Analysis
-
max time kernel
28s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
16-12-2024 22:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9a744510aa6c98a2a9880c76bebfd2d7cb2b4abd11a92823a7b1d3d9ba51d831.dll
Resource
win7-20240708-en
windows7-x64
17 signatures
120 seconds
General
-
Target
9a744510aa6c98a2a9880c76bebfd2d7cb2b4abd11a92823a7b1d3d9ba51d831.dll
-
Size
120KB
-
MD5
c1305ba0747068170b1e0a5e43981d65
-
SHA1
0578904ac6e0693a2bf396f9c6c3e677873411a0
-
SHA256
9a744510aa6c98a2a9880c76bebfd2d7cb2b4abd11a92823a7b1d3d9ba51d831
-
SHA512
509535e470811d6eeb36f108ccaa02f9c9bfa800748fef85bb162e9d0eca66bc4d33dadb47e0cb45eba440b15406ef8c14ac80bfba4ed7bc5e36e8f9dcedceb8
-
SSDEEP
3072:t6RdsJRnvxBVOGb9gHRdR49BxG9siWjaDnq+:kRd6nv7EGb2RSMNOqB
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f768102.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f768102.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f76629a.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f76629a.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f76629a.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f768102.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76629a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f768102.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f768102.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76629a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76629a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f768102.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f768102.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f768102.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f768102.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f768102.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76629a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76629a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76629a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76629a.exe -
Executes dropped EXE 3 IoCs
pid Process 2720 f76629a.exe 3008 f76646e.exe 3028 f768102.exe -
Loads dropped DLL 6 IoCs
pid Process 2680 rundll32.exe 2680 rundll32.exe 2680 rundll32.exe 2680 rundll32.exe 2680 rundll32.exe 2680 rundll32.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f768102.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f76629a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f768102.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f768102.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f768102.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76629a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76629a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76629a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76629a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76629a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f768102.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76629a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f768102.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f768102.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76629a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f768102.exe -
Enumerates connected drives 3 TTPs 17 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: f76629a.exe File opened (read-only) \??\M: f76629a.exe File opened (read-only) \??\O: f76629a.exe File opened (read-only) \??\H: f76629a.exe File opened (read-only) \??\K: f76629a.exe File opened (read-only) \??\P: f76629a.exe File opened (read-only) \??\R: f76629a.exe File opened (read-only) \??\E: f768102.exe File opened (read-only) \??\G: f768102.exe File opened (read-only) \??\E: f76629a.exe File opened (read-only) \??\J: f76629a.exe File opened (read-only) \??\Q: f76629a.exe File opened (read-only) \??\T: f76629a.exe File opened (read-only) \??\G: f76629a.exe File opened (read-only) \??\L: f76629a.exe File opened (read-only) \??\N: f76629a.exe File opened (read-only) \??\S: f76629a.exe -
resource yara_rule behavioral1/memory/2720-18-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2720-20-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2720-21-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2720-19-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2720-15-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2720-22-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2720-13-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2720-14-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2720-17-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2720-16-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2720-60-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2720-61-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2720-62-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2720-64-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2720-63-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2720-66-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2720-67-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2720-68-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2720-69-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2720-85-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2720-87-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2720-95-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2720-150-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/3028-167-0x0000000000920000-0x00000000019DA000-memory.dmp upx behavioral1/memory/3028-206-0x0000000000920000-0x00000000019DA000-memory.dmp upx -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI f76629a.exe File created C:\Windows\f76b490 f768102.exe File created C:\Windows\f766307 f76629a.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f76629a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f768102.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2720 f76629a.exe 2720 f76629a.exe 3028 f768102.exe -
Suspicious use of AdjustPrivilegeToken 45 IoCs
description pid Process Token: SeDebugPrivilege 2720 f76629a.exe Token: SeDebugPrivilege 2720 f76629a.exe Token: SeDebugPrivilege 2720 f76629a.exe Token: SeDebugPrivilege 2720 f76629a.exe Token: SeDebugPrivilege 2720 f76629a.exe Token: SeDebugPrivilege 2720 f76629a.exe Token: SeDebugPrivilege 2720 f76629a.exe Token: SeDebugPrivilege 2720 f76629a.exe Token: SeDebugPrivilege 2720 f76629a.exe Token: SeDebugPrivilege 2720 f76629a.exe Token: SeDebugPrivilege 2720 f76629a.exe Token: SeDebugPrivilege 2720 f76629a.exe Token: SeDebugPrivilege 2720 f76629a.exe Token: SeDebugPrivilege 2720 f76629a.exe Token: SeDebugPrivilege 2720 f76629a.exe Token: SeDebugPrivilege 2720 f76629a.exe Token: SeDebugPrivilege 2720 f76629a.exe Token: SeDebugPrivilege 2720 f76629a.exe Token: SeDebugPrivilege 2720 f76629a.exe Token: SeDebugPrivilege 2720 f76629a.exe Token: SeDebugPrivilege 2720 f76629a.exe Token: SeDebugPrivilege 2720 f76629a.exe Token: SeDebugPrivilege 2720 f76629a.exe Token: SeDebugPrivilege 3028 f768102.exe Token: SeDebugPrivilege 3028 f768102.exe Token: SeDebugPrivilege 3028 f768102.exe Token: SeDebugPrivilege 3028 f768102.exe Token: SeDebugPrivilege 3028 f768102.exe Token: SeDebugPrivilege 3028 f768102.exe Token: SeDebugPrivilege 3028 f768102.exe Token: SeDebugPrivilege 3028 f768102.exe Token: SeDebugPrivilege 3028 f768102.exe Token: SeDebugPrivilege 3028 f768102.exe Token: SeDebugPrivilege 3028 f768102.exe Token: SeDebugPrivilege 3028 f768102.exe Token: SeDebugPrivilege 3028 f768102.exe Token: SeDebugPrivilege 3028 f768102.exe Token: SeDebugPrivilege 3028 f768102.exe Token: SeDebugPrivilege 3028 f768102.exe Token: SeDebugPrivilege 3028 f768102.exe Token: SeDebugPrivilege 3028 f768102.exe Token: SeDebugPrivilege 3028 f768102.exe Token: SeDebugPrivilege 3028 f768102.exe Token: SeDebugPrivilege 3028 f768102.exe Token: SeDebugPrivilege 3028 f768102.exe -
Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 1508 wrote to memory of 2680 1508 rundll32.exe 30 PID 1508 wrote to memory of 2680 1508 rundll32.exe 30 PID 1508 wrote to memory of 2680 1508 rundll32.exe 30 PID 1508 wrote to memory of 2680 1508 rundll32.exe 30 PID 1508 wrote to memory of 2680 1508 rundll32.exe 30 PID 1508 wrote to memory of 2680 1508 rundll32.exe 30 PID 1508 wrote to memory of 2680 1508 rundll32.exe 30 PID 2680 wrote to memory of 2720 2680 rundll32.exe 31 PID 2680 wrote to memory of 2720 2680 rundll32.exe 31 PID 2680 wrote to memory of 2720 2680 rundll32.exe 31 PID 2680 wrote to memory of 2720 2680 rundll32.exe 31 PID 2720 wrote to memory of 1116 2720 f76629a.exe 19 PID 2720 wrote to memory of 1168 2720 f76629a.exe 20 PID 2720 wrote to memory of 1236 2720 f76629a.exe 21 PID 2720 wrote to memory of 1636 2720 f76629a.exe 25 PID 2720 wrote to memory of 1508 2720 f76629a.exe 29 PID 2720 wrote to memory of 2680 2720 f76629a.exe 30 PID 2720 wrote to memory of 2680 2720 f76629a.exe 30 PID 2680 wrote to memory of 3008 2680 rundll32.exe 32 PID 2680 wrote to memory of 3008 2680 rundll32.exe 32 PID 2680 wrote to memory of 3008 2680 rundll32.exe 32 PID 2680 wrote to memory of 3008 2680 rundll32.exe 32 PID 2680 wrote to memory of 3028 2680 rundll32.exe 33 PID 2680 wrote to memory of 3028 2680 rundll32.exe 33 PID 2680 wrote to memory of 3028 2680 rundll32.exe 33 PID 2680 wrote to memory of 3028 2680 rundll32.exe 33 PID 2720 wrote to memory of 1116 2720 f76629a.exe 19 PID 2720 wrote to memory of 1168 2720 f76629a.exe 20 PID 2720 wrote to memory of 1236 2720 f76629a.exe 21 PID 2720 wrote to memory of 1636 2720 f76629a.exe 25 PID 2720 wrote to memory of 3008 2720 f76629a.exe 32 PID 2720 wrote to memory of 3008 2720 f76629a.exe 32 PID 2720 wrote to memory of 3028 2720 f76629a.exe 33 PID 2720 wrote to memory of 3028 2720 f76629a.exe 33 PID 3028 wrote to memory of 1116 3028 f768102.exe 19 PID 3028 wrote to memory of 1168 3028 f768102.exe 20 PID 3028 wrote to memory of 1236 3028 f768102.exe 21 PID 3028 wrote to memory of 1636 3028 f768102.exe 25 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76629a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f768102.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1116
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1168
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1236
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9a744510aa6c98a2a9880c76bebfd2d7cb2b4abd11a92823a7b1d3d9ba51d831.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9a744510aa6c98a2a9880c76bebfd2d7cb2b4abd11a92823a7b1d3d9ba51d831.dll,#13⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\f76629a.exeC:\Users\Admin\AppData\Local\Temp\f76629a.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2720
-
-
C:\Users\Admin\AppData\Local\Temp\f76646e.exeC:\Users\Admin\AppData\Local\Temp\f76646e.exe4⤵
- Executes dropped EXE
PID:3008
-
-
C:\Users\Admin\AppData\Local\Temp\f768102.exeC:\Users\Admin\AppData\Local\Temp\f768102.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3028
-
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1636
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD5292443baea40d7bc5d1c6a5c6dc6ce93
SHA1bb45eb2765f3383095e2813c211c826483f3a783
SHA2564547f4f23d0ca273907be6af29199916432b96edef4ed74c440a6906cf181c31
SHA51236aedc9b58477b76b77200a4977efad072ef09a3672bb94163206723bbb6b4c53a080efe7286086a136ec945828766e6db60fa85c23aef544c2eda6173a72770
-
Filesize
257B
MD58b768d2a34c8ef9d1584b990a2082df2
SHA1bbbdfa82682b8924b9d6ce587bc033dce0149dca
SHA2567d5ea554465ceb27a1a67d55ef84190269b4cc4a90376b029418c445e3f49b2f
SHA512498c54f09bfe5c498cdf6ee2de14ed3739485faed9e308fad31e1462a2441aa8b9aa484637577aaf8a201b3c13fd75d9876d6ddd37f0fc84f93737e9e0190457