Analysis
-
max time kernel
24s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
21-11-2024 03:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3676e114c01b51c344a0008a0a6d87ddf66f308deabc48f9c87b780a2fb50e9e.dll
Resource
win7-20240903-en
windows7-x64
17 signatures
150 seconds
General
-
Target
3676e114c01b51c344a0008a0a6d87ddf66f308deabc48f9c87b780a2fb50e9e.dll
-
Size
120KB
-
MD5
7299dd6e71392512b72ae8ab75cc9d6e
-
SHA1
e006da7b4261d4496d6068ed31e50e94c3d6633d
-
SHA256
3676e114c01b51c344a0008a0a6d87ddf66f308deabc48f9c87b780a2fb50e9e
-
SHA512
04c93c6a70fb61b9ad52432a239285cc7bd8396092ecbc659b285716bafe149139f18b1fe94011a95b7ea2b50d89c5e28d0f3926ba9ce19375e83b8511a68ddb
-
SSDEEP
3072:Erm9OP/yYDlB2Q5vBZiyGEQuglxU9/GbQ:L0PVl8QtziN2gg/0Q
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
Processes:
f769bc3.exef76b71f.exedescription ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f769bc3.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f769bc3.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f769bc3.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f76b71f.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f76b71f.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f76b71f.exe -
Sality family
-
Processes:
f769bc3.exef76b71f.exedescription ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f769bc3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76b71f.exe -
Processes:
f769bc3.exef76b71f.exedescription ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f769bc3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f769bc3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f769bc3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76b71f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76b71f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76b71f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f769bc3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f769bc3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f769bc3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76b71f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76b71f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76b71f.exe -
Executes dropped EXE 3 IoCs
Processes:
f769bc3.exef769d97.exef76b71f.exepid Process 2484 f769bc3.exe 2816 f769d97.exe 2056 f76b71f.exe -
Loads dropped DLL 6 IoCs
Processes:
rundll32.exepid Process 2508 rundll32.exe 2508 rundll32.exe 2508 rundll32.exe 2508 rundll32.exe 2508 rundll32.exe 2508 rundll32.exe -
Processes:
f769bc3.exef76b71f.exedescription ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f769bc3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f769bc3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f769bc3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f769bc3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76b71f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f76b71f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f769bc3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76b71f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76b71f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f769bc3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f769bc3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76b71f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76b71f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76b71f.exe -
Processes:
f769bc3.exef76b71f.exedescription ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f769bc3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76b71f.exe -
Enumerates connected drives 3 TTPs 14 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
f769bc3.exedescription ioc Process File opened (read-only) \??\G: f769bc3.exe File opened (read-only) \??\I: f769bc3.exe File opened (read-only) \??\K: f769bc3.exe File opened (read-only) \??\P: f769bc3.exe File opened (read-only) \??\R: f769bc3.exe File opened (read-only) \??\E: f769bc3.exe File opened (read-only) \??\J: f769bc3.exe File opened (read-only) \??\M: f769bc3.exe File opened (read-only) \??\N: f769bc3.exe File opened (read-only) \??\O: f769bc3.exe File opened (read-only) \??\Q: f769bc3.exe File opened (read-only) \??\H: f769bc3.exe File opened (read-only) \??\L: f769bc3.exe File opened (read-only) \??\S: f769bc3.exe -
Processes:
resource yara_rule behavioral1/memory/2484-15-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/2484-21-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/2484-23-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/2484-17-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/2484-25-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/2484-22-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/2484-19-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/2484-18-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/2484-20-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/2484-24-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/2484-65-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/2484-66-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/2484-67-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/2484-68-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/2484-71-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/2484-72-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/2484-87-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/2484-90-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/2484-92-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/2484-113-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/2484-160-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/2056-181-0x0000000000910000-0x00000000019CA000-memory.dmp upx behavioral1/memory/2056-213-0x0000000000910000-0x00000000019CA000-memory.dmp upx -
Drops file in Windows directory 3 IoCs
Processes:
f769bc3.exef76b71f.exedescription ioc Process File created C:\Windows\f769c4f f769bc3.exe File opened for modification C:\Windows\SYSTEM.INI f769bc3.exe File created C:\Windows\f76ebd5 f76b71f.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
rundll32.exef769bc3.exef76b71f.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f769bc3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f76b71f.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
f769bc3.exef76b71f.exepid Process 2484 f769bc3.exe 2484 f769bc3.exe 2056 f76b71f.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
Processes:
f769bc3.exef76b71f.exedescription pid Process Token: SeDebugPrivilege 2484 f769bc3.exe Token: SeDebugPrivilege 2484 f769bc3.exe Token: SeDebugPrivilege 2484 f769bc3.exe Token: SeDebugPrivilege 2484 f769bc3.exe Token: SeDebugPrivilege 2484 f769bc3.exe Token: SeDebugPrivilege 2484 f769bc3.exe Token: SeDebugPrivilege 2484 f769bc3.exe Token: SeDebugPrivilege 2484 f769bc3.exe Token: SeDebugPrivilege 2484 f769bc3.exe Token: SeDebugPrivilege 2484 f769bc3.exe Token: SeDebugPrivilege 2484 f769bc3.exe Token: SeDebugPrivilege 2484 f769bc3.exe Token: SeDebugPrivilege 2484 f769bc3.exe Token: SeDebugPrivilege 2484 f769bc3.exe Token: SeDebugPrivilege 2484 f769bc3.exe Token: SeDebugPrivilege 2484 f769bc3.exe Token: SeDebugPrivilege 2484 f769bc3.exe Token: SeDebugPrivilege 2484 f769bc3.exe Token: SeDebugPrivilege 2484 f769bc3.exe Token: SeDebugPrivilege 2484 f769bc3.exe Token: SeDebugPrivilege 2484 f769bc3.exe Token: SeDebugPrivilege 2484 f769bc3.exe Token: SeDebugPrivilege 2484 f769bc3.exe Token: SeDebugPrivilege 2056 f76b71f.exe Token: SeDebugPrivilege 2056 f76b71f.exe Token: SeDebugPrivilege 2056 f76b71f.exe Token: SeDebugPrivilege 2056 f76b71f.exe Token: SeDebugPrivilege 2056 f76b71f.exe Token: SeDebugPrivilege 2056 f76b71f.exe Token: SeDebugPrivilege 2056 f76b71f.exe Token: SeDebugPrivilege 2056 f76b71f.exe Token: SeDebugPrivilege 2056 f76b71f.exe Token: SeDebugPrivilege 2056 f76b71f.exe Token: SeDebugPrivilege 2056 f76b71f.exe Token: SeDebugPrivilege 2056 f76b71f.exe Token: SeDebugPrivilege 2056 f76b71f.exe Token: SeDebugPrivilege 2056 f76b71f.exe Token: SeDebugPrivilege 2056 f76b71f.exe Token: SeDebugPrivilege 2056 f76b71f.exe Token: SeDebugPrivilege 2056 f76b71f.exe Token: SeDebugPrivilege 2056 f76b71f.exe Token: SeDebugPrivilege 2056 f76b71f.exe Token: SeDebugPrivilege 2056 f76b71f.exe Token: SeDebugPrivilege 2056 f76b71f.exe Token: SeDebugPrivilege 2056 f76b71f.exe Token: SeDebugPrivilege 2056 f76b71f.exe -
Suspicious use of WriteProcessMemory 38 IoCs
Processes:
rundll32.exerundll32.exef769bc3.exef76b71f.exedescription pid Process procid_target PID 2684 wrote to memory of 2508 2684 rundll32.exe 30 PID 2684 wrote to memory of 2508 2684 rundll32.exe 30 PID 2684 wrote to memory of 2508 2684 rundll32.exe 30 PID 2684 wrote to memory of 2508 2684 rundll32.exe 30 PID 2684 wrote to memory of 2508 2684 rundll32.exe 30 PID 2684 wrote to memory of 2508 2684 rundll32.exe 30 PID 2684 wrote to memory of 2508 2684 rundll32.exe 30 PID 2508 wrote to memory of 2484 2508 rundll32.exe 31 PID 2508 wrote to memory of 2484 2508 rundll32.exe 31 PID 2508 wrote to memory of 2484 2508 rundll32.exe 31 PID 2508 wrote to memory of 2484 2508 rundll32.exe 31 PID 2484 wrote to memory of 1096 2484 f769bc3.exe 19 PID 2484 wrote to memory of 1176 2484 f769bc3.exe 20 PID 2484 wrote to memory of 1204 2484 f769bc3.exe 21 PID 2484 wrote to memory of 884 2484 f769bc3.exe 25 PID 2484 wrote to memory of 2684 2484 f769bc3.exe 29 PID 2484 wrote to memory of 2508 2484 f769bc3.exe 30 PID 2484 wrote to memory of 2508 2484 f769bc3.exe 30 PID 2508 wrote to memory of 2816 2508 rundll32.exe 32 PID 2508 wrote to memory of 2816 2508 rundll32.exe 32 PID 2508 wrote to memory of 2816 2508 rundll32.exe 32 PID 2508 wrote to memory of 2816 2508 rundll32.exe 32 PID 2508 wrote to memory of 2056 2508 rundll32.exe 33 PID 2508 wrote to memory of 2056 2508 rundll32.exe 33 PID 2508 wrote to memory of 2056 2508 rundll32.exe 33 PID 2508 wrote to memory of 2056 2508 rundll32.exe 33 PID 2484 wrote to memory of 1096 2484 f769bc3.exe 19 PID 2484 wrote to memory of 1176 2484 f769bc3.exe 20 PID 2484 wrote to memory of 1204 2484 f769bc3.exe 21 PID 2484 wrote to memory of 884 2484 f769bc3.exe 25 PID 2484 wrote to memory of 2816 2484 f769bc3.exe 32 PID 2484 wrote to memory of 2816 2484 f769bc3.exe 32 PID 2484 wrote to memory of 2056 2484 f769bc3.exe 33 PID 2484 wrote to memory of 2056 2484 f769bc3.exe 33 PID 2056 wrote to memory of 1096 2056 f76b71f.exe 19 PID 2056 wrote to memory of 1176 2056 f76b71f.exe 20 PID 2056 wrote to memory of 1204 2056 f76b71f.exe 21 PID 2056 wrote to memory of 884 2056 f76b71f.exe 25 -
System policy modification 1 TTPs 2 IoCs
Processes:
f769bc3.exef76b71f.exedescription ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f769bc3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76b71f.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1096
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1176
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1204
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3676e114c01b51c344a0008a0a6d87ddf66f308deabc48f9c87b780a2fb50e9e.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3676e114c01b51c344a0008a0a6d87ddf66f308deabc48f9c87b780a2fb50e9e.dll,#13⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\f769bc3.exeC:\Users\Admin\AppData\Local\Temp\f769bc3.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2484
-
-
C:\Users\Admin\AppData\Local\Temp\f769d97.exeC:\Users\Admin\AppData\Local\Temp\f769d97.exe4⤵
- Executes dropped EXE
PID:2816
-
-
C:\Users\Admin\AppData\Local\Temp\f76b71f.exeC:\Users\Admin\AppData\Local\Temp\f76b71f.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2056
-
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:884
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
257B
MD5fb8b395f4908e2e7ae3f81f7338ad69b
SHA11b20eed0b9a583f9b31740f5d53749481dbf8bc2
SHA2568872d2d1d0cd10c212bc0c5249888b56a6195d50d1a890c1599b982a3e6a11a1
SHA512adb212341cd23360e076178d62215b2a1832e8e6e52916eb7f62b7513cead936eaab0a4cf42bb86e285a2495c7c2fec02a0b2b5af8d039a2d8f5f6a57a790895
-
Filesize
97KB
MD5aeb633e1848e950cee214f79bc3d5c8f
SHA158da0bc74753a99c00039c3b5da5453d30e98406
SHA256f692af10c9741897eee3d7034ba04ddf881374c93b2351ea6afff5a5ab268306
SHA5121582e6b4caf2df2ae6e0a7ebcdf32f1e8621d2aea45ae722b49f195266ce18d869977339d1ee317a98ee2d3a08869cf268805a5e947a5c418b36874fa502c915