Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
09/11/2024, 12:08
Static task
static1
Behavioral task
behavioral1
Sample
92f058b923b56754fa99bc64e5ad7fc5e2a5e2ca47566bfab9fab27dbb70ad4aN.dll
Resource
win7-20241023-en
General
-
Target
92f058b923b56754fa99bc64e5ad7fc5e2a5e2ca47566bfab9fab27dbb70ad4aN.dll
-
Size
120KB
-
MD5
509b2838440bbf50ad70e027eeb61c40
-
SHA1
65f2bee1330922304b3e08591718890b2cadf058
-
SHA256
92f058b923b56754fa99bc64e5ad7fc5e2a5e2ca47566bfab9fab27dbb70ad4a
-
SHA512
5c76e5dd8c891e9cd69d92ac442437c96c966dbeddb86f77301bf57ac028227cfac0d5700ac66417171132b697364b09cc09b9aeef50d7828fb9511a51b3b337
-
SSDEEP
1536:UauVh7KrlYKCmmBIYZvAFY6n6UTmJNVe/gDxeBh2+1pm8vcl06PsKKWe:Ah2rlYKiIoIFd6RJDe/yArECcWWe
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f763a23.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f763a23.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f7655dd.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f7655dd.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f7655dd.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f763a23.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f763a23.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f7655dd.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f7655dd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f7655dd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f763a23.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f763a23.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f7655dd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f763a23.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f7655dd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f7655dd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f7655dd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f763a23.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f763a23.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f763a23.exe -
Executes dropped EXE 3 IoCs
pid Process 2872 f763a23.exe 2240 f763bb9.exe 1332 f7655dd.exe -
Loads dropped DLL 6 IoCs
pid Process 2764 rundll32.exe 2764 rundll32.exe 2764 rundll32.exe 2764 rundll32.exe 2764 rundll32.exe 2764 rundll32.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f763a23.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f763a23.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f7655dd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f7655dd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f763a23.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f763a23.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f763a23.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f7655dd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f7655dd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f7655dd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f7655dd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f7655dd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f763a23.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f763a23.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f763a23.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f7655dd.exe -
Enumerates connected drives 3 TTPs 14 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Q: f763a23.exe File opened (read-only) \??\R: f763a23.exe File opened (read-only) \??\M: f763a23.exe File opened (read-only) \??\O: f763a23.exe File opened (read-only) \??\I: f763a23.exe File opened (read-only) \??\K: f763a23.exe File opened (read-only) \??\L: f763a23.exe File opened (read-only) \??\P: f763a23.exe File opened (read-only) \??\E: f763a23.exe File opened (read-only) \??\H: f763a23.exe File opened (read-only) \??\N: f763a23.exe File opened (read-only) \??\G: f763a23.exe File opened (read-only) \??\J: f763a23.exe File opened (read-only) \??\E: f7655dd.exe -
resource yara_rule behavioral1/memory/2872-17-0x00000000005A0000-0x000000000165A000-memory.dmp upx behavioral1/memory/2872-19-0x00000000005A0000-0x000000000165A000-memory.dmp upx behavioral1/memory/2872-21-0x00000000005A0000-0x000000000165A000-memory.dmp upx behavioral1/memory/2872-16-0x00000000005A0000-0x000000000165A000-memory.dmp upx behavioral1/memory/2872-22-0x00000000005A0000-0x000000000165A000-memory.dmp upx behavioral1/memory/2872-15-0x00000000005A0000-0x000000000165A000-memory.dmp upx behavioral1/memory/2872-20-0x00000000005A0000-0x000000000165A000-memory.dmp upx behavioral1/memory/2872-23-0x00000000005A0000-0x000000000165A000-memory.dmp upx behavioral1/memory/2872-24-0x00000000005A0000-0x000000000165A000-memory.dmp upx behavioral1/memory/2872-18-0x00000000005A0000-0x000000000165A000-memory.dmp upx behavioral1/memory/2872-61-0x00000000005A0000-0x000000000165A000-memory.dmp upx behavioral1/memory/2872-62-0x00000000005A0000-0x000000000165A000-memory.dmp upx behavioral1/memory/2872-63-0x00000000005A0000-0x000000000165A000-memory.dmp upx behavioral1/memory/2872-65-0x00000000005A0000-0x000000000165A000-memory.dmp upx behavioral1/memory/2872-64-0x00000000005A0000-0x000000000165A000-memory.dmp upx behavioral1/memory/2872-67-0x00000000005A0000-0x000000000165A000-memory.dmp upx behavioral1/memory/2872-69-0x00000000005A0000-0x000000000165A000-memory.dmp upx behavioral1/memory/2872-85-0x00000000005A0000-0x000000000165A000-memory.dmp upx behavioral1/memory/2872-87-0x00000000005A0000-0x000000000165A000-memory.dmp upx behavioral1/memory/2872-88-0x00000000005A0000-0x000000000165A000-memory.dmp upx behavioral1/memory/2872-108-0x00000000005A0000-0x000000000165A000-memory.dmp upx behavioral1/memory/2872-109-0x00000000005A0000-0x000000000165A000-memory.dmp upx behavioral1/memory/2872-113-0x00000000005A0000-0x000000000165A000-memory.dmp upx behavioral1/memory/2872-114-0x00000000005A0000-0x000000000165A000-memory.dmp upx behavioral1/memory/2872-147-0x00000000005A0000-0x000000000165A000-memory.dmp upx behavioral1/memory/1332-165-0x0000000000A60000-0x0000000001B1A000-memory.dmp upx behavioral1/memory/1332-203-0x0000000000A60000-0x0000000001B1A000-memory.dmp upx -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\f763a81 f763a23.exe File opened for modification C:\Windows\SYSTEM.INI f763a23.exe File created C:\Windows\f768c19 f7655dd.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f763a23.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f7655dd.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2872 f763a23.exe 2872 f763a23.exe 1332 f7655dd.exe -
Suspicious use of AdjustPrivilegeToken 45 IoCs
description pid Process Token: SeDebugPrivilege 2872 f763a23.exe Token: SeDebugPrivilege 2872 f763a23.exe Token: SeDebugPrivilege 2872 f763a23.exe Token: SeDebugPrivilege 2872 f763a23.exe Token: SeDebugPrivilege 2872 f763a23.exe Token: SeDebugPrivilege 2872 f763a23.exe Token: SeDebugPrivilege 2872 f763a23.exe Token: SeDebugPrivilege 2872 f763a23.exe Token: SeDebugPrivilege 2872 f763a23.exe Token: SeDebugPrivilege 2872 f763a23.exe Token: SeDebugPrivilege 2872 f763a23.exe Token: SeDebugPrivilege 2872 f763a23.exe Token: SeDebugPrivilege 2872 f763a23.exe Token: SeDebugPrivilege 2872 f763a23.exe Token: SeDebugPrivilege 2872 f763a23.exe Token: SeDebugPrivilege 2872 f763a23.exe Token: SeDebugPrivilege 2872 f763a23.exe Token: SeDebugPrivilege 2872 f763a23.exe Token: SeDebugPrivilege 2872 f763a23.exe Token: SeDebugPrivilege 2872 f763a23.exe Token: SeDebugPrivilege 2872 f763a23.exe Token: SeDebugPrivilege 2872 f763a23.exe Token: SeDebugPrivilege 2872 f763a23.exe Token: SeDebugPrivilege 1332 f7655dd.exe Token: SeDebugPrivilege 1332 f7655dd.exe Token: SeDebugPrivilege 1332 f7655dd.exe Token: SeDebugPrivilege 1332 f7655dd.exe Token: SeDebugPrivilege 1332 f7655dd.exe Token: SeDebugPrivilege 1332 f7655dd.exe Token: SeDebugPrivilege 1332 f7655dd.exe Token: SeDebugPrivilege 1332 f7655dd.exe Token: SeDebugPrivilege 1332 f7655dd.exe Token: SeDebugPrivilege 1332 f7655dd.exe Token: SeDebugPrivilege 1332 f7655dd.exe Token: SeDebugPrivilege 1332 f7655dd.exe Token: SeDebugPrivilege 1332 f7655dd.exe Token: SeDebugPrivilege 1332 f7655dd.exe Token: SeDebugPrivilege 1332 f7655dd.exe Token: SeDebugPrivilege 1332 f7655dd.exe Token: SeDebugPrivilege 1332 f7655dd.exe Token: SeDebugPrivilege 1332 f7655dd.exe Token: SeDebugPrivilege 1332 f7655dd.exe Token: SeDebugPrivilege 1332 f7655dd.exe Token: SeDebugPrivilege 1332 f7655dd.exe Token: SeDebugPrivilege 1332 f7655dd.exe -
Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 2452 wrote to memory of 2764 2452 rundll32.exe 30 PID 2452 wrote to memory of 2764 2452 rundll32.exe 30 PID 2452 wrote to memory of 2764 2452 rundll32.exe 30 PID 2452 wrote to memory of 2764 2452 rundll32.exe 30 PID 2452 wrote to memory of 2764 2452 rundll32.exe 30 PID 2452 wrote to memory of 2764 2452 rundll32.exe 30 PID 2452 wrote to memory of 2764 2452 rundll32.exe 30 PID 2764 wrote to memory of 2872 2764 rundll32.exe 31 PID 2764 wrote to memory of 2872 2764 rundll32.exe 31 PID 2764 wrote to memory of 2872 2764 rundll32.exe 31 PID 2764 wrote to memory of 2872 2764 rundll32.exe 31 PID 2872 wrote to memory of 1064 2872 f763a23.exe 17 PID 2872 wrote to memory of 1128 2872 f763a23.exe 19 PID 2872 wrote to memory of 1196 2872 f763a23.exe 21 PID 2872 wrote to memory of 1684 2872 f763a23.exe 25 PID 2872 wrote to memory of 2452 2872 f763a23.exe 29 PID 2872 wrote to memory of 2764 2872 f763a23.exe 30 PID 2872 wrote to memory of 2764 2872 f763a23.exe 30 PID 2764 wrote to memory of 2240 2764 rundll32.exe 32 PID 2764 wrote to memory of 2240 2764 rundll32.exe 32 PID 2764 wrote to memory of 2240 2764 rundll32.exe 32 PID 2764 wrote to memory of 2240 2764 rundll32.exe 32 PID 2764 wrote to memory of 1332 2764 rundll32.exe 33 PID 2764 wrote to memory of 1332 2764 rundll32.exe 33 PID 2764 wrote to memory of 1332 2764 rundll32.exe 33 PID 2764 wrote to memory of 1332 2764 rundll32.exe 33 PID 2872 wrote to memory of 1064 2872 f763a23.exe 17 PID 2872 wrote to memory of 1128 2872 f763a23.exe 19 PID 2872 wrote to memory of 1196 2872 f763a23.exe 21 PID 2872 wrote to memory of 1684 2872 f763a23.exe 25 PID 2872 wrote to memory of 2240 2872 f763a23.exe 32 PID 2872 wrote to memory of 2240 2872 f763a23.exe 32 PID 2872 wrote to memory of 1332 2872 f763a23.exe 33 PID 2872 wrote to memory of 1332 2872 f763a23.exe 33 PID 1332 wrote to memory of 1064 1332 f7655dd.exe 17 PID 1332 wrote to memory of 1128 1332 f7655dd.exe 19 PID 1332 wrote to memory of 1196 1332 f7655dd.exe 21 PID 1332 wrote to memory of 1684 1332 f7655dd.exe 25 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f763a23.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f7655dd.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1064
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1128
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1196
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\92f058b923b56754fa99bc64e5ad7fc5e2a5e2ca47566bfab9fab27dbb70ad4aN.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\92f058b923b56754fa99bc64e5ad7fc5e2a5e2ca47566bfab9fab27dbb70ad4aN.dll,#13⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\f763a23.exeC:\Users\Admin\AppData\Local\Temp\f763a23.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2872
-
-
C:\Users\Admin\AppData\Local\Temp\f763bb9.exeC:\Users\Admin\AppData\Local\Temp\f763bb9.exe4⤵
- Executes dropped EXE
PID:2240
-
-
C:\Users\Admin\AppData\Local\Temp\f7655dd.exeC:\Users\Admin\AppData\Local\Temp\f7655dd.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1332
-
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1684
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD570d6cbb1338703abe744c11775867258
SHA1bf3ba02baf703e7d47bea838f17d0c4db83a54d0
SHA2561e5e84dd84d38ef63d902c418422a32541cfa59437ad102922bfa5110e52a819
SHA5120670a1e403fbd51a4964e614442b42089a1dceaf27442e8918a3137468f333d25a03356d82dedc405bab798ebc06086c1b24074f60eac38356f75fb82d67c6b1
-
Filesize
257B
MD596b8c0a875eb41cf79192337d0a7b0f7
SHA13cbe9ec1460f544a66721bffc871221aecdce0ba
SHA256995e17ef7b2ac6026ed429c5032f4c37b946abd624e499bb06647656133b55b1
SHA512d178e393d2dd97690e844aa95aec0ad77f032912c001c0deb75a0e362b2d13633b89294806aa24835c99ff622b77b7fef3fb5e0d90635de89cc2ef07f11bfd27