Analysis
-
max time kernel
118s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
17-12-2024 05:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
65fd351e09ca0a20dbd517680888764ab8cf9916ecd1dab75cf5ac335f0e9806.dll
Resource
win7-20240708-en
windows7-x64
17 signatures
120 seconds
General
-
Target
65fd351e09ca0a20dbd517680888764ab8cf9916ecd1dab75cf5ac335f0e9806.dll
-
Size
120KB
-
MD5
c2797e1e4689dc5737f124803c74cea8
-
SHA1
5733f6b220bfad29a6f12aca7d4be3c254f621af
-
SHA256
65fd351e09ca0a20dbd517680888764ab8cf9916ecd1dab75cf5ac335f0e9806
-
SHA512
c0cd77fd0d44ab71d26eeabac1639a4b4bf30d4b4deec23a9f74b654ab5fa33e46d863fa168f308b7db1741ba3b94510fe25295d635c329134954cd820c0ec7a
-
SSDEEP
1536:Z/3RtNTihJ1yGXoC6yXTs2BrlLqgJxNTRuCCMsbhYn1frQY2R3KlxVPf4tIeGCxX:Z5tRIVjs2BrlLhLohIfswxSO89h5
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f769aaa.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f769c4f.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f769c4f.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f769c4f.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f769aaa.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f769aaa.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f769aaa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f769c4f.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f769c4f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f769aaa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f769aaa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f769aaa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f769c4f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f769c4f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f769c4f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f769c4f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f769aaa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f769aaa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f769aaa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f769c4f.exe -
Executes dropped EXE 3 IoCs
pid Process 1932 f769aaa.exe 2796 f769c4f.exe 2632 f76b683.exe -
Loads dropped DLL 6 IoCs
pid Process 2040 rundll32.exe 2040 rundll32.exe 2040 rundll32.exe 2040 rundll32.exe 2040 rundll32.exe 2040 rundll32.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f769aaa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f769c4f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f769c4f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f769c4f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f769c4f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f769aaa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f769aaa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f769aaa.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f769aaa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f769c4f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f769c4f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f769c4f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f769aaa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f769aaa.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f769aaa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f769c4f.exe -
Enumerates connected drives 3 TTPs 14 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\S: f769aaa.exe File opened (read-only) \??\K: f769aaa.exe File opened (read-only) \??\L: f769aaa.exe File opened (read-only) \??\N: f769aaa.exe File opened (read-only) \??\Q: f769aaa.exe File opened (read-only) \??\E: f769aaa.exe File opened (read-only) \??\M: f769aaa.exe File opened (read-only) \??\O: f769aaa.exe File opened (read-only) \??\P: f769aaa.exe File opened (read-only) \??\I: f769aaa.exe File opened (read-only) \??\G: f769aaa.exe File opened (read-only) \??\H: f769aaa.exe File opened (read-only) \??\J: f769aaa.exe File opened (read-only) \??\R: f769aaa.exe -
resource yara_rule behavioral1/memory/1932-11-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/1932-14-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/1932-16-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/1932-17-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/1932-15-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/1932-13-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/1932-19-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/1932-20-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/1932-18-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/1932-21-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/1932-61-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/1932-62-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/1932-63-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/1932-64-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/1932-65-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/1932-67-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/1932-82-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/1932-83-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/1932-86-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/1932-85-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/1932-152-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2796-169-0x0000000000920000-0x00000000019DA000-memory.dmp upx behavioral1/memory/2796-190-0x0000000000920000-0x00000000019DA000-memory.dmp upx -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\f769b55 f769aaa.exe File opened for modification C:\Windows\SYSTEM.INI f769aaa.exe File created C:\Windows\f76ec14 f769c4f.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f769aaa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f769c4f.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 1932 f769aaa.exe 1932 f769aaa.exe 2796 f769c4f.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeDebugPrivilege 1932 f769aaa.exe Token: SeDebugPrivilege 1932 f769aaa.exe Token: SeDebugPrivilege 1932 f769aaa.exe Token: SeDebugPrivilege 1932 f769aaa.exe Token: SeDebugPrivilege 1932 f769aaa.exe Token: SeDebugPrivilege 1932 f769aaa.exe Token: SeDebugPrivilege 1932 f769aaa.exe Token: SeDebugPrivilege 1932 f769aaa.exe Token: SeDebugPrivilege 1932 f769aaa.exe Token: SeDebugPrivilege 1932 f769aaa.exe Token: SeDebugPrivilege 1932 f769aaa.exe Token: SeDebugPrivilege 1932 f769aaa.exe Token: SeDebugPrivilege 1932 f769aaa.exe Token: SeDebugPrivilege 1932 f769aaa.exe Token: SeDebugPrivilege 1932 f769aaa.exe Token: SeDebugPrivilege 1932 f769aaa.exe Token: SeDebugPrivilege 1932 f769aaa.exe Token: SeDebugPrivilege 1932 f769aaa.exe Token: SeDebugPrivilege 1932 f769aaa.exe Token: SeDebugPrivilege 1932 f769aaa.exe Token: SeDebugPrivilege 1932 f769aaa.exe Token: SeDebugPrivilege 1932 f769aaa.exe Token: SeDebugPrivilege 1932 f769aaa.exe Token: SeDebugPrivilege 2796 f769c4f.exe Token: SeDebugPrivilege 2796 f769c4f.exe Token: SeDebugPrivilege 2796 f769c4f.exe Token: SeDebugPrivilege 2796 f769c4f.exe Token: SeDebugPrivilege 2796 f769c4f.exe Token: SeDebugPrivilege 2796 f769c4f.exe Token: SeDebugPrivilege 2796 f769c4f.exe Token: SeDebugPrivilege 2796 f769c4f.exe Token: SeDebugPrivilege 2796 f769c4f.exe Token: SeDebugPrivilege 2796 f769c4f.exe Token: SeDebugPrivilege 2796 f769c4f.exe Token: SeDebugPrivilege 2796 f769c4f.exe Token: SeDebugPrivilege 2796 f769c4f.exe Token: SeDebugPrivilege 2796 f769c4f.exe Token: SeDebugPrivilege 2796 f769c4f.exe Token: SeDebugPrivilege 2796 f769c4f.exe Token: SeDebugPrivilege 2796 f769c4f.exe Token: SeDebugPrivilege 2796 f769c4f.exe Token: SeDebugPrivilege 2796 f769c4f.exe Token: SeDebugPrivilege 2796 f769c4f.exe Token: SeDebugPrivilege 2796 f769c4f.exe Token: SeDebugPrivilege 2796 f769c4f.exe Token: SeDebugPrivilege 2796 f769c4f.exe -
Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 1452 wrote to memory of 2040 1452 rundll32.exe 30 PID 1452 wrote to memory of 2040 1452 rundll32.exe 30 PID 1452 wrote to memory of 2040 1452 rundll32.exe 30 PID 1452 wrote to memory of 2040 1452 rundll32.exe 30 PID 1452 wrote to memory of 2040 1452 rundll32.exe 30 PID 1452 wrote to memory of 2040 1452 rundll32.exe 30 PID 1452 wrote to memory of 2040 1452 rundll32.exe 30 PID 2040 wrote to memory of 1932 2040 rundll32.exe 31 PID 2040 wrote to memory of 1932 2040 rundll32.exe 31 PID 2040 wrote to memory of 1932 2040 rundll32.exe 31 PID 2040 wrote to memory of 1932 2040 rundll32.exe 31 PID 1932 wrote to memory of 1108 1932 f769aaa.exe 19 PID 1932 wrote to memory of 1168 1932 f769aaa.exe 20 PID 1932 wrote to memory of 1204 1932 f769aaa.exe 21 PID 1932 wrote to memory of 376 1932 f769aaa.exe 25 PID 1932 wrote to memory of 1452 1932 f769aaa.exe 29 PID 1932 wrote to memory of 2040 1932 f769aaa.exe 30 PID 1932 wrote to memory of 2040 1932 f769aaa.exe 30 PID 2040 wrote to memory of 2796 2040 rundll32.exe 32 PID 2040 wrote to memory of 2796 2040 rundll32.exe 32 PID 2040 wrote to memory of 2796 2040 rundll32.exe 32 PID 2040 wrote to memory of 2796 2040 rundll32.exe 32 PID 2040 wrote to memory of 2632 2040 rundll32.exe 33 PID 2040 wrote to memory of 2632 2040 rundll32.exe 33 PID 2040 wrote to memory of 2632 2040 rundll32.exe 33 PID 2040 wrote to memory of 2632 2040 rundll32.exe 33 PID 1932 wrote to memory of 1108 1932 f769aaa.exe 19 PID 1932 wrote to memory of 1168 1932 f769aaa.exe 20 PID 1932 wrote to memory of 1204 1932 f769aaa.exe 21 PID 1932 wrote to memory of 376 1932 f769aaa.exe 25 PID 1932 wrote to memory of 2796 1932 f769aaa.exe 32 PID 1932 wrote to memory of 2796 1932 f769aaa.exe 32 PID 1932 wrote to memory of 2632 1932 f769aaa.exe 33 PID 1932 wrote to memory of 2632 1932 f769aaa.exe 33 PID 2796 wrote to memory of 1108 2796 f769c4f.exe 19 PID 2796 wrote to memory of 1168 2796 f769c4f.exe 20 PID 2796 wrote to memory of 1204 2796 f769c4f.exe 21 PID 2796 wrote to memory of 376 2796 f769c4f.exe 25 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f769aaa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f769c4f.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1108
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1168
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1204
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\65fd351e09ca0a20dbd517680888764ab8cf9916ecd1dab75cf5ac335f0e9806.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:1452 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\65fd351e09ca0a20dbd517680888764ab8cf9916ecd1dab75cf5ac335f0e9806.dll,#13⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\f769aaa.exeC:\Users\Admin\AppData\Local\Temp\f769aaa.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1932
-
-
C:\Users\Admin\AppData\Local\Temp\f769c4f.exeC:\Users\Admin\AppData\Local\Temp\f769c4f.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2796
-
-
C:\Users\Admin\AppData\Local\Temp\f76b683.exeC:\Users\Admin\AppData\Local\Temp\f76b683.exe4⤵
- Executes dropped EXE
PID:2632
-
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:376
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
257B
MD52660be1c6cb1c2c4965d4c6e37cc8dd7
SHA1324329f6b3cd229d36652aee3d37605242722b0c
SHA2569b4a63f6b85aa618c3170ba9524c44107c052e378fcbb177b9f9f8f8848d9284
SHA512509cc99192e1182678c0d67db1f11d9da3e073832b3ff5c158a5e13f5a4b18fb8496ffffd8830dff544b30c42f6d2fba282153b8c092b058e7732ee7ebfa16a0
-
Filesize
97KB
MD5ff18b62da358e811a5764c7bad021192
SHA11a85e345dce9a230dd2b048b6174225004aea398
SHA2566c7c596e093f53ed7a75d0e030306d72c823c75e6a23a6083e38090cc9c0a8c4
SHA512a5f24ce23f9ae80ff2f0ad6b6af1ec6bd16f1ed2249f14fe282abbc28a6d05160fca2de788456dd8da0a1719b6a3c51157db235f088e0df4a99ac5a50b2ccd01