Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
16-12-2024 01:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
006f32bb212509e7dbf8ba6db959d854c77571acdc143b4fc1018564a3a2933cN.dll
Resource
win7-20240903-en
windows7-x64
17 signatures
120 seconds
General
-
Target
006f32bb212509e7dbf8ba6db959d854c77571acdc143b4fc1018564a3a2933cN.dll
-
Size
120KB
-
MD5
29ba3a8632df23709ffa81806af34dc0
-
SHA1
9c88d9b48c08bf0a45dbde821e1fe22f9e6e8ae9
-
SHA256
006f32bb212509e7dbf8ba6db959d854c77571acdc143b4fc1018564a3a2933c
-
SHA512
eafedc574b5aa9cf36564aefa4c389e3bae2025f66445dc27414282c2144caf74816bbb88638051fa4db6bcc278751455b55628596b38d62ed3f588fe0f4cdb6
-
SSDEEP
1536:B6+rRG6gWmiSBW1004mo9f2hro5gpvrphYMvBJti/Vjgpx9p6f:BtdDgRc1004pGro5uvr3Y6B6/ls4f
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f76e8aa.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f770722.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f770722.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f770722.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f76e8aa.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f76e8aa.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76e8aa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f770722.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76e8aa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76e8aa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f770722.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f770722.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f770722.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76e8aa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76e8aa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76e8aa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f770722.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f770722.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f770722.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76e8aa.exe -
Executes dropped EXE 3 IoCs
pid Process 2712 f76e8aa.exe 984 f76ea8e.exe 664 f770722.exe -
Loads dropped DLL 6 IoCs
pid Process 2800 rundll32.exe 2800 rundll32.exe 2800 rundll32.exe 2800 rundll32.exe 2800 rundll32.exe 2800 rundll32.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f770722.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f770722.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f770722.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f770722.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76e8aa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76e8aa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f770722.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f770722.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76e8aa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76e8aa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76e8aa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f770722.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76e8aa.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f76e8aa.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76e8aa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f770722.exe -
Enumerates connected drives 3 TTPs 18 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: f76e8aa.exe File opened (read-only) \??\N: f76e8aa.exe File opened (read-only) \??\P: f76e8aa.exe File opened (read-only) \??\Q: f76e8aa.exe File opened (read-only) \??\J: f76e8aa.exe File opened (read-only) \??\R: f76e8aa.exe File opened (read-only) \??\E: f770722.exe File opened (read-only) \??\H: f76e8aa.exe File opened (read-only) \??\K: f76e8aa.exe File opened (read-only) \??\L: f76e8aa.exe File opened (read-only) \??\T: f76e8aa.exe File opened (read-only) \??\G: f770722.exe File opened (read-only) \??\H: f770722.exe File opened (read-only) \??\G: f76e8aa.exe File opened (read-only) \??\I: f76e8aa.exe File opened (read-only) \??\M: f76e8aa.exe File opened (read-only) \??\O: f76e8aa.exe File opened (read-only) \??\S: f76e8aa.exe -
resource yara_rule behavioral1/memory/2712-20-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/2712-22-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/2712-19-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/2712-17-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/2712-25-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/2712-24-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/2712-23-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/2712-21-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/2712-18-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/2712-26-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/2712-62-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/2712-68-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/2712-69-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/2712-63-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/2712-70-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/2712-72-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/2712-73-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/2712-74-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/2712-75-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/2712-89-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/2712-92-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/2712-91-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/2712-157-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/664-169-0x0000000000950000-0x0000000001A0A000-memory.dmp upx behavioral1/memory/664-215-0x0000000000950000-0x0000000001A0A000-memory.dmp upx -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\f76e908 f76e8aa.exe File opened for modification C:\Windows\SYSTEM.INI f76e8aa.exe File created C:\Windows\f7739c6 f770722.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f76e8aa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f770722.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2712 f76e8aa.exe 2712 f76e8aa.exe 664 f770722.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeDebugPrivilege 2712 f76e8aa.exe Token: SeDebugPrivilege 2712 f76e8aa.exe Token: SeDebugPrivilege 2712 f76e8aa.exe Token: SeDebugPrivilege 2712 f76e8aa.exe Token: SeDebugPrivilege 2712 f76e8aa.exe Token: SeDebugPrivilege 2712 f76e8aa.exe Token: SeDebugPrivilege 2712 f76e8aa.exe Token: SeDebugPrivilege 2712 f76e8aa.exe Token: SeDebugPrivilege 2712 f76e8aa.exe Token: SeDebugPrivilege 2712 f76e8aa.exe Token: SeDebugPrivilege 2712 f76e8aa.exe Token: SeDebugPrivilege 2712 f76e8aa.exe Token: SeDebugPrivilege 2712 f76e8aa.exe Token: SeDebugPrivilege 2712 f76e8aa.exe Token: SeDebugPrivilege 2712 f76e8aa.exe Token: SeDebugPrivilege 2712 f76e8aa.exe Token: SeDebugPrivilege 2712 f76e8aa.exe Token: SeDebugPrivilege 2712 f76e8aa.exe Token: SeDebugPrivilege 2712 f76e8aa.exe Token: SeDebugPrivilege 2712 f76e8aa.exe Token: SeDebugPrivilege 2712 f76e8aa.exe Token: SeDebugPrivilege 2712 f76e8aa.exe Token: SeDebugPrivilege 2712 f76e8aa.exe Token: SeDebugPrivilege 2712 f76e8aa.exe Token: SeDebugPrivilege 664 f770722.exe Token: SeDebugPrivilege 664 f770722.exe Token: SeDebugPrivilege 664 f770722.exe Token: SeDebugPrivilege 664 f770722.exe Token: SeDebugPrivilege 664 f770722.exe Token: SeDebugPrivilege 664 f770722.exe Token: SeDebugPrivilege 664 f770722.exe Token: SeDebugPrivilege 664 f770722.exe Token: SeDebugPrivilege 664 f770722.exe Token: SeDebugPrivilege 664 f770722.exe Token: SeDebugPrivilege 664 f770722.exe Token: SeDebugPrivilege 664 f770722.exe Token: SeDebugPrivilege 664 f770722.exe Token: SeDebugPrivilege 664 f770722.exe Token: SeDebugPrivilege 664 f770722.exe Token: SeDebugPrivilege 664 f770722.exe Token: SeDebugPrivilege 664 f770722.exe Token: SeDebugPrivilege 664 f770722.exe Token: SeDebugPrivilege 664 f770722.exe Token: SeDebugPrivilege 664 f770722.exe Token: SeDebugPrivilege 664 f770722.exe Token: SeDebugPrivilege 664 f770722.exe -
Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 2788 wrote to memory of 2800 2788 rundll32.exe 31 PID 2788 wrote to memory of 2800 2788 rundll32.exe 31 PID 2788 wrote to memory of 2800 2788 rundll32.exe 31 PID 2788 wrote to memory of 2800 2788 rundll32.exe 31 PID 2788 wrote to memory of 2800 2788 rundll32.exe 31 PID 2788 wrote to memory of 2800 2788 rundll32.exe 31 PID 2788 wrote to memory of 2800 2788 rundll32.exe 31 PID 2800 wrote to memory of 2712 2800 rundll32.exe 32 PID 2800 wrote to memory of 2712 2800 rundll32.exe 32 PID 2800 wrote to memory of 2712 2800 rundll32.exe 32 PID 2800 wrote to memory of 2712 2800 rundll32.exe 32 PID 2712 wrote to memory of 1104 2712 f76e8aa.exe 19 PID 2712 wrote to memory of 1156 2712 f76e8aa.exe 20 PID 2712 wrote to memory of 1196 2712 f76e8aa.exe 21 PID 2712 wrote to memory of 304 2712 f76e8aa.exe 23 PID 2712 wrote to memory of 2788 2712 f76e8aa.exe 30 PID 2712 wrote to memory of 2800 2712 f76e8aa.exe 31 PID 2712 wrote to memory of 2800 2712 f76e8aa.exe 31 PID 2800 wrote to memory of 984 2800 rundll32.exe 33 PID 2800 wrote to memory of 984 2800 rundll32.exe 33 PID 2800 wrote to memory of 984 2800 rundll32.exe 33 PID 2800 wrote to memory of 984 2800 rundll32.exe 33 PID 2800 wrote to memory of 664 2800 rundll32.exe 34 PID 2800 wrote to memory of 664 2800 rundll32.exe 34 PID 2800 wrote to memory of 664 2800 rundll32.exe 34 PID 2800 wrote to memory of 664 2800 rundll32.exe 34 PID 2712 wrote to memory of 1104 2712 f76e8aa.exe 19 PID 2712 wrote to memory of 1156 2712 f76e8aa.exe 20 PID 2712 wrote to memory of 1196 2712 f76e8aa.exe 21 PID 2712 wrote to memory of 304 2712 f76e8aa.exe 23 PID 2712 wrote to memory of 984 2712 f76e8aa.exe 33 PID 2712 wrote to memory of 984 2712 f76e8aa.exe 33 PID 2712 wrote to memory of 664 2712 f76e8aa.exe 34 PID 2712 wrote to memory of 664 2712 f76e8aa.exe 34 PID 664 wrote to memory of 1104 664 f770722.exe 19 PID 664 wrote to memory of 1156 664 f770722.exe 20 PID 664 wrote to memory of 1196 664 f770722.exe 21 PID 664 wrote to memory of 304 664 f770722.exe 23 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76e8aa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f770722.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1104
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1156
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1196
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\006f32bb212509e7dbf8ba6db959d854c77571acdc143b4fc1018564a3a2933cN.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\006f32bb212509e7dbf8ba6db959d854c77571acdc143b4fc1018564a3a2933cN.dll,#13⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\f76e8aa.exeC:\Users\Admin\AppData\Local\Temp\f76e8aa.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2712
-
-
C:\Users\Admin\AppData\Local\Temp\f76ea8e.exeC:\Users\Admin\AppData\Local\Temp\f76ea8e.exe4⤵
- Executes dropped EXE
PID:984
-
-
C:\Users\Admin\AppData\Local\Temp\f770722.exeC:\Users\Admin\AppData\Local\Temp\f770722.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:664
-
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:304
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD5bfb455933d70bbbaad3120808443a87f
SHA12027d4d3134ad3fafcfbacc520bb1968dddfced8
SHA2564d1415af712c655e031e9263e61524aab23d9d4f7575462da24f7f43c548bea8
SHA51250db4c244f39840fc659b680d4e0aa5adf1be097d6ef3a9cc16cbba86821c202bd61d79742b2e3ce8c898bf7cf73fe8ba849da9825e1b988161561c1786eff1a
-
Filesize
256B
MD5b4a63902e395a22524b9a300c4b5dc3b
SHA17eca37f2a0b6c37407d837d13cd54caf5085775a
SHA2565dfc9b6920f0fee84d7ac2ab63895ee1581cede80df545d8be0b66969ce51b44
SHA512c38e708241509077be3dc2e659a4626edaaf9eb346f0f50b3eaa377b189452eb3b97def6683eb4aefc22dedfaec7a103a65a56dd7fb9d1dbf15715136e2450e9