Analysis
-
max time kernel
27s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
11-12-2024 13:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6b4bcc5db6714bdfb28a06fa41ab262227ed3186daf60cd5984fd1b93bf69ce0.dll
Resource
win7-20241010-en
windows7-x64
17 signatures
120 seconds
General
-
Target
6b4bcc5db6714bdfb28a06fa41ab262227ed3186daf60cd5984fd1b93bf69ce0.dll
-
Size
120KB
-
MD5
e3f1c306d339483420499dfb38d6eb53
-
SHA1
f0e26be09a0fd80fc417c4d710f50b6749e0e300
-
SHA256
6b4bcc5db6714bdfb28a06fa41ab262227ed3186daf60cd5984fd1b93bf69ce0
-
SHA512
7c4fda6f92d0d73cca0fd356a330f50c2ea85425cb4554cb73df71efc949eb0aead639c488fd94b36ff37a514fb6ea55ec5533163557dd7aef4f8f58c7b32e23
-
SSDEEP
3072:DBfxRBG91cdIjeTA05D8+vTVLe9uXnvmF+SPR:lj8fOiekUNNe9aq+SPR
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f7688fe.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f7688fe.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f7688fe.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f76a4b8.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f76a4b8.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f76a4b8.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76a4b8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f7688fe.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f7688fe.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f7688fe.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f7688fe.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f7688fe.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76a4b8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76a4b8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76a4b8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f7688fe.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f7688fe.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76a4b8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76a4b8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76a4b8.exe -
Executes dropped EXE 3 IoCs
pid Process 2716 f7688fe.exe 2864 f768cd5.exe 2896 f76a4b8.exe -
Loads dropped DLL 6 IoCs
pid Process 2360 rundll32.exe 2360 rundll32.exe 2360 rundll32.exe 2360 rundll32.exe 2360 rundll32.exe 2360 rundll32.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f7688fe.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f7688fe.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f7688fe.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76a4b8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76a4b8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f7688fe.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76a4b8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76a4b8.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f76a4b8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f7688fe.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f7688fe.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f7688fe.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76a4b8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76a4b8.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f7688fe.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76a4b8.exe -
Enumerates connected drives 3 TTPs 15 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\P: f7688fe.exe File opened (read-only) \??\G: f7688fe.exe File opened (read-only) \??\H: f7688fe.exe File opened (read-only) \??\L: f7688fe.exe File opened (read-only) \??\S: f7688fe.exe File opened (read-only) \??\R: f7688fe.exe File opened (read-only) \??\E: f76a4b8.exe File opened (read-only) \??\K: f7688fe.exe File opened (read-only) \??\O: f7688fe.exe File opened (read-only) \??\Q: f7688fe.exe File opened (read-only) \??\M: f7688fe.exe File opened (read-only) \??\N: f7688fe.exe File opened (read-only) \??\E: f7688fe.exe File opened (read-only) \??\I: f7688fe.exe File opened (read-only) \??\J: f7688fe.exe -
resource yara_rule behavioral1/memory/2716-12-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/2716-16-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/2716-19-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/2716-15-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/2716-17-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/2716-21-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/2716-20-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/2716-18-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/2716-14-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/2716-22-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/2716-57-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/2716-58-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/2716-59-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/2716-60-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/2716-61-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/2716-63-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/2716-64-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/2716-78-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/2716-79-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/2716-83-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/2716-84-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/2716-145-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/2896-162-0x0000000000990000-0x0000000001A4A000-memory.dmp upx behavioral1/memory/2896-200-0x0000000000990000-0x0000000001A4A000-memory.dmp upx -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\f7689a9 f7688fe.exe File opened for modification C:\Windows\SYSTEM.INI f7688fe.exe File created C:\Windows\f76dd54 f76a4b8.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f7688fe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f76a4b8.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2716 f7688fe.exe 2716 f7688fe.exe 2896 f76a4b8.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeDebugPrivilege 2716 f7688fe.exe Token: SeDebugPrivilege 2716 f7688fe.exe Token: SeDebugPrivilege 2716 f7688fe.exe Token: SeDebugPrivilege 2716 f7688fe.exe Token: SeDebugPrivilege 2716 f7688fe.exe Token: SeDebugPrivilege 2716 f7688fe.exe Token: SeDebugPrivilege 2716 f7688fe.exe Token: SeDebugPrivilege 2716 f7688fe.exe Token: SeDebugPrivilege 2716 f7688fe.exe Token: SeDebugPrivilege 2716 f7688fe.exe Token: SeDebugPrivilege 2716 f7688fe.exe Token: SeDebugPrivilege 2716 f7688fe.exe Token: SeDebugPrivilege 2716 f7688fe.exe Token: SeDebugPrivilege 2716 f7688fe.exe Token: SeDebugPrivilege 2716 f7688fe.exe Token: SeDebugPrivilege 2716 f7688fe.exe Token: SeDebugPrivilege 2716 f7688fe.exe Token: SeDebugPrivilege 2716 f7688fe.exe Token: SeDebugPrivilege 2716 f7688fe.exe Token: SeDebugPrivilege 2716 f7688fe.exe Token: SeDebugPrivilege 2716 f7688fe.exe Token: SeDebugPrivilege 2716 f7688fe.exe Token: SeDebugPrivilege 2716 f7688fe.exe Token: SeDebugPrivilege 2896 f76a4b8.exe Token: SeDebugPrivilege 2896 f76a4b8.exe Token: SeDebugPrivilege 2896 f76a4b8.exe Token: SeDebugPrivilege 2896 f76a4b8.exe Token: SeDebugPrivilege 2896 f76a4b8.exe Token: SeDebugPrivilege 2896 f76a4b8.exe Token: SeDebugPrivilege 2896 f76a4b8.exe Token: SeDebugPrivilege 2896 f76a4b8.exe Token: SeDebugPrivilege 2896 f76a4b8.exe Token: SeDebugPrivilege 2896 f76a4b8.exe Token: SeDebugPrivilege 2896 f76a4b8.exe Token: SeDebugPrivilege 2896 f76a4b8.exe Token: SeDebugPrivilege 2896 f76a4b8.exe Token: SeDebugPrivilege 2896 f76a4b8.exe Token: SeDebugPrivilege 2896 f76a4b8.exe Token: SeDebugPrivilege 2896 f76a4b8.exe Token: SeDebugPrivilege 2896 f76a4b8.exe Token: SeDebugPrivilege 2896 f76a4b8.exe Token: SeDebugPrivilege 2896 f76a4b8.exe Token: SeDebugPrivilege 2896 f76a4b8.exe Token: SeDebugPrivilege 2896 f76a4b8.exe Token: SeDebugPrivilege 2896 f76a4b8.exe Token: SeDebugPrivilege 2896 f76a4b8.exe -
Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 2568 wrote to memory of 2360 2568 rundll32.exe 30 PID 2568 wrote to memory of 2360 2568 rundll32.exe 30 PID 2568 wrote to memory of 2360 2568 rundll32.exe 30 PID 2568 wrote to memory of 2360 2568 rundll32.exe 30 PID 2568 wrote to memory of 2360 2568 rundll32.exe 30 PID 2568 wrote to memory of 2360 2568 rundll32.exe 30 PID 2568 wrote to memory of 2360 2568 rundll32.exe 30 PID 2360 wrote to memory of 2716 2360 rundll32.exe 31 PID 2360 wrote to memory of 2716 2360 rundll32.exe 31 PID 2360 wrote to memory of 2716 2360 rundll32.exe 31 PID 2360 wrote to memory of 2716 2360 rundll32.exe 31 PID 2716 wrote to memory of 1108 2716 f7688fe.exe 19 PID 2716 wrote to memory of 1168 2716 f7688fe.exe 20 PID 2716 wrote to memory of 1204 2716 f7688fe.exe 21 PID 2716 wrote to memory of 844 2716 f7688fe.exe 23 PID 2716 wrote to memory of 2568 2716 f7688fe.exe 29 PID 2716 wrote to memory of 2360 2716 f7688fe.exe 30 PID 2716 wrote to memory of 2360 2716 f7688fe.exe 30 PID 2360 wrote to memory of 2864 2360 rundll32.exe 32 PID 2360 wrote to memory of 2864 2360 rundll32.exe 32 PID 2360 wrote to memory of 2864 2360 rundll32.exe 32 PID 2360 wrote to memory of 2864 2360 rundll32.exe 32 PID 2360 wrote to memory of 2896 2360 rundll32.exe 33 PID 2360 wrote to memory of 2896 2360 rundll32.exe 33 PID 2360 wrote to memory of 2896 2360 rundll32.exe 33 PID 2360 wrote to memory of 2896 2360 rundll32.exe 33 PID 2716 wrote to memory of 1108 2716 f7688fe.exe 19 PID 2716 wrote to memory of 1168 2716 f7688fe.exe 20 PID 2716 wrote to memory of 1204 2716 f7688fe.exe 21 PID 2716 wrote to memory of 844 2716 f7688fe.exe 23 PID 2716 wrote to memory of 2864 2716 f7688fe.exe 32 PID 2716 wrote to memory of 2864 2716 f7688fe.exe 32 PID 2716 wrote to memory of 2896 2716 f7688fe.exe 33 PID 2716 wrote to memory of 2896 2716 f7688fe.exe 33 PID 2896 wrote to memory of 1108 2896 f76a4b8.exe 19 PID 2896 wrote to memory of 1168 2896 f76a4b8.exe 20 PID 2896 wrote to memory of 1204 2896 f76a4b8.exe 21 PID 2896 wrote to memory of 844 2896 f76a4b8.exe 23 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f7688fe.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76a4b8.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1108
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1168
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1204
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6b4bcc5db6714bdfb28a06fa41ab262227ed3186daf60cd5984fd1b93bf69ce0.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6b4bcc5db6714bdfb28a06fa41ab262227ed3186daf60cd5984fd1b93bf69ce0.dll,#13⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\f7688fe.exeC:\Users\Admin\AppData\Local\Temp\f7688fe.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2716
-
-
C:\Users\Admin\AppData\Local\Temp\f768cd5.exeC:\Users\Admin\AppData\Local\Temp\f768cd5.exe4⤵
- Executes dropped EXE
PID:2864
-
-
C:\Users\Admin\AppData\Local\Temp\f76a4b8.exeC:\Users\Admin\AppData\Local\Temp\f76a4b8.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2896
-
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:844
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
257B
MD518d19db9c584ec6fad40dff6bb843b9a
SHA1734c23ccf0740fd3d00f4c91b0c43b08627f17d9
SHA2560fd1ee9642f29e5edd74b80b1a00bfab599b25ad31553c2770fc3b8a50dd1e4a
SHA5123823f6a0a93b45f65e054b5016e324431c9de783de4171f8461ce30b3c9451a8e792447abc9a6f918babd4c5e08d8185e82b7f1219aac6a6c6ae9076c8ce68ab
-
Filesize
97KB
MD52e3eae26764b1c497b755c37911a5f3f
SHA1d456674790a0128a9f1a5b64e17b10a1e694442a
SHA25632319126961d3811a093cc85d5028e84d0c5bc92d4e94242eddf72f75cf0ccf2
SHA5125b0d9fa164b96d19f3895b4c6c63df9ced52fe585addea4dede97bfeb2df6ab2006993450ceb33590cdf075a2e6b1af1c20cb54d7f024ce4589c65d3896359b9