Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    121s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    11/12/2024, 09:09

General

  • Target

    812be1d65df03d161c1d0fc7e3cf3365592923bc69bf5ba18171018ad2d07184.dll

  • Size

    120KB

  • MD5

    51be7c2c4f515baa585791f71e8cbe3b

  • SHA1

    61ba1e9f2f4ed63c399b7ca50f6dc8786cfa9f5d

  • SHA256

    812be1d65df03d161c1d0fc7e3cf3365592923bc69bf5ba18171018ad2d07184

  • SHA512

    2f2469c7e9ed3bf94a289088c334d962951384cd6504b2bd556d0a93197cb428c0d2797d22fb09852b6fd0e05a6125488f9c3ad664ff99957d0a5da51f5dee9e

  • SSDEEP

    1536:G3jCKCtQbCPcB/j4ZXRWOvHCT9qfNLSIPEUO4+M2WdZI292ZZZUA:GJC+bCPcB/kZXFvZhSOG4+MvZ7A

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Signatures

  • Modifies firewall policy service 3 TTPs 6 IoCs
  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

  • Sality family
  • UAC bypass 3 TTPs 2 IoCs
  • Windows security bypass 2 TTPs 12 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 6 IoCs
  • Windows security modification 2 TTPs 14 IoCs
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
  • Enumerates connected drives 3 TTPs 15 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file 25 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Windows directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 46 IoCs
  • Suspicious use of WriteProcessMemory 38 IoCs
  • System policy modification 1 TTPs 2 IoCs

Processes

  • C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    1⤵
      PID:1112
    • C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      1⤵
        PID:1156
      • C:\Windows\Explorer.EXE
        C:\Windows\Explorer.EXE
        1⤵
          PID:1192
          • C:\Windows\system32\rundll32.exe
            rundll32.exe C:\Users\Admin\AppData\Local\Temp\812be1d65df03d161c1d0fc7e3cf3365592923bc69bf5ba18171018ad2d07184.dll,#1
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:3056
            • C:\Windows\SysWOW64\rundll32.exe
              rundll32.exe C:\Users\Admin\AppData\Local\Temp\812be1d65df03d161c1d0fc7e3cf3365592923bc69bf5ba18171018ad2d07184.dll,#1
              3⤵
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2520
              • C:\Users\Admin\AppData\Local\Temp\f769453.exe
                C:\Users\Admin\AppData\Local\Temp\f769453.exe
                4⤵
                • Modifies firewall policy service
                • UAC bypass
                • Windows security bypass
                • Executes dropped EXE
                • Windows security modification
                • Checks whether UAC is enabled
                • Enumerates connected drives
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                • System policy modification
                PID:2576
              • C:\Users\Admin\AppData\Local\Temp\f769637.exe
                C:\Users\Admin\AppData\Local\Temp\f769637.exe
                4⤵
                • Modifies firewall policy service
                • UAC bypass
                • Windows security bypass
                • Executes dropped EXE
                • Windows security modification
                • Checks whether UAC is enabled
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                • System policy modification
                PID:2292
              • C:\Users\Admin\AppData\Local\Temp\f76b09a.exe
                C:\Users\Admin\AppData\Local\Temp\f76b09a.exe
                4⤵
                • Executes dropped EXE
                PID:2676
        • C:\Windows\system32\DllHost.exe
          C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
          1⤵
            PID:1600

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Windows\SYSTEM.INI

            Filesize

            257B

            MD5

            5462c71c8f8736395d0e4875b2236a7b

            SHA1

            3eee5d6485382277f48312e485ff2ecb72b0796f

            SHA256

            0e3e2193ed981c444a91b1b8153baf72323a91bb976304361c3be3995d9987ae

            SHA512

            feafdcb56b3ad8e2632e380c88d2370ba978cfb47f6b12c713178052d2965c1365694b7379bf2f7f7746b18134abf113ac05efcd58b8605346d5f16cf0977526

          • \Users\Admin\AppData\Local\Temp\f769453.exe

            Filesize

            97KB

            MD5

            99624688fce5030abb5571c295f951e1

            SHA1

            52feebe0051f860b435a504cade50c550f164458

            SHA256

            1e025affb2724d783074d81ee93868e4ad0e6fafc7aba0d6186f7fca6fb43102

            SHA512

            d9bbf1123da33cfb309674fcfd3d201aa05903102cc782adb6118ce25f9ca4c5f7cd62cb5ad169946fae4bb4d4cafae8174620037e92f2cb0dabda3bb4ff727c

          • memory/1112-29-0x0000000000210000-0x0000000000212000-memory.dmp

            Filesize

            8KB

          • memory/2292-192-0x0000000000980000-0x0000000001A3A000-memory.dmp

            Filesize

            16.7MB

          • memory/2292-193-0x0000000000400000-0x0000000000412000-memory.dmp

            Filesize

            72KB

          • memory/2292-159-0x0000000000980000-0x0000000001A3A000-memory.dmp

            Filesize

            16.7MB

          • memory/2292-123-0x0000000000260000-0x0000000000262000-memory.dmp

            Filesize

            8KB

          • memory/2292-102-0x0000000000260000-0x0000000000262000-memory.dmp

            Filesize

            8KB

          • memory/2292-96-0x00000000002B0000-0x00000000002B1000-memory.dmp

            Filesize

            4KB

          • memory/2292-99-0x0000000000260000-0x0000000000262000-memory.dmp

            Filesize

            8KB

          • memory/2292-60-0x0000000000400000-0x0000000000412000-memory.dmp

            Filesize

            72KB

          • memory/2520-38-0x00000000001B0000-0x00000000001B1000-memory.dmp

            Filesize

            4KB

          • memory/2520-57-0x00000000001A0000-0x00000000001A2000-memory.dmp

            Filesize

            8KB

          • memory/2520-37-0x00000000001A0000-0x00000000001A2000-memory.dmp

            Filesize

            8KB

          • memory/2520-10-0x0000000000180000-0x0000000000192000-memory.dmp

            Filesize

            72KB

          • memory/2520-9-0x0000000000180000-0x0000000000192000-memory.dmp

            Filesize

            72KB

          • memory/2520-1-0x0000000010000000-0x0000000010020000-memory.dmp

            Filesize

            128KB

          • memory/2520-76-0x00000000001A0000-0x00000000001A2000-memory.dmp

            Filesize

            8KB

          • memory/2520-40-0x00000000001B0000-0x00000000001B1000-memory.dmp

            Filesize

            4KB

          • memory/2520-55-0x00000000001A0000-0x00000000001A2000-memory.dmp

            Filesize

            8KB

          • memory/2520-56-0x0000000000280000-0x0000000000292000-memory.dmp

            Filesize

            72KB

          • memory/2576-68-0x00000000005B0000-0x000000000166A000-memory.dmp

            Filesize

            16.7MB

          • memory/2576-86-0x00000000005B0000-0x000000000166A000-memory.dmp

            Filesize

            16.7MB

          • memory/2576-23-0x00000000005B0000-0x000000000166A000-memory.dmp

            Filesize

            16.7MB

          • memory/2576-48-0x0000000003BD0000-0x0000000003BD2000-memory.dmp

            Filesize

            8KB

          • memory/2576-59-0x0000000003BD0000-0x0000000003BD2000-memory.dmp

            Filesize

            8KB

          • memory/2576-61-0x00000000005B0000-0x000000000166A000-memory.dmp

            Filesize

            16.7MB

          • memory/2576-62-0x00000000005B0000-0x000000000166A000-memory.dmp

            Filesize

            16.7MB

          • memory/2576-63-0x00000000005B0000-0x000000000166A000-memory.dmp

            Filesize

            16.7MB

          • memory/2576-64-0x00000000005B0000-0x000000000166A000-memory.dmp

            Filesize

            16.7MB

          • memory/2576-65-0x00000000005B0000-0x000000000166A000-memory.dmp

            Filesize

            16.7MB

          • memory/2576-67-0x00000000005B0000-0x000000000166A000-memory.dmp

            Filesize

            16.7MB

          • memory/2576-14-0x00000000005B0000-0x000000000166A000-memory.dmp

            Filesize

            16.7MB

          • memory/2576-17-0x00000000005B0000-0x000000000166A000-memory.dmp

            Filesize

            16.7MB

          • memory/2576-11-0x0000000000400000-0x0000000000412000-memory.dmp

            Filesize

            72KB

          • memory/2576-81-0x00000000005B0000-0x000000000166A000-memory.dmp

            Filesize

            16.7MB

          • memory/2576-82-0x00000000005B0000-0x000000000166A000-memory.dmp

            Filesize

            16.7MB

          • memory/2576-85-0x00000000005B0000-0x000000000166A000-memory.dmp

            Filesize

            16.7MB

          • memory/2576-20-0x00000000005B0000-0x000000000166A000-memory.dmp

            Filesize

            16.7MB

          • memory/2576-22-0x00000000005B0000-0x000000000166A000-memory.dmp

            Filesize

            16.7MB

          • memory/2576-16-0x00000000005B0000-0x000000000166A000-memory.dmp

            Filesize

            16.7MB

          • memory/2576-18-0x00000000005B0000-0x000000000166A000-memory.dmp

            Filesize

            16.7MB

          • memory/2576-46-0x0000000003C20000-0x0000000003C21000-memory.dmp

            Filesize

            4KB

          • memory/2576-21-0x00000000005B0000-0x000000000166A000-memory.dmp

            Filesize

            16.7MB

          • memory/2576-106-0x00000000005B0000-0x000000000166A000-memory.dmp

            Filesize

            16.7MB

          • memory/2576-15-0x00000000005B0000-0x000000000166A000-memory.dmp

            Filesize

            16.7MB

          • memory/2576-153-0x0000000000400000-0x0000000000412000-memory.dmp

            Filesize

            72KB

          • memory/2576-152-0x00000000005B0000-0x000000000166A000-memory.dmp

            Filesize

            16.7MB

          • memory/2576-19-0x00000000005B0000-0x000000000166A000-memory.dmp

            Filesize

            16.7MB

          • memory/2676-160-0x0000000000260000-0x0000000000262000-memory.dmp

            Filesize

            8KB

          • memory/2676-105-0x0000000000260000-0x0000000000262000-memory.dmp

            Filesize

            8KB

          • memory/2676-103-0x00000000002B0000-0x00000000002B1000-memory.dmp

            Filesize

            4KB

          • memory/2676-80-0x0000000000400000-0x0000000000412000-memory.dmp

            Filesize

            72KB

          • memory/2676-197-0x0000000000400000-0x0000000000412000-memory.dmp

            Filesize

            72KB