Analysis
-
max time kernel
123s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
04/11/2024, 04:52
Static task
static1
Behavioral task
behavioral1
Sample
cbcc142fa4a7e960109f9643e56edcb989ad47063539aa6c20348a05355dc827N.dll
Resource
win7-20240729-en
General
-
Target
cbcc142fa4a7e960109f9643e56edcb989ad47063539aa6c20348a05355dc827N.dll
-
Size
120KB
-
MD5
a14fecf5587b5f5d06ff34b9c28b57b0
-
SHA1
5ec813098a0440e845b1f6d42314f2338a123b66
-
SHA256
cbcc142fa4a7e960109f9643e56edcb989ad47063539aa6c20348a05355dc827
-
SHA512
d2fe024e613b6a6ae690af1990ab56a464803328cf6603f8343e80b94ac3dfe336a38e4e0b80333990f618a646554356957cde177667da1b4e67c822517f9bff
-
SSDEEP
3072:ZzPH4V6YWortvX5Q2em3+rzRK+JxonS2LwE:ZzQVCortvpQc3+HRRJxonSw
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e578618.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e578618.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e578618.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e578618.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e578618.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e578618.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e578618.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e578618.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e578618.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e578618.exe -
Executes dropped EXE 3 IoCs
pid Process 4784 e578618.exe 1332 e5787ae.exe 4760 e57b15e.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e578618.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e578618.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e578618.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e578618.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e578618.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e578618.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e578618.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e578618.exe -
Enumerates connected drives 3 TTPs 7 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: e578618.exe File opened (read-only) \??\I: e578618.exe File opened (read-only) \??\J: e578618.exe File opened (read-only) \??\K: e578618.exe File opened (read-only) \??\L: e578618.exe File opened (read-only) \??\E: e578618.exe File opened (read-only) \??\G: e578618.exe -
resource yara_rule behavioral2/memory/4784-6-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/4784-9-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/4784-18-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/4784-10-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/4784-24-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/4784-27-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/4784-8-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/4784-32-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/4784-33-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/4784-34-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/4784-35-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/4784-36-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/4784-37-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/4784-39-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/4784-38-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/4784-53-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/4784-55-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/4784-56-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/4784-58-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/4784-59-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/4784-61-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/4784-63-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/4784-68-0x0000000000860000-0x000000000191A000-memory.dmp upx -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\e5786f3 e578618.exe File opened for modification C:\Windows\SYSTEM.INI e578618.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e578618.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e5787ae.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e57b15e.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4784 e578618.exe 4784 e578618.exe 4784 e578618.exe 4784 e578618.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4784 e578618.exe Token: SeDebugPrivilege 4784 e578618.exe Token: SeDebugPrivilege 4784 e578618.exe Token: SeDebugPrivilege 4784 e578618.exe Token: SeDebugPrivilege 4784 e578618.exe Token: SeDebugPrivilege 4784 e578618.exe Token: SeDebugPrivilege 4784 e578618.exe Token: SeDebugPrivilege 4784 e578618.exe Token: SeDebugPrivilege 4784 e578618.exe Token: SeDebugPrivilege 4784 e578618.exe Token: SeDebugPrivilege 4784 e578618.exe Token: SeDebugPrivilege 4784 e578618.exe Token: SeDebugPrivilege 4784 e578618.exe Token: SeDebugPrivilege 4784 e578618.exe Token: SeDebugPrivilege 4784 e578618.exe Token: SeDebugPrivilege 4784 e578618.exe Token: SeDebugPrivilege 4784 e578618.exe Token: SeDebugPrivilege 4784 e578618.exe Token: SeDebugPrivilege 4784 e578618.exe Token: SeDebugPrivilege 4784 e578618.exe Token: SeDebugPrivilege 4784 e578618.exe Token: SeDebugPrivilege 4784 e578618.exe Token: SeDebugPrivilege 4784 e578618.exe Token: SeDebugPrivilege 4784 e578618.exe Token: SeDebugPrivilege 4784 e578618.exe Token: SeDebugPrivilege 4784 e578618.exe Token: SeDebugPrivilege 4784 e578618.exe Token: SeDebugPrivilege 4784 e578618.exe Token: SeDebugPrivilege 4784 e578618.exe Token: SeDebugPrivilege 4784 e578618.exe Token: SeDebugPrivilege 4784 e578618.exe Token: SeDebugPrivilege 4784 e578618.exe Token: SeDebugPrivilege 4784 e578618.exe Token: SeDebugPrivilege 4784 e578618.exe Token: SeDebugPrivilege 4784 e578618.exe Token: SeDebugPrivilege 4784 e578618.exe Token: SeDebugPrivilege 4784 e578618.exe Token: SeDebugPrivilege 4784 e578618.exe Token: SeDebugPrivilege 4784 e578618.exe Token: SeDebugPrivilege 4784 e578618.exe Token: SeDebugPrivilege 4784 e578618.exe Token: SeDebugPrivilege 4784 e578618.exe Token: SeDebugPrivilege 4784 e578618.exe Token: SeDebugPrivilege 4784 e578618.exe Token: SeDebugPrivilege 4784 e578618.exe Token: SeDebugPrivilege 4784 e578618.exe Token: SeDebugPrivilege 4784 e578618.exe Token: SeDebugPrivilege 4784 e578618.exe Token: SeDebugPrivilege 4784 e578618.exe Token: SeDebugPrivilege 4784 e578618.exe Token: SeDebugPrivilege 4784 e578618.exe Token: SeDebugPrivilege 4784 e578618.exe Token: SeDebugPrivilege 4784 e578618.exe Token: SeDebugPrivilege 4784 e578618.exe Token: SeDebugPrivilege 4784 e578618.exe Token: SeDebugPrivilege 4784 e578618.exe Token: SeDebugPrivilege 4784 e578618.exe Token: SeDebugPrivilege 4784 e578618.exe Token: SeDebugPrivilege 4784 e578618.exe Token: SeDebugPrivilege 4784 e578618.exe Token: SeDebugPrivilege 4784 e578618.exe Token: SeDebugPrivilege 4784 e578618.exe Token: SeDebugPrivilege 4784 e578618.exe Token: SeDebugPrivilege 4784 e578618.exe -
Suspicious use of WriteProcessMemory 54 IoCs
description pid Process procid_target PID 1184 wrote to memory of 1888 1184 rundll32.exe 84 PID 1184 wrote to memory of 1888 1184 rundll32.exe 84 PID 1184 wrote to memory of 1888 1184 rundll32.exe 84 PID 1888 wrote to memory of 4784 1888 rundll32.exe 85 PID 1888 wrote to memory of 4784 1888 rundll32.exe 85 PID 1888 wrote to memory of 4784 1888 rundll32.exe 85 PID 4784 wrote to memory of 800 4784 e578618.exe 9 PID 4784 wrote to memory of 808 4784 e578618.exe 10 PID 4784 wrote to memory of 316 4784 e578618.exe 13 PID 4784 wrote to memory of 2572 4784 e578618.exe 44 PID 4784 wrote to memory of 2620 4784 e578618.exe 45 PID 4784 wrote to memory of 2936 4784 e578618.exe 52 PID 4784 wrote to memory of 3372 4784 e578618.exe 56 PID 4784 wrote to memory of 3500 4784 e578618.exe 57 PID 4784 wrote to memory of 3708 4784 e578618.exe 58 PID 4784 wrote to memory of 3800 4784 e578618.exe 59 PID 4784 wrote to memory of 3864 4784 e578618.exe 60 PID 4784 wrote to memory of 3948 4784 e578618.exe 61 PID 4784 wrote to memory of 3568 4784 e578618.exe 62 PID 4784 wrote to memory of 4548 4784 e578618.exe 75 PID 4784 wrote to memory of 3080 4784 e578618.exe 76 PID 4784 wrote to memory of 4576 4784 e578618.exe 81 PID 4784 wrote to memory of 4772 4784 e578618.exe 82 PID 4784 wrote to memory of 1184 4784 e578618.exe 83 PID 4784 wrote to memory of 1888 4784 e578618.exe 84 PID 4784 wrote to memory of 1888 4784 e578618.exe 84 PID 1888 wrote to memory of 1332 1888 rundll32.exe 86 PID 1888 wrote to memory of 1332 1888 rundll32.exe 86 PID 1888 wrote to memory of 1332 1888 rundll32.exe 86 PID 4784 wrote to memory of 800 4784 e578618.exe 9 PID 4784 wrote to memory of 808 4784 e578618.exe 10 PID 4784 wrote to memory of 316 4784 e578618.exe 13 PID 4784 wrote to memory of 2572 4784 e578618.exe 44 PID 4784 wrote to memory of 2620 4784 e578618.exe 45 PID 4784 wrote to memory of 2936 4784 e578618.exe 52 PID 4784 wrote to memory of 3372 4784 e578618.exe 56 PID 4784 wrote to memory of 3500 4784 e578618.exe 57 PID 4784 wrote to memory of 3708 4784 e578618.exe 58 PID 4784 wrote to memory of 3800 4784 e578618.exe 59 PID 4784 wrote to memory of 3864 4784 e578618.exe 60 PID 4784 wrote to memory of 3948 4784 e578618.exe 61 PID 4784 wrote to memory of 3568 4784 e578618.exe 62 PID 4784 wrote to memory of 4548 4784 e578618.exe 75 PID 4784 wrote to memory of 3080 4784 e578618.exe 76 PID 4784 wrote to memory of 4576 4784 e578618.exe 81 PID 4784 wrote to memory of 4772 4784 e578618.exe 82 PID 4784 wrote to memory of 1184 4784 e578618.exe 83 PID 4784 wrote to memory of 1332 4784 e578618.exe 86 PID 4784 wrote to memory of 1332 4784 e578618.exe 86 PID 4784 wrote to memory of 448 4784 e578618.exe 87 PID 4784 wrote to memory of 4420 4784 e578618.exe 88 PID 1888 wrote to memory of 4760 1888 rundll32.exe 89 PID 1888 wrote to memory of 4760 1888 rundll32.exe 89 PID 1888 wrote to memory of 4760 1888 rundll32.exe 89 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e578618.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:800
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:808
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:316
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2572
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2620
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2936
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3372
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cbcc142fa4a7e960109f9643e56edcb989ad47063539aa6c20348a05355dc827N.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:1184 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cbcc142fa4a7e960109f9643e56edcb989ad47063539aa6c20348a05355dc827N.dll,#13⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\e578618.exeC:\Users\Admin\AppData\Local\Temp\e578618.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4784
-
-
C:\Users\Admin\AppData\Local\Temp\e5787ae.exeC:\Users\Admin\AppData\Local\Temp\e5787ae.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1332
-
-
C:\Users\Admin\AppData\Local\Temp\e57b15e.exeC:\Users\Admin\AppData\Local\Temp\e57b15e.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4760
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3500
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3708
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3800
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3864
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3948
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3568
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:4548
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3080
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵PID:4576
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:4772
-
C:\Windows\system32\BackgroundTaskHost.exe"C:\Windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider1⤵PID:448
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4420
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD53f4855e34ca66d4a8d94da47ea4b3cbc
SHA10ff399f134c2bd145b036be821422c2103d5edb0
SHA25657aaf3e40638ea3b12e7c2b5626d777125d2a484ddefec767271132195842fb0
SHA51242e89070a4dcdaae7368b3543a3bf5a7750872ac3405f66478def13d3a33db9799fee767c312fa1e13190ee9caee8db194e551631900bb868e04f6d6244a7be3