Analysis
-
max time kernel
28s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
16-12-2024 16:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3d93211837be824834c409a3f7539e3d5ce22d8fb1a8179555befe2e0b6dd3baN.dll
Resource
win7-20240729-en
windows7-x64
17 signatures
120 seconds
General
-
Target
3d93211837be824834c409a3f7539e3d5ce22d8fb1a8179555befe2e0b6dd3baN.dll
-
Size
120KB
-
MD5
0c4a116fc620b012ac790d5a6e98be90
-
SHA1
cf172028a24a62abe88a9d93acd7f46b16bd7e6d
-
SHA256
3d93211837be824834c409a3f7539e3d5ce22d8fb1a8179555befe2e0b6dd3ba
-
SHA512
ba341f43d573d5655eb1525dbec4a219580565165036d4b639b675fc5f76ae4c031654d30b493d2043f14bf67b6cf1c2f8eed633efdf02fe6552a87bca3aa828
-
SSDEEP
3072:2fpCIotX4cGchu1yaUP3eBpKwggnFEOTw6WUEHl7B:2fYNB40JFApMOTw6WUEHl7
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f76cb5a.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f76cb5a.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f76cb5a.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f76c977.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f76c977.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f76c977.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76c977.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76cb5a.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76cb5a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76cb5a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76cb5a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76cb5a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76cb5a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76c977.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76c977.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76c977.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76c977.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76cb5a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76c977.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76c977.exe -
Executes dropped EXE 3 IoCs
pid Process 2132 f76c977.exe 2840 f76cb5a.exe 2060 f76e80e.exe -
Loads dropped DLL 6 IoCs
pid Process 1896 rundll32.exe 1896 rundll32.exe 1896 rundll32.exe 1896 rundll32.exe 1896 rundll32.exe 1896 rundll32.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76cb5a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76c977.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76c977.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76c977.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76c977.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76c977.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f76cb5a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76cb5a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76cb5a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76cb5a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76c977.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f76c977.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76cb5a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76cb5a.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76c977.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76cb5a.exe -
Enumerates connected drives 3 TTPs 15 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: f76c977.exe File opened (read-only) \??\I: f76c977.exe File opened (read-only) \??\R: f76c977.exe File opened (read-only) \??\T: f76c977.exe File opened (read-only) \??\O: f76c977.exe File opened (read-only) \??\S: f76c977.exe File opened (read-only) \??\G: f76c977.exe File opened (read-only) \??\J: f76c977.exe File opened (read-only) \??\K: f76c977.exe File opened (read-only) \??\L: f76c977.exe File opened (read-only) \??\M: f76c977.exe File opened (read-only) \??\N: f76c977.exe File opened (read-only) \??\P: f76c977.exe File opened (read-only) \??\Q: f76c977.exe File opened (read-only) \??\E: f76c977.exe -
resource yara_rule behavioral1/memory/2132-11-0x00000000006B0000-0x000000000176A000-memory.dmp upx behavioral1/memory/2132-17-0x00000000006B0000-0x000000000176A000-memory.dmp upx behavioral1/memory/2132-13-0x00000000006B0000-0x000000000176A000-memory.dmp upx behavioral1/memory/2132-14-0x00000000006B0000-0x000000000176A000-memory.dmp upx behavioral1/memory/2132-16-0x00000000006B0000-0x000000000176A000-memory.dmp upx behavioral1/memory/2132-15-0x00000000006B0000-0x000000000176A000-memory.dmp upx behavioral1/memory/2132-21-0x00000000006B0000-0x000000000176A000-memory.dmp upx behavioral1/memory/2132-20-0x00000000006B0000-0x000000000176A000-memory.dmp upx behavioral1/memory/2132-19-0x00000000006B0000-0x000000000176A000-memory.dmp upx behavioral1/memory/2132-18-0x00000000006B0000-0x000000000176A000-memory.dmp upx behavioral1/memory/2132-61-0x00000000006B0000-0x000000000176A000-memory.dmp upx behavioral1/memory/2132-63-0x00000000006B0000-0x000000000176A000-memory.dmp upx behavioral1/memory/2132-64-0x00000000006B0000-0x000000000176A000-memory.dmp upx behavioral1/memory/2132-62-0x00000000006B0000-0x000000000176A000-memory.dmp upx behavioral1/memory/2132-65-0x00000000006B0000-0x000000000176A000-memory.dmp upx behavioral1/memory/2132-67-0x00000000006B0000-0x000000000176A000-memory.dmp upx behavioral1/memory/2132-68-0x00000000006B0000-0x000000000176A000-memory.dmp upx behavioral1/memory/2132-70-0x00000000006B0000-0x000000000176A000-memory.dmp upx behavioral1/memory/2132-69-0x00000000006B0000-0x000000000176A000-memory.dmp upx behavioral1/memory/2132-86-0x00000000006B0000-0x000000000176A000-memory.dmp upx behavioral1/memory/2132-87-0x00000000006B0000-0x000000000176A000-memory.dmp upx behavioral1/memory/2132-104-0x00000000006B0000-0x000000000176A000-memory.dmp upx behavioral1/memory/2132-150-0x00000000006B0000-0x000000000176A000-memory.dmp upx behavioral1/memory/2840-162-0x0000000000910000-0x00000000019CA000-memory.dmp upx behavioral1/memory/2840-192-0x0000000000910000-0x00000000019CA000-memory.dmp upx -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\f76c9d4 f76c977.exe File opened for modification C:\Windows\SYSTEM.INI f76c977.exe File created C:\Windows\f771a64 f76cb5a.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f76c977.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f76cb5a.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2132 f76c977.exe 2132 f76c977.exe 2840 f76cb5a.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeDebugPrivilege 2132 f76c977.exe Token: SeDebugPrivilege 2132 f76c977.exe Token: SeDebugPrivilege 2132 f76c977.exe Token: SeDebugPrivilege 2132 f76c977.exe Token: SeDebugPrivilege 2132 f76c977.exe Token: SeDebugPrivilege 2132 f76c977.exe Token: SeDebugPrivilege 2132 f76c977.exe Token: SeDebugPrivilege 2132 f76c977.exe Token: SeDebugPrivilege 2132 f76c977.exe Token: SeDebugPrivilege 2132 f76c977.exe Token: SeDebugPrivilege 2132 f76c977.exe Token: SeDebugPrivilege 2132 f76c977.exe Token: SeDebugPrivilege 2132 f76c977.exe Token: SeDebugPrivilege 2132 f76c977.exe Token: SeDebugPrivilege 2132 f76c977.exe Token: SeDebugPrivilege 2132 f76c977.exe Token: SeDebugPrivilege 2132 f76c977.exe Token: SeDebugPrivilege 2132 f76c977.exe Token: SeDebugPrivilege 2132 f76c977.exe Token: SeDebugPrivilege 2132 f76c977.exe Token: SeDebugPrivilege 2132 f76c977.exe Token: SeDebugPrivilege 2132 f76c977.exe Token: SeDebugPrivilege 2132 f76c977.exe Token: SeDebugPrivilege 2132 f76c977.exe Token: SeDebugPrivilege 2840 f76cb5a.exe Token: SeDebugPrivilege 2840 f76cb5a.exe Token: SeDebugPrivilege 2840 f76cb5a.exe Token: SeDebugPrivilege 2840 f76cb5a.exe Token: SeDebugPrivilege 2840 f76cb5a.exe Token: SeDebugPrivilege 2840 f76cb5a.exe Token: SeDebugPrivilege 2840 f76cb5a.exe Token: SeDebugPrivilege 2840 f76cb5a.exe Token: SeDebugPrivilege 2840 f76cb5a.exe Token: SeDebugPrivilege 2840 f76cb5a.exe Token: SeDebugPrivilege 2840 f76cb5a.exe Token: SeDebugPrivilege 2840 f76cb5a.exe Token: SeDebugPrivilege 2840 f76cb5a.exe Token: SeDebugPrivilege 2840 f76cb5a.exe Token: SeDebugPrivilege 2840 f76cb5a.exe Token: SeDebugPrivilege 2840 f76cb5a.exe Token: SeDebugPrivilege 2840 f76cb5a.exe Token: SeDebugPrivilege 2840 f76cb5a.exe Token: SeDebugPrivilege 2840 f76cb5a.exe Token: SeDebugPrivilege 2840 f76cb5a.exe Token: SeDebugPrivilege 2840 f76cb5a.exe Token: SeDebugPrivilege 2840 f76cb5a.exe -
Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 2172 wrote to memory of 1896 2172 rundll32.exe 30 PID 2172 wrote to memory of 1896 2172 rundll32.exe 30 PID 2172 wrote to memory of 1896 2172 rundll32.exe 30 PID 2172 wrote to memory of 1896 2172 rundll32.exe 30 PID 2172 wrote to memory of 1896 2172 rundll32.exe 30 PID 2172 wrote to memory of 1896 2172 rundll32.exe 30 PID 2172 wrote to memory of 1896 2172 rundll32.exe 30 PID 1896 wrote to memory of 2132 1896 rundll32.exe 31 PID 1896 wrote to memory of 2132 1896 rundll32.exe 31 PID 1896 wrote to memory of 2132 1896 rundll32.exe 31 PID 1896 wrote to memory of 2132 1896 rundll32.exe 31 PID 2132 wrote to memory of 1124 2132 f76c977.exe 19 PID 2132 wrote to memory of 1196 2132 f76c977.exe 20 PID 2132 wrote to memory of 1264 2132 f76c977.exe 21 PID 2132 wrote to memory of 1744 2132 f76c977.exe 23 PID 2132 wrote to memory of 2172 2132 f76c977.exe 29 PID 2132 wrote to memory of 1896 2132 f76c977.exe 30 PID 2132 wrote to memory of 1896 2132 f76c977.exe 30 PID 1896 wrote to memory of 2840 1896 rundll32.exe 32 PID 1896 wrote to memory of 2840 1896 rundll32.exe 32 PID 1896 wrote to memory of 2840 1896 rundll32.exe 32 PID 1896 wrote to memory of 2840 1896 rundll32.exe 32 PID 1896 wrote to memory of 2060 1896 rundll32.exe 34 PID 1896 wrote to memory of 2060 1896 rundll32.exe 34 PID 1896 wrote to memory of 2060 1896 rundll32.exe 34 PID 1896 wrote to memory of 2060 1896 rundll32.exe 34 PID 2132 wrote to memory of 1124 2132 f76c977.exe 19 PID 2132 wrote to memory of 1196 2132 f76c977.exe 20 PID 2132 wrote to memory of 1264 2132 f76c977.exe 21 PID 2132 wrote to memory of 1744 2132 f76c977.exe 23 PID 2132 wrote to memory of 2840 2132 f76c977.exe 32 PID 2132 wrote to memory of 2840 2132 f76c977.exe 32 PID 2132 wrote to memory of 2060 2132 f76c977.exe 34 PID 2132 wrote to memory of 2060 2132 f76c977.exe 34 PID 2840 wrote to memory of 1124 2840 f76cb5a.exe 19 PID 2840 wrote to memory of 1196 2840 f76cb5a.exe 20 PID 2840 wrote to memory of 1264 2840 f76cb5a.exe 21 PID 2840 wrote to memory of 1744 2840 f76cb5a.exe 23 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76c977.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76cb5a.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1124
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1196
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1264
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3d93211837be824834c409a3f7539e3d5ce22d8fb1a8179555befe2e0b6dd3baN.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3d93211837be824834c409a3f7539e3d5ce22d8fb1a8179555befe2e0b6dd3baN.dll,#13⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1896 -
C:\Users\Admin\AppData\Local\Temp\f76c977.exeC:\Users\Admin\AppData\Local\Temp\f76c977.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2132
-
-
C:\Users\Admin\AppData\Local\Temp\f76cb5a.exeC:\Users\Admin\AppData\Local\Temp\f76cb5a.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2840
-
-
C:\Users\Admin\AppData\Local\Temp\f76e80e.exeC:\Users\Admin\AppData\Local\Temp\f76e80e.exe4⤵
- Executes dropped EXE
PID:2060
-
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1744
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD59aa7ce882bc2c08cfb213cad3de13d1a
SHA101f2a3166f087ec5abd6237a75b4d49e0ac10163
SHA25688db79831bc924acbcd9bc855f1cf9420a37c02233eaa0e7cb1257ba113ca951
SHA5124bc1720490e101dd955ac38833930e665f7a27a9854d63b2ef8cb82144268b8a5a38c93070cea3f225d46219ab6ebd9407f11bb5a0af3ef042f1bdc976624f24
-
Filesize
257B
MD5785e1ccd16793ec083df5f067a63777d
SHA1b58e1e7dd94cf63a690a36a65e946fc65c8204ee
SHA256cec1008b6507bbc3be2151ab34572f1c5c71fb8882e1b9dc8e3977c7295e9b35
SHA512ebcf339ec41904b2213000399c6e6023b1ded7d19cbc29855c505e53141a4b16d301908a43cff36adc3172b17a907ebbc5a864009fe58a79bf2d22951a68f69c