Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
15/12/2024, 22:47
Static task
static1
Behavioral task
behavioral1
Sample
ba351a64b455226c4d87f7dd3e4413c75c0cb7c13a03e70e422d3d33adf7b5f0N.dll
Resource
win7-20241023-en
General
-
Target
ba351a64b455226c4d87f7dd3e4413c75c0cb7c13a03e70e422d3d33adf7b5f0N.dll
-
Size
120KB
-
MD5
3242d7f5a760f33cdfa83eb8a5fce020
-
SHA1
d2f1f9cea8f83774f53eddf45c9f62c67d5168be
-
SHA256
ba351a64b455226c4d87f7dd3e4413c75c0cb7c13a03e70e422d3d33adf7b5f0
-
SHA512
261536da3ced9234ac6893eaf22189a6b344e7e09f6a328517eabebbd69878d1568a03a6c26049ecee9e92275d30e3a7b6ea05106651065831f8b8a673ae01a8
-
SSDEEP
3072:Rkggw5DyrMgADAYFYPt+KpJc2pNf9LfuiHf8:rArUDF34hpXLuwf8
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f7734d6.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f7734d6.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f77192c.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f77192c.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f77192c.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f7734d6.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f77192c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f7734d6.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f7734d6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f77192c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f7734d6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f7734d6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f7734d6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f7734d6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f7734d6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f77192c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f77192c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f77192c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f77192c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f77192c.exe -
Executes dropped EXE 3 IoCs
pid Process 2512 f77192c.exe 2672 f771f34.exe 2732 f7734d6.exe -
Loads dropped DLL 6 IoCs
pid Process 2152 rundll32.exe 2152 rundll32.exe 2152 rundll32.exe 2152 rundll32.exe 2152 rundll32.exe 2152 rundll32.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f77192c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f7734d6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f7734d6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f77192c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f7734d6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f7734d6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f77192c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f77192c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f7734d6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f7734d6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f7734d6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f77192c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f77192c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f77192c.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f77192c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f7734d6.exe -
Enumerates connected drives 3 TTPs 16 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: f77192c.exe File opened (read-only) \??\E: f7734d6.exe File opened (read-only) \??\G: f77192c.exe File opened (read-only) \??\M: f77192c.exe File opened (read-only) \??\P: f77192c.exe File opened (read-only) \??\R: f77192c.exe File opened (read-only) \??\E: f77192c.exe File opened (read-only) \??\I: f77192c.exe File opened (read-only) \??\J: f77192c.exe File opened (read-only) \??\N: f77192c.exe File opened (read-only) \??\Q: f77192c.exe File opened (read-only) \??\S: f77192c.exe File opened (read-only) \??\T: f77192c.exe File opened (read-only) \??\K: f77192c.exe File opened (read-only) \??\L: f77192c.exe File opened (read-only) \??\O: f77192c.exe -
resource yara_rule behavioral1/memory/2512-14-0x00000000006D0000-0x000000000178A000-memory.dmp upx behavioral1/memory/2512-18-0x00000000006D0000-0x000000000178A000-memory.dmp upx behavioral1/memory/2512-20-0x00000000006D0000-0x000000000178A000-memory.dmp upx behavioral1/memory/2512-24-0x00000000006D0000-0x000000000178A000-memory.dmp upx behavioral1/memory/2512-25-0x00000000006D0000-0x000000000178A000-memory.dmp upx behavioral1/memory/2512-23-0x00000000006D0000-0x000000000178A000-memory.dmp upx behavioral1/memory/2512-22-0x00000000006D0000-0x000000000178A000-memory.dmp upx behavioral1/memory/2512-19-0x00000000006D0000-0x000000000178A000-memory.dmp upx behavioral1/memory/2512-17-0x00000000006D0000-0x000000000178A000-memory.dmp upx behavioral1/memory/2512-16-0x00000000006D0000-0x000000000178A000-memory.dmp upx behavioral1/memory/2512-21-0x00000000006D0000-0x000000000178A000-memory.dmp upx behavioral1/memory/2512-31-0x00000000006D0000-0x000000000178A000-memory.dmp upx behavioral1/memory/2512-32-0x00000000006D0000-0x000000000178A000-memory.dmp upx behavioral1/memory/2512-63-0x00000000006D0000-0x000000000178A000-memory.dmp upx behavioral1/memory/2512-64-0x00000000006D0000-0x000000000178A000-memory.dmp upx behavioral1/memory/2512-65-0x00000000006D0000-0x000000000178A000-memory.dmp upx behavioral1/memory/2512-67-0x00000000006D0000-0x000000000178A000-memory.dmp upx behavioral1/memory/2512-68-0x00000000006D0000-0x000000000178A000-memory.dmp upx behavioral1/memory/2512-82-0x00000000006D0000-0x000000000178A000-memory.dmp upx behavioral1/memory/2512-84-0x00000000006D0000-0x000000000178A000-memory.dmp upx behavioral1/memory/2512-86-0x00000000006D0000-0x000000000178A000-memory.dmp upx behavioral1/memory/2512-87-0x00000000006D0000-0x000000000178A000-memory.dmp upx behavioral1/memory/2512-89-0x00000000006D0000-0x000000000178A000-memory.dmp upx behavioral1/memory/2512-149-0x00000000006D0000-0x000000000178A000-memory.dmp upx behavioral1/memory/2732-165-0x0000000000910000-0x00000000019CA000-memory.dmp upx behavioral1/memory/2732-202-0x0000000000910000-0x00000000019CA000-memory.dmp upx -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\f7719b8 f77192c.exe File opened for modification C:\Windows\SYSTEM.INI f77192c.exe File created C:\Windows\f776e6c f7734d6.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f77192c.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f7734d6.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2512 f77192c.exe 2512 f77192c.exe 2732 f7734d6.exe -
Suspicious use of AdjustPrivilegeToken 45 IoCs
description pid Process Token: SeDebugPrivilege 2512 f77192c.exe Token: SeDebugPrivilege 2512 f77192c.exe Token: SeDebugPrivilege 2512 f77192c.exe Token: SeDebugPrivilege 2512 f77192c.exe Token: SeDebugPrivilege 2512 f77192c.exe Token: SeDebugPrivilege 2512 f77192c.exe Token: SeDebugPrivilege 2512 f77192c.exe Token: SeDebugPrivilege 2512 f77192c.exe Token: SeDebugPrivilege 2512 f77192c.exe Token: SeDebugPrivilege 2512 f77192c.exe Token: SeDebugPrivilege 2512 f77192c.exe Token: SeDebugPrivilege 2512 f77192c.exe Token: SeDebugPrivilege 2512 f77192c.exe Token: SeDebugPrivilege 2512 f77192c.exe Token: SeDebugPrivilege 2512 f77192c.exe Token: SeDebugPrivilege 2512 f77192c.exe Token: SeDebugPrivilege 2512 f77192c.exe Token: SeDebugPrivilege 2512 f77192c.exe Token: SeDebugPrivilege 2512 f77192c.exe Token: SeDebugPrivilege 2512 f77192c.exe Token: SeDebugPrivilege 2512 f77192c.exe Token: SeDebugPrivilege 2512 f77192c.exe Token: SeDebugPrivilege 2512 f77192c.exe Token: SeDebugPrivilege 2732 f7734d6.exe Token: SeDebugPrivilege 2732 f7734d6.exe Token: SeDebugPrivilege 2732 f7734d6.exe Token: SeDebugPrivilege 2732 f7734d6.exe Token: SeDebugPrivilege 2732 f7734d6.exe Token: SeDebugPrivilege 2732 f7734d6.exe Token: SeDebugPrivilege 2732 f7734d6.exe Token: SeDebugPrivilege 2732 f7734d6.exe Token: SeDebugPrivilege 2732 f7734d6.exe Token: SeDebugPrivilege 2732 f7734d6.exe Token: SeDebugPrivilege 2732 f7734d6.exe Token: SeDebugPrivilege 2732 f7734d6.exe Token: SeDebugPrivilege 2732 f7734d6.exe Token: SeDebugPrivilege 2732 f7734d6.exe Token: SeDebugPrivilege 2732 f7734d6.exe Token: SeDebugPrivilege 2732 f7734d6.exe Token: SeDebugPrivilege 2732 f7734d6.exe Token: SeDebugPrivilege 2732 f7734d6.exe Token: SeDebugPrivilege 2732 f7734d6.exe Token: SeDebugPrivilege 2732 f7734d6.exe Token: SeDebugPrivilege 2732 f7734d6.exe Token: SeDebugPrivilege 2732 f7734d6.exe -
Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 2272 wrote to memory of 2152 2272 rundll32.exe 30 PID 2272 wrote to memory of 2152 2272 rundll32.exe 30 PID 2272 wrote to memory of 2152 2272 rundll32.exe 30 PID 2272 wrote to memory of 2152 2272 rundll32.exe 30 PID 2272 wrote to memory of 2152 2272 rundll32.exe 30 PID 2272 wrote to memory of 2152 2272 rundll32.exe 30 PID 2272 wrote to memory of 2152 2272 rundll32.exe 30 PID 2152 wrote to memory of 2512 2152 rundll32.exe 31 PID 2152 wrote to memory of 2512 2152 rundll32.exe 31 PID 2152 wrote to memory of 2512 2152 rundll32.exe 31 PID 2152 wrote to memory of 2512 2152 rundll32.exe 31 PID 2512 wrote to memory of 1112 2512 f77192c.exe 19 PID 2512 wrote to memory of 1176 2512 f77192c.exe 20 PID 2512 wrote to memory of 1216 2512 f77192c.exe 21 PID 2512 wrote to memory of 1348 2512 f77192c.exe 23 PID 2512 wrote to memory of 2272 2512 f77192c.exe 29 PID 2512 wrote to memory of 2152 2512 f77192c.exe 30 PID 2512 wrote to memory of 2152 2512 f77192c.exe 30 PID 2152 wrote to memory of 2672 2152 rundll32.exe 32 PID 2152 wrote to memory of 2672 2152 rundll32.exe 32 PID 2152 wrote to memory of 2672 2152 rundll32.exe 32 PID 2152 wrote to memory of 2672 2152 rundll32.exe 32 PID 2152 wrote to memory of 2732 2152 rundll32.exe 33 PID 2152 wrote to memory of 2732 2152 rundll32.exe 33 PID 2152 wrote to memory of 2732 2152 rundll32.exe 33 PID 2152 wrote to memory of 2732 2152 rundll32.exe 33 PID 2512 wrote to memory of 1112 2512 f77192c.exe 19 PID 2512 wrote to memory of 1176 2512 f77192c.exe 20 PID 2512 wrote to memory of 1216 2512 f77192c.exe 21 PID 2512 wrote to memory of 1348 2512 f77192c.exe 23 PID 2512 wrote to memory of 2672 2512 f77192c.exe 32 PID 2512 wrote to memory of 2672 2512 f77192c.exe 32 PID 2512 wrote to memory of 2732 2512 f77192c.exe 33 PID 2512 wrote to memory of 2732 2512 f77192c.exe 33 PID 2732 wrote to memory of 1112 2732 f7734d6.exe 19 PID 2732 wrote to memory of 1176 2732 f7734d6.exe 20 PID 2732 wrote to memory of 1216 2732 f7734d6.exe 21 PID 2732 wrote to memory of 1348 2732 f7734d6.exe 23 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f77192c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f7734d6.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1112
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1176
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1216
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ba351a64b455226c4d87f7dd3e4413c75c0cb7c13a03e70e422d3d33adf7b5f0N.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ba351a64b455226c4d87f7dd3e4413c75c0cb7c13a03e70e422d3d33adf7b5f0N.dll,#13⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\f77192c.exeC:\Users\Admin\AppData\Local\Temp\f77192c.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2512
-
-
C:\Users\Admin\AppData\Local\Temp\f771f34.exeC:\Users\Admin\AppData\Local\Temp\f771f34.exe4⤵
- Executes dropped EXE
PID:2672
-
-
C:\Users\Admin\AppData\Local\Temp\f7734d6.exeC:\Users\Admin\AppData\Local\Temp\f7734d6.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2732
-
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1348
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
257B
MD55fa5fb3a7da69a56d00e4a179cce5aa4
SHA1eaefa825966a35de54ade34913bc5a1070c5aa8c
SHA25632be05e1a343b71520e3719f8fc49df7ef35b3525e568a2da6ee8bd776cdbe87
SHA5123d17b50be126fa648239488dacb565b6489f0398a9898216b871be72359b9464cb22a13d91455eb0e55a6ec638a013f745ab53cdf6d0b5e041dc5d2613cfb5e7
-
Filesize
97KB
MD5fa1f2d22b78788237a3bdca27dd4a5c3
SHA110d4bccfd1504e94ceea2bf32080717974877c90
SHA256bda470445f6f7deede56bfa671e029d21a0319fad95221f8ca7cb2dd0a43b9cc
SHA512e19e6d1dbca55e2e955780ded543912a53d3125d4f2f8f094f0ddc648123db667c475e4d8294f456a6ae41fa88154c113539e783df41c7faccda8bc748732e55