Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    32s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    11/12/2024, 13:15

General

  • Target

    6b4bcc5db6714bdfb28a06fa41ab262227ed3186daf60cd5984fd1b93bf69ce0.dll

  • Size

    120KB

  • MD5

    e3f1c306d339483420499dfb38d6eb53

  • SHA1

    f0e26be09a0fd80fc417c4d710f50b6749e0e300

  • SHA256

    6b4bcc5db6714bdfb28a06fa41ab262227ed3186daf60cd5984fd1b93bf69ce0

  • SHA512

    7c4fda6f92d0d73cca0fd356a330f50c2ea85425cb4554cb73df71efc949eb0aead639c488fd94b36ff37a514fb6ea55ec5533163557dd7aef4f8f58c7b32e23

  • SSDEEP

    3072:DBfxRBG91cdIjeTA05D8+vTVLe9uXnvmF+SPR:lj8fOiekUNNe9aq+SPR

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Signatures

  • Modifies firewall policy service 3 TTPs 9 IoCs
  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

  • Sality family
  • UAC bypass 3 TTPs 3 IoCs
  • Windows security bypass 2 TTPs 18 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 6 IoCs
  • Windows security modification 2 TTPs 21 IoCs
  • Checks whether UAC is enabled 1 TTPs 3 IoCs
  • Enumerates connected drives 3 TTPs 12 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file 27 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Windows directory 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 46 IoCs
  • Suspicious use of WriteProcessMemory 37 IoCs
  • System policy modification 1 TTPs 3 IoCs

Processes

  • C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    1⤵
      PID:1128
    • C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      1⤵
        PID:1180
      • C:\Windows\Explorer.EXE
        C:\Windows\Explorer.EXE
        1⤵
          PID:1216
          • C:\Windows\system32\rundll32.exe
            rundll32.exe C:\Users\Admin\AppData\Local\Temp\6b4bcc5db6714bdfb28a06fa41ab262227ed3186daf60cd5984fd1b93bf69ce0.dll,#1
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:2204
            • C:\Windows\SysWOW64\rundll32.exe
              rundll32.exe C:\Users\Admin\AppData\Local\Temp\6b4bcc5db6714bdfb28a06fa41ab262227ed3186daf60cd5984fd1b93bf69ce0.dll,#1
              3⤵
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:1708
              • C:\Users\Admin\AppData\Local\Temp\f768e3b.exe
                C:\Users\Admin\AppData\Local\Temp\f768e3b.exe
                4⤵
                • Modifies firewall policy service
                • UAC bypass
                • Windows security bypass
                • Executes dropped EXE
                • Windows security modification
                • Checks whether UAC is enabled
                • Enumerates connected drives
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                • System policy modification
                PID:2516
              • C:\Users\Admin\AppData\Local\Temp\f768ff0.exe
                C:\Users\Admin\AppData\Local\Temp\f768ff0.exe
                4⤵
                • Modifies firewall policy service
                • UAC bypass
                • Windows security bypass
                • Executes dropped EXE
                • Windows security modification
                • Checks whether UAC is enabled
                • Drops file in Windows directory
                • System policy modification
                PID:2632
              • C:\Users\Admin\AppData\Local\Temp\f76bb44.exe
                C:\Users\Admin\AppData\Local\Temp\f76bb44.exe
                4⤵
                • Modifies firewall policy service
                • UAC bypass
                • Windows security bypass
                • Executes dropped EXE
                • Windows security modification
                • Checks whether UAC is enabled
                • Enumerates connected drives
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                • System policy modification
                PID:1252
        • C:\Windows\system32\DllHost.exe
          C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
          1⤵
            PID:1764

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Windows\SYSTEM.INI

            Filesize

            257B

            MD5

            67b764669fda2241c110de6ef9f9244e

            SHA1

            ae4a961edc8e89f96b0d1bda45c3aeeceba53f23

            SHA256

            1bef050d64b64ac0268686ef561ee83227208196c0ca3703902eae15787f6c54

            SHA512

            74c359fb558934264902b09ee302c9cb22e3f7bed6b15fb04bb933d0704951fd02261d155247e862ac0ef27c2c20c0f607d62bd7a2603008c87b91e84b73d655

          • \Users\Admin\AppData\Local\Temp\f768e3b.exe

            Filesize

            97KB

            MD5

            2e3eae26764b1c497b755c37911a5f3f

            SHA1

            d456674790a0128a9f1a5b64e17b10a1e694442a

            SHA256

            32319126961d3811a093cc85d5028e84d0c5bc92d4e94242eddf72f75cf0ccf2

            SHA512

            5b0d9fa164b96d19f3895b4c6c63df9ced52fe585addea4dede97bfeb2df6ab2006993450ceb33590cdf075a2e6b1af1c20cb54d7f024ce4589c65d3896359b9

          • memory/1128-29-0x0000000000160000-0x0000000000162000-memory.dmp

            Filesize

            8KB

          • memory/1252-219-0x0000000000400000-0x0000000000412000-memory.dmp

            Filesize

            72KB

          • memory/1252-101-0x0000000000400000-0x0000000000412000-memory.dmp

            Filesize

            72KB

          • memory/1252-168-0x0000000000520000-0x00000000015DA000-memory.dmp

            Filesize

            16.7MB

          • memory/1252-220-0x0000000000520000-0x00000000015DA000-memory.dmp

            Filesize

            16.7MB

          • memory/1708-62-0x00000000001E0000-0x00000000001E2000-memory.dmp

            Filesize

            8KB

          • memory/1708-61-0x00000000003C0000-0x00000000003D2000-memory.dmp

            Filesize

            72KB

          • memory/1708-39-0x00000000002B0000-0x00000000002B1000-memory.dmp

            Filesize

            4KB

          • memory/1708-48-0x00000000002B0000-0x00000000002B1000-memory.dmp

            Filesize

            4KB

          • memory/1708-95-0x00000000003E0000-0x00000000003F2000-memory.dmp

            Filesize

            72KB

          • memory/1708-96-0x00000000003E0000-0x00000000003F2000-memory.dmp

            Filesize

            72KB

          • memory/1708-9-0x00000000001B0000-0x00000000001C2000-memory.dmp

            Filesize

            72KB

          • memory/1708-100-0x00000000001B0000-0x00000000001B2000-memory.dmp

            Filesize

            8KB

          • memory/1708-68-0x00000000001E0000-0x00000000001E2000-memory.dmp

            Filesize

            8KB

          • memory/1708-10-0x00000000001B0000-0x00000000001C2000-memory.dmp

            Filesize

            72KB

          • memory/1708-1-0x0000000010000000-0x0000000010020000-memory.dmp

            Filesize

            128KB

          • memory/1708-38-0x00000000001E0000-0x00000000001E2000-memory.dmp

            Filesize

            8KB

          • memory/1708-59-0x00000000001E0000-0x00000000001E2000-memory.dmp

            Filesize

            8KB

          • memory/2516-65-0x0000000000710000-0x00000000017CA000-memory.dmp

            Filesize

            16.7MB

          • memory/2516-14-0x0000000000710000-0x00000000017CA000-memory.dmp

            Filesize

            16.7MB

          • memory/2516-52-0x00000000004E0000-0x00000000004E2000-memory.dmp

            Filesize

            8KB

          • memory/2516-49-0x00000000004F0000-0x00000000004F1000-memory.dmp

            Filesize

            4KB

          • memory/2516-20-0x0000000000710000-0x00000000017CA000-memory.dmp

            Filesize

            16.7MB

          • memory/2516-16-0x0000000000710000-0x00000000017CA000-memory.dmp

            Filesize

            16.7MB

          • memory/2516-64-0x0000000000710000-0x00000000017CA000-memory.dmp

            Filesize

            16.7MB

          • memory/2516-66-0x0000000000710000-0x00000000017CA000-memory.dmp

            Filesize

            16.7MB

          • memory/2516-23-0x0000000000710000-0x00000000017CA000-memory.dmp

            Filesize

            16.7MB

          • memory/2516-67-0x00000000004E0000-0x00000000004E2000-memory.dmp

            Filesize

            8KB

          • memory/2516-22-0x0000000000710000-0x00000000017CA000-memory.dmp

            Filesize

            16.7MB

          • memory/2516-69-0x0000000000710000-0x00000000017CA000-memory.dmp

            Filesize

            16.7MB

          • memory/2516-11-0x0000000000400000-0x0000000000412000-memory.dmp

            Filesize

            72KB

          • memory/2516-12-0x0000000000710000-0x00000000017CA000-memory.dmp

            Filesize

            16.7MB

          • memory/2516-18-0x0000000000710000-0x00000000017CA000-memory.dmp

            Filesize

            16.7MB

          • memory/2516-15-0x0000000000710000-0x00000000017CA000-memory.dmp

            Filesize

            16.7MB

          • memory/2516-85-0x0000000000710000-0x00000000017CA000-memory.dmp

            Filesize

            16.7MB

          • memory/2516-86-0x0000000000710000-0x00000000017CA000-memory.dmp

            Filesize

            16.7MB

          • memory/2516-21-0x0000000000710000-0x00000000017CA000-memory.dmp

            Filesize

            16.7MB

          • memory/2516-51-0x00000000004E0000-0x00000000004E2000-memory.dmp

            Filesize

            8KB

          • memory/2516-19-0x0000000000710000-0x00000000017CA000-memory.dmp

            Filesize

            16.7MB

          • memory/2516-17-0x0000000000710000-0x00000000017CA000-memory.dmp

            Filesize

            16.7MB

          • memory/2516-103-0x0000000000710000-0x00000000017CA000-memory.dmp

            Filesize

            16.7MB

          • memory/2516-104-0x0000000000710000-0x00000000017CA000-memory.dmp

            Filesize

            16.7MB

          • memory/2516-106-0x0000000000710000-0x00000000017CA000-memory.dmp

            Filesize

            16.7MB

          • memory/2516-108-0x0000000000710000-0x00000000017CA000-memory.dmp

            Filesize

            16.7MB

          • memory/2516-134-0x0000000000400000-0x0000000000412000-memory.dmp

            Filesize

            72KB

          • memory/2516-111-0x0000000000710000-0x00000000017CA000-memory.dmp

            Filesize

            16.7MB

          • memory/2516-112-0x0000000000710000-0x00000000017CA000-memory.dmp

            Filesize

            16.7MB

          • memory/2516-135-0x0000000000710000-0x00000000017CA000-memory.dmp

            Filesize

            16.7MB

          • memory/2632-109-0x0000000000260000-0x0000000000262000-memory.dmp

            Filesize

            8KB

          • memory/2632-82-0x0000000000260000-0x0000000000262000-memory.dmp

            Filesize

            8KB

          • memory/2632-153-0x0000000000400000-0x0000000000412000-memory.dmp

            Filesize

            72KB

          • memory/2632-154-0x00000000009B0000-0x0000000001A6A000-memory.dmp

            Filesize

            16.7MB

          • memory/2632-83-0x00000000002B0000-0x00000000002B1000-memory.dmp

            Filesize

            4KB

          • memory/2632-198-0x00000000009B0000-0x0000000001A6A000-memory.dmp

            Filesize

            16.7MB

          • memory/2632-84-0x0000000000260000-0x0000000000262000-memory.dmp

            Filesize

            8KB

          • memory/2632-63-0x0000000000400000-0x0000000000412000-memory.dmp

            Filesize

            72KB