Analysis
-
max time kernel
117s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
16-12-2024 07:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a2c5c5d4857654116255da02cfff15514b233d14e49caf80e4144ac930982422N.dll
Resource
win7-20240903-en
windows7-x64
17 signatures
120 seconds
General
-
Target
a2c5c5d4857654116255da02cfff15514b233d14e49caf80e4144ac930982422N.dll
-
Size
120KB
-
MD5
a8827018f7cd9d73c946dd7c902f55d0
-
SHA1
87ffb08d089bc3bb13448a71f29082ef52a88a68
-
SHA256
a2c5c5d4857654116255da02cfff15514b233d14e49caf80e4144ac930982422
-
SHA512
2481b043706b4ed747755a29616cbda75b70dbb7001eef1550f5908e99d2c808a3754884f1c9761eccbe34b8ea78ae5d0e9ec2fc57fbce44a5b429648c54756b
-
SSDEEP
1536:fcqlMQcs4Q0mS67X3wZR5aC2ndTQ/gRz0KpEbFA1WgNYY59mejj:fcVQcs4Q05LZiC2ndM/gN/oFAr59b
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f7717d4.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f7717d4.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f76f95c.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f76f95c.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f76f95c.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f7717d4.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76f95c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f7717d4.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f7717d4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76f95c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f7717d4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76f95c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76f95c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76f95c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f7717d4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f7717d4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f7717d4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76f95c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76f95c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f7717d4.exe -
Executes dropped EXE 3 IoCs
pid Process 2696 f76f95c.exe 800 f76fb21.exe 2148 f7717d4.exe -
Loads dropped DLL 6 IoCs
pid Process 2260 rundll32.exe 2260 rundll32.exe 2260 rundll32.exe 2260 rundll32.exe 2260 rundll32.exe 2260 rundll32.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76f95c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f7717d4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f7717d4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f7717d4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76f95c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f7717d4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f7717d4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76f95c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f76f95c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f7717d4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f7717d4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76f95c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76f95c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76f95c.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76f95c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f7717d4.exe -
Enumerates connected drives 3 TTPs 17 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\S: f76f95c.exe File opened (read-only) \??\H: f76f95c.exe File opened (read-only) \??\R: f76f95c.exe File opened (read-only) \??\J: f76f95c.exe File opened (read-only) \??\L: f76f95c.exe File opened (read-only) \??\M: f76f95c.exe File opened (read-only) \??\N: f76f95c.exe File opened (read-only) \??\O: f76f95c.exe File opened (read-only) \??\Q: f76f95c.exe File opened (read-only) \??\E: f76f95c.exe File opened (read-only) \??\G: f76f95c.exe File opened (read-only) \??\T: f76f95c.exe File opened (read-only) \??\E: f7717d4.exe File opened (read-only) \??\K: f76f95c.exe File opened (read-only) \??\P: f76f95c.exe File opened (read-only) \??\I: f76f95c.exe File opened (read-only) \??\G: f7717d4.exe -
resource yara_rule behavioral1/memory/2696-9-0x00000000006E0000-0x000000000179A000-memory.dmp upx behavioral1/memory/2696-17-0x00000000006E0000-0x000000000179A000-memory.dmp upx behavioral1/memory/2696-20-0x00000000006E0000-0x000000000179A000-memory.dmp upx behavioral1/memory/2696-15-0x00000000006E0000-0x000000000179A000-memory.dmp upx behavioral1/memory/2696-14-0x00000000006E0000-0x000000000179A000-memory.dmp upx behavioral1/memory/2696-18-0x00000000006E0000-0x000000000179A000-memory.dmp upx behavioral1/memory/2696-21-0x00000000006E0000-0x000000000179A000-memory.dmp upx behavioral1/memory/2696-19-0x00000000006E0000-0x000000000179A000-memory.dmp upx behavioral1/memory/2696-16-0x00000000006E0000-0x000000000179A000-memory.dmp upx behavioral1/memory/2696-22-0x00000000006E0000-0x000000000179A000-memory.dmp upx behavioral1/memory/2696-61-0x00000000006E0000-0x000000000179A000-memory.dmp upx behavioral1/memory/2696-62-0x00000000006E0000-0x000000000179A000-memory.dmp upx behavioral1/memory/2696-63-0x00000000006E0000-0x000000000179A000-memory.dmp upx behavioral1/memory/2696-64-0x00000000006E0000-0x000000000179A000-memory.dmp upx behavioral1/memory/2696-65-0x00000000006E0000-0x000000000179A000-memory.dmp upx behavioral1/memory/2696-67-0x00000000006E0000-0x000000000179A000-memory.dmp upx behavioral1/memory/2696-68-0x00000000006E0000-0x000000000179A000-memory.dmp upx behavioral1/memory/2696-69-0x00000000006E0000-0x000000000179A000-memory.dmp upx behavioral1/memory/2696-70-0x00000000006E0000-0x000000000179A000-memory.dmp upx behavioral1/memory/2696-84-0x00000000006E0000-0x000000000179A000-memory.dmp upx behavioral1/memory/2696-86-0x00000000006E0000-0x000000000179A000-memory.dmp upx behavioral1/memory/2696-105-0x00000000006E0000-0x000000000179A000-memory.dmp upx behavioral1/memory/2696-146-0x00000000006E0000-0x000000000179A000-memory.dmp upx behavioral1/memory/2148-160-0x0000000000970000-0x0000000001A2A000-memory.dmp upx behavioral1/memory/2148-202-0x0000000000970000-0x0000000001A2A000-memory.dmp upx -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\f76f9ca f76f95c.exe File opened for modification C:\Windows\SYSTEM.INI f76f95c.exe File created C:\Windows\f7749dc f7717d4.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f76f95c.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f7717d4.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2696 f76f95c.exe 2696 f76f95c.exe 2148 f7717d4.exe -
Suspicious use of AdjustPrivilegeToken 45 IoCs
description pid Process Token: SeDebugPrivilege 2696 f76f95c.exe Token: SeDebugPrivilege 2696 f76f95c.exe Token: SeDebugPrivilege 2696 f76f95c.exe Token: SeDebugPrivilege 2696 f76f95c.exe Token: SeDebugPrivilege 2696 f76f95c.exe Token: SeDebugPrivilege 2696 f76f95c.exe Token: SeDebugPrivilege 2696 f76f95c.exe Token: SeDebugPrivilege 2696 f76f95c.exe Token: SeDebugPrivilege 2696 f76f95c.exe Token: SeDebugPrivilege 2696 f76f95c.exe Token: SeDebugPrivilege 2696 f76f95c.exe Token: SeDebugPrivilege 2696 f76f95c.exe Token: SeDebugPrivilege 2696 f76f95c.exe Token: SeDebugPrivilege 2696 f76f95c.exe Token: SeDebugPrivilege 2696 f76f95c.exe Token: SeDebugPrivilege 2696 f76f95c.exe Token: SeDebugPrivilege 2696 f76f95c.exe Token: SeDebugPrivilege 2696 f76f95c.exe Token: SeDebugPrivilege 2696 f76f95c.exe Token: SeDebugPrivilege 2696 f76f95c.exe Token: SeDebugPrivilege 2696 f76f95c.exe Token: SeDebugPrivilege 2696 f76f95c.exe Token: SeDebugPrivilege 2696 f76f95c.exe Token: SeDebugPrivilege 2148 f7717d4.exe Token: SeDebugPrivilege 2148 f7717d4.exe Token: SeDebugPrivilege 2148 f7717d4.exe Token: SeDebugPrivilege 2148 f7717d4.exe Token: SeDebugPrivilege 2148 f7717d4.exe Token: SeDebugPrivilege 2148 f7717d4.exe Token: SeDebugPrivilege 2148 f7717d4.exe Token: SeDebugPrivilege 2148 f7717d4.exe Token: SeDebugPrivilege 2148 f7717d4.exe Token: SeDebugPrivilege 2148 f7717d4.exe Token: SeDebugPrivilege 2148 f7717d4.exe Token: SeDebugPrivilege 2148 f7717d4.exe Token: SeDebugPrivilege 2148 f7717d4.exe Token: SeDebugPrivilege 2148 f7717d4.exe Token: SeDebugPrivilege 2148 f7717d4.exe Token: SeDebugPrivilege 2148 f7717d4.exe Token: SeDebugPrivilege 2148 f7717d4.exe Token: SeDebugPrivilege 2148 f7717d4.exe Token: SeDebugPrivilege 2148 f7717d4.exe Token: SeDebugPrivilege 2148 f7717d4.exe Token: SeDebugPrivilege 2148 f7717d4.exe Token: SeDebugPrivilege 2148 f7717d4.exe -
Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 2644 wrote to memory of 2260 2644 rundll32.exe 30 PID 2644 wrote to memory of 2260 2644 rundll32.exe 30 PID 2644 wrote to memory of 2260 2644 rundll32.exe 30 PID 2644 wrote to memory of 2260 2644 rundll32.exe 30 PID 2644 wrote to memory of 2260 2644 rundll32.exe 30 PID 2644 wrote to memory of 2260 2644 rundll32.exe 30 PID 2644 wrote to memory of 2260 2644 rundll32.exe 30 PID 2260 wrote to memory of 2696 2260 rundll32.exe 31 PID 2260 wrote to memory of 2696 2260 rundll32.exe 31 PID 2260 wrote to memory of 2696 2260 rundll32.exe 31 PID 2260 wrote to memory of 2696 2260 rundll32.exe 31 PID 2696 wrote to memory of 1104 2696 f76f95c.exe 19 PID 2696 wrote to memory of 1172 2696 f76f95c.exe 20 PID 2696 wrote to memory of 1208 2696 f76f95c.exe 21 PID 2696 wrote to memory of 1532 2696 f76f95c.exe 23 PID 2696 wrote to memory of 2644 2696 f76f95c.exe 29 PID 2696 wrote to memory of 2260 2696 f76f95c.exe 30 PID 2696 wrote to memory of 2260 2696 f76f95c.exe 30 PID 2260 wrote to memory of 800 2260 rundll32.exe 32 PID 2260 wrote to memory of 800 2260 rundll32.exe 32 PID 2260 wrote to memory of 800 2260 rundll32.exe 32 PID 2260 wrote to memory of 800 2260 rundll32.exe 32 PID 2260 wrote to memory of 2148 2260 rundll32.exe 33 PID 2260 wrote to memory of 2148 2260 rundll32.exe 33 PID 2260 wrote to memory of 2148 2260 rundll32.exe 33 PID 2260 wrote to memory of 2148 2260 rundll32.exe 33 PID 2696 wrote to memory of 1104 2696 f76f95c.exe 19 PID 2696 wrote to memory of 1172 2696 f76f95c.exe 20 PID 2696 wrote to memory of 1208 2696 f76f95c.exe 21 PID 2696 wrote to memory of 1532 2696 f76f95c.exe 23 PID 2696 wrote to memory of 800 2696 f76f95c.exe 32 PID 2696 wrote to memory of 800 2696 f76f95c.exe 32 PID 2696 wrote to memory of 2148 2696 f76f95c.exe 33 PID 2696 wrote to memory of 2148 2696 f76f95c.exe 33 PID 2148 wrote to memory of 1104 2148 f7717d4.exe 19 PID 2148 wrote to memory of 1172 2148 f7717d4.exe 20 PID 2148 wrote to memory of 1208 2148 f7717d4.exe 21 PID 2148 wrote to memory of 1532 2148 f7717d4.exe 23 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76f95c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f7717d4.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1104
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1172
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1208
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a2c5c5d4857654116255da02cfff15514b233d14e49caf80e4144ac930982422N.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a2c5c5d4857654116255da02cfff15514b233d14e49caf80e4144ac930982422N.dll,#13⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\f76f95c.exeC:\Users\Admin\AppData\Local\Temp\f76f95c.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2696
-
-
C:\Users\Admin\AppData\Local\Temp\f76fb21.exeC:\Users\Admin\AppData\Local\Temp\f76fb21.exe4⤵
- Executes dropped EXE
PID:800
-
-
C:\Users\Admin\AppData\Local\Temp\f7717d4.exeC:\Users\Admin\AppData\Local\Temp\f7717d4.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2148
-
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1532
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD594abf21777afb8a9a699661b0254852f
SHA1245a08e48baf315257e18fc99aa747aa1077237b
SHA25650c384fe69129e7cbee131f0709102680224f39cde20e6192159c1a7a6a1faa7
SHA512212480cc4b657d0bc55718b169501545de1062a3468f75d95b0b0ee52472c3422cce7f71c6833dbc42312032db9f099e529ed6d2d8822af40464bf794a4d4e4f
-
Filesize
257B
MD56d09dcdbf2cc158dae1046e0f91184c3
SHA1533deff2faf8006d266c4d74aee3baa5fabba39f
SHA256984fec2fe9f005ea6830cec9820254690e67b105ce746a5cf381153f57b8587f
SHA512260a212ce8652bcf1a65278e9fa73e85c042c5e73a995719b44d9eaff7532d34eada2703ee7a18bce120988bd417821dfd92c4e738846734d9dda9ad02418d19