaf3e40638ea3b12e7c2b5626d777125d2a484ddefec767271132195842fb0
SHA51242e89070a4dcdaae7368b3543a3bf5a7750872ac3405f66478def13d3a33db9799fee767c312fa1e13190ee9caee8db194e551631900bb868e04f6d6244a7be3