Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
17-12-2024 04:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
56ef628235d79e1e0ba97b5799741ce7baececa70ada39359886b8edadcd7b54.dll
Resource
win7-20240903-en
windows7-x64
17 signatures
120 seconds
General
-
Target
56ef628235d79e1e0ba97b5799741ce7baececa70ada39359886b8edadcd7b54.dll
-
Size
120KB
-
MD5
f19196937de973f9268ecd8f6ca26c8f
-
SHA1
d6d1657ad48f1bfea960e212b9432eee61c126b5
-
SHA256
56ef628235d79e1e0ba97b5799741ce7baececa70ada39359886b8edadcd7b54
-
SHA512
aa2c109a08ab5f8354133b6b50c49dbdd573b1fb8e9f1ae87a8d52fa898c80ee2f2e659db4ecf7f949519a501a4a84c4bdd8b79de4c98c648c70800130ca23e2
-
SSDEEP
3072:zdpHLGyQBVcoHoMcv0+dtsyHRd1wnEyXeed:fLW2KoMA0+dtLXOnfxd
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f76ca51.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f76ca51.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f76ca51.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f76ae78.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f76ae78.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f76ae78.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76ae78.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76ca51.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76ca51.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76ca51.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76ae78.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76ae78.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76ae78.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76ae78.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76ca51.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76ca51.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76ae78.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76ae78.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76ca51.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76ca51.exe -
Executes dropped EXE 3 IoCs
pid Process 3028 f76ae78.exe 2600 f76affe.exe 2596 f76ca51.exe -
Loads dropped DLL 6 IoCs
pid Process 2072 rundll32.exe 2072 rundll32.exe 2072 rundll32.exe 2072 rundll32.exe 2072 rundll32.exe 2072 rundll32.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f76ae78.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76ca51.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76ca51.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76ca51.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f76ca51.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76ae78.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76ca51.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76ca51.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76ca51.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76ae78.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76ae78.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76ae78.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76ae78.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76ae78.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76ae78.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76ca51.exe -
Enumerates connected drives 3 TTPs 17 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\T: f76ae78.exe File opened (read-only) \??\O: f76ae78.exe File opened (read-only) \??\N: f76ae78.exe File opened (read-only) \??\Q: f76ae78.exe File opened (read-only) \??\M: f76ae78.exe File opened (read-only) \??\I: f76ae78.exe File opened (read-only) \??\L: f76ae78.exe File opened (read-only) \??\P: f76ae78.exe File opened (read-only) \??\E: f76ca51.exe File opened (read-only) \??\G: f76ae78.exe File opened (read-only) \??\H: f76ae78.exe File opened (read-only) \??\J: f76ae78.exe File opened (read-only) \??\K: f76ae78.exe File opened (read-only) \??\R: f76ae78.exe File opened (read-only) \??\S: f76ae78.exe File opened (read-only) \??\G: f76ca51.exe File opened (read-only) \??\E: f76ae78.exe -
resource yara_rule behavioral1/memory/3028-20-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/3028-22-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/3028-19-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/3028-24-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/3028-23-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/3028-21-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/3028-18-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/3028-26-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/3028-17-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/3028-25-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/3028-62-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/3028-61-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/3028-63-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/3028-65-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/3028-64-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/3028-67-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/3028-68-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/3028-81-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/3028-83-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/3028-85-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/3028-86-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/3028-151-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/2596-167-0x00000000009A0000-0x0000000001A5A000-memory.dmp upx behavioral1/memory/2596-207-0x00000000009A0000-0x0000000001A5A000-memory.dmp upx -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\f76aea7 f76ae78.exe File opened for modification C:\Windows\SYSTEM.INI f76ae78.exe File created C:\Windows\f76ff07 f76ca51.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f76ae78.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f76ca51.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 3028 f76ae78.exe 3028 f76ae78.exe 2596 f76ca51.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeDebugPrivilege 3028 f76ae78.exe Token: SeDebugPrivilege 3028 f76ae78.exe Token: SeDebugPrivilege 3028 f76ae78.exe Token: SeDebugPrivilege 3028 f76ae78.exe Token: SeDebugPrivilege 3028 f76ae78.exe Token: SeDebugPrivilege 3028 f76ae78.exe Token: SeDebugPrivilege 3028 f76ae78.exe Token: SeDebugPrivilege 3028 f76ae78.exe Token: SeDebugPrivilege 3028 f76ae78.exe Token: SeDebugPrivilege 3028 f76ae78.exe Token: SeDebugPrivilege 3028 f76ae78.exe Token: SeDebugPrivilege 3028 f76ae78.exe Token: SeDebugPrivilege 3028 f76ae78.exe Token: SeDebugPrivilege 3028 f76ae78.exe Token: SeDebugPrivilege 3028 f76ae78.exe Token: SeDebugPrivilege 3028 f76ae78.exe Token: SeDebugPrivilege 3028 f76ae78.exe Token: SeDebugPrivilege 3028 f76ae78.exe Token: SeDebugPrivilege 3028 f76ae78.exe Token: SeDebugPrivilege 3028 f76ae78.exe Token: SeDebugPrivilege 3028 f76ae78.exe Token: SeDebugPrivilege 3028 f76ae78.exe Token: SeDebugPrivilege 3028 f76ae78.exe Token: SeDebugPrivilege 3028 f76ae78.exe Token: SeDebugPrivilege 2596 f76ca51.exe Token: SeDebugPrivilege 2596 f76ca51.exe Token: SeDebugPrivilege 2596 f76ca51.exe Token: SeDebugPrivilege 2596 f76ca51.exe Token: SeDebugPrivilege 2596 f76ca51.exe Token: SeDebugPrivilege 2596 f76ca51.exe Token: SeDebugPrivilege 2596 f76ca51.exe Token: SeDebugPrivilege 2596 f76ca51.exe Token: SeDebugPrivilege 2596 f76ca51.exe Token: SeDebugPrivilege 2596 f76ca51.exe Token: SeDebugPrivilege 2596 f76ca51.exe Token: SeDebugPrivilege 2596 f76ca51.exe Token: SeDebugPrivilege 2596 f76ca51.exe Token: SeDebugPrivilege 2596 f76ca51.exe Token: SeDebugPrivilege 2596 f76ca51.exe Token: SeDebugPrivilege 2596 f76ca51.exe Token: SeDebugPrivilege 2596 f76ca51.exe Token: SeDebugPrivilege 2596 f76ca51.exe Token: SeDebugPrivilege 2596 f76ca51.exe Token: SeDebugPrivilege 2596 f76ca51.exe Token: SeDebugPrivilege 2596 f76ca51.exe Token: SeDebugPrivilege 2596 f76ca51.exe -
Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 2384 wrote to memory of 2072 2384 rundll32.exe 30 PID 2384 wrote to memory of 2072 2384 rundll32.exe 30 PID 2384 wrote to memory of 2072 2384 rundll32.exe 30 PID 2384 wrote to memory of 2072 2384 rundll32.exe 30 PID 2384 wrote to memory of 2072 2384 rundll32.exe 30 PID 2384 wrote to memory of 2072 2384 rundll32.exe 30 PID 2384 wrote to memory of 2072 2384 rundll32.exe 30 PID 2072 wrote to memory of 3028 2072 rundll32.exe 31 PID 2072 wrote to memory of 3028 2072 rundll32.exe 31 PID 2072 wrote to memory of 3028 2072 rundll32.exe 31 PID 2072 wrote to memory of 3028 2072 rundll32.exe 31 PID 3028 wrote to memory of 1104 3028 f76ae78.exe 19 PID 3028 wrote to memory of 1160 3028 f76ae78.exe 20 PID 3028 wrote to memory of 1192 3028 f76ae78.exe 21 PID 3028 wrote to memory of 1388 3028 f76ae78.exe 23 PID 3028 wrote to memory of 2384 3028 f76ae78.exe 29 PID 3028 wrote to memory of 2072 3028 f76ae78.exe 30 PID 3028 wrote to memory of 2072 3028 f76ae78.exe 30 PID 2072 wrote to memory of 2600 2072 rundll32.exe 32 PID 2072 wrote to memory of 2600 2072 rundll32.exe 32 PID 2072 wrote to memory of 2600 2072 rundll32.exe 32 PID 2072 wrote to memory of 2600 2072 rundll32.exe 32 PID 2072 wrote to memory of 2596 2072 rundll32.exe 33 PID 2072 wrote to memory of 2596 2072 rundll32.exe 33 PID 2072 wrote to memory of 2596 2072 rundll32.exe 33 PID 2072 wrote to memory of 2596 2072 rundll32.exe 33 PID 3028 wrote to memory of 1104 3028 f76ae78.exe 19 PID 3028 wrote to memory of 1160 3028 f76ae78.exe 20 PID 3028 wrote to memory of 1192 3028 f76ae78.exe 21 PID 3028 wrote to memory of 1388 3028 f76ae78.exe 23 PID 3028 wrote to memory of 2600 3028 f76ae78.exe 32 PID 3028 wrote to memory of 2600 3028 f76ae78.exe 32 PID 3028 wrote to memory of 2596 3028 f76ae78.exe 33 PID 3028 wrote to memory of 2596 3028 f76ae78.exe 33 PID 2596 wrote to memory of 1104 2596 f76ca51.exe 19 PID 2596 wrote to memory of 1160 2596 f76ca51.exe 20 PID 2596 wrote to memory of 1192 2596 f76ca51.exe 21 PID 2596 wrote to memory of 1388 2596 f76ca51.exe 23 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76ae78.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76ca51.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1104
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1160
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1192
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\56ef628235d79e1e0ba97b5799741ce7baececa70ada39359886b8edadcd7b54.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\56ef628235d79e1e0ba97b5799741ce7baececa70ada39359886b8edadcd7b54.dll,#13⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\f76ae78.exeC:\Users\Admin\AppData\Local\Temp\f76ae78.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3028
-
-
C:\Users\Admin\AppData\Local\Temp\f76affe.exeC:\Users\Admin\AppData\Local\Temp\f76affe.exe4⤵
- Executes dropped EXE
PID:2600
-
-
C:\Users\Admin\AppData\Local\Temp\f76ca51.exeC:\Users\Admin\AppData\Local\Temp\f76ca51.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2596
-
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1388
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
257B
MD571d37cf92e8a7fc7fbcb0e48a07f6c85
SHA1d875032a6aa677145d013b2548c5b1abfa15f334
SHA256fc45e4e06105695306e4330f67f4fd12a65bb59a5f154a7da1e87fe69f1dc9ee
SHA512ced3d241bbf9c7e2df408a633bd4de7965f4093176b4851c425a4e5faf8efdbd6e1cdad53f6cc84de5a3dde9a69609300660e400e87ffbce19747e48aeea98bb
-
Filesize
97KB
MD58f70134d81bfba4f0b29f8912dcf93d3
SHA1af09ca9698e13004f4fd27f6e70cf9070885d47f
SHA25664ae92cdb27e6720e82c2382d1ff295568784d65cd4461348a463fdb107941f1
SHA512957e53ad8010021e675677f350cef699b19a909c1f5369b091f8d726e780ec21aea6d7396effbc0476aa8b46c13afaae88aee7a47d2fdeca40600f32852a53dc