Analysis
-
max time kernel
95s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
17-12-2024 18:22
Static task
static1
Behavioral task
behavioral1
Sample
dd99f4d2b50d85e626b5792a8dc4b92255df56bb26bbb5f1fa9dfc0e716aa740N.dll
Resource
win7-20240903-en
General
-
Target
dd99f4d2b50d85e626b5792a8dc4b92255df56bb26bbb5f1fa9dfc0e716aa740N.dll
-
Size
120KB
-
MD5
ef592a3b9b69390316239bf5d8f11df0
-
SHA1
ae504a1dc3cb39ca5bb8701384dd160f1e7e852f
-
SHA256
dd99f4d2b50d85e626b5792a8dc4b92255df56bb26bbb5f1fa9dfc0e716aa740
-
SHA512
0167362e1db5e6ea2f1b12116a99cc96fdd13824616836f7346d77ea6c34d547f6922797298fa45deb14e2191d0d0250fc01c5edf3439fbc69dfd95de723be78
-
SSDEEP
1536:BHJPA12494n6e7Gt4nZvIbl9g+9SeJglqe3w52SBfLyMBzp8y0Tj9EEAo:BZuvWGt4Ib/hMAiqM4Bf2W3do
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e57690a.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e57690a.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e57690a.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57690a.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57690a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57690a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57690a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57690a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57690a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57690a.exe -
Executes dropped EXE 4 IoCs
pid Process 4328 e57690a.exe 2300 e576ac0.exe 1044 e5784ff.exe 468 e57853d.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57690a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57690a.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e57690a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57690a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57690a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57690a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57690a.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57690a.exe -
Enumerates connected drives 3 TTPs 12 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: e57690a.exe File opened (read-only) \??\I: e57690a.exe File opened (read-only) \??\J: e57690a.exe File opened (read-only) \??\K: e57690a.exe File opened (read-only) \??\O: e57690a.exe File opened (read-only) \??\P: e57690a.exe File opened (read-only) \??\Q: e57690a.exe File opened (read-only) \??\G: e57690a.exe File opened (read-only) \??\H: e57690a.exe File opened (read-only) \??\L: e57690a.exe File opened (read-only) \??\M: e57690a.exe File opened (read-only) \??\N: e57690a.exe -
resource yara_rule behavioral2/memory/4328-6-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/4328-10-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/4328-11-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/4328-12-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/4328-8-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/4328-9-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/4328-26-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/4328-27-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/4328-33-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/4328-18-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/4328-35-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/4328-36-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/4328-37-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/4328-38-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/4328-39-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/4328-41-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/4328-53-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/4328-58-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/4328-60-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/4328-74-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/4328-75-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/4328-77-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/4328-79-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/4328-82-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/4328-83-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/4328-85-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/4328-86-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/4328-87-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/4328-92-0x00000000007B0000-0x000000000186A000-memory.dmp upx -
Drops file in Program Files directory 3 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\7z.exe e57690a.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe e57690a.exe File opened for modification C:\Program Files\7-Zip\7zG.exe e57690a.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\e576997 e57690a.exe File opened for modification C:\Windows\SYSTEM.INI e57690a.exe -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e57690a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e576ac0.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e5784ff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e57853d.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4328 e57690a.exe 4328 e57690a.exe 4328 e57690a.exe 4328 e57690a.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4328 e57690a.exe Token: SeDebugPrivilege 4328 e57690a.exe Token: SeDebugPrivilege 4328 e57690a.exe Token: SeDebugPrivilege 4328 e57690a.exe Token: SeDebugPrivilege 4328 e57690a.exe Token: SeDebugPrivilege 4328 e57690a.exe Token: SeDebugPrivilege 4328 e57690a.exe Token: SeDebugPrivilege 4328 e57690a.exe Token: SeDebugPrivilege 4328 e57690a.exe Token: SeDebugPrivilege 4328 e57690a.exe Token: SeDebugPrivilege 4328 e57690a.exe Token: SeDebugPrivilege 4328 e57690a.exe Token: SeDebugPrivilege 4328 e57690a.exe Token: SeDebugPrivilege 4328 e57690a.exe Token: SeDebugPrivilege 4328 e57690a.exe Token: SeDebugPrivilege 4328 e57690a.exe Token: SeDebugPrivilege 4328 e57690a.exe Token: SeDebugPrivilege 4328 e57690a.exe Token: SeDebugPrivilege 4328 e57690a.exe Token: SeDebugPrivilege 4328 e57690a.exe Token: SeDebugPrivilege 4328 e57690a.exe Token: SeDebugPrivilege 4328 e57690a.exe Token: SeDebugPrivilege 4328 e57690a.exe Token: SeDebugPrivilege 4328 e57690a.exe Token: SeDebugPrivilege 4328 e57690a.exe Token: SeDebugPrivilege 4328 e57690a.exe Token: SeDebugPrivilege 4328 e57690a.exe Token: SeDebugPrivilege 4328 e57690a.exe Token: SeDebugPrivilege 4328 e57690a.exe Token: SeDebugPrivilege 4328 e57690a.exe Token: SeDebugPrivilege 4328 e57690a.exe Token: SeDebugPrivilege 4328 e57690a.exe Token: SeDebugPrivilege 4328 e57690a.exe Token: SeDebugPrivilege 4328 e57690a.exe Token: SeDebugPrivilege 4328 e57690a.exe Token: SeDebugPrivilege 4328 e57690a.exe Token: SeDebugPrivilege 4328 e57690a.exe Token: SeDebugPrivilege 4328 e57690a.exe Token: SeDebugPrivilege 4328 e57690a.exe Token: SeDebugPrivilege 4328 e57690a.exe Token: SeDebugPrivilege 4328 e57690a.exe Token: SeDebugPrivilege 4328 e57690a.exe Token: SeDebugPrivilege 4328 e57690a.exe Token: SeDebugPrivilege 4328 e57690a.exe Token: SeDebugPrivilege 4328 e57690a.exe Token: SeDebugPrivilege 4328 e57690a.exe Token: SeDebugPrivilege 4328 e57690a.exe Token: SeDebugPrivilege 4328 e57690a.exe Token: SeDebugPrivilege 4328 e57690a.exe Token: SeDebugPrivilege 4328 e57690a.exe Token: SeDebugPrivilege 4328 e57690a.exe Token: SeDebugPrivilege 4328 e57690a.exe Token: SeDebugPrivilege 4328 e57690a.exe Token: SeDebugPrivilege 4328 e57690a.exe Token: SeDebugPrivilege 4328 e57690a.exe Token: SeDebugPrivilege 4328 e57690a.exe Token: SeDebugPrivilege 4328 e57690a.exe Token: SeDebugPrivilege 4328 e57690a.exe Token: SeDebugPrivilege 4328 e57690a.exe Token: SeDebugPrivilege 4328 e57690a.exe Token: SeDebugPrivilege 4328 e57690a.exe Token: SeDebugPrivilege 4328 e57690a.exe Token: SeDebugPrivilege 4328 e57690a.exe Token: SeDebugPrivilege 4328 e57690a.exe -
Suspicious use of WriteProcessMemory 55 IoCs
description pid Process procid_target PID 2344 wrote to memory of 748 2344 rundll32.exe 83 PID 2344 wrote to memory of 748 2344 rundll32.exe 83 PID 2344 wrote to memory of 748 2344 rundll32.exe 83 PID 748 wrote to memory of 4328 748 rundll32.exe 84 PID 748 wrote to memory of 4328 748 rundll32.exe 84 PID 748 wrote to memory of 4328 748 rundll32.exe 84 PID 4328 wrote to memory of 756 4328 e57690a.exe 8 PID 4328 wrote to memory of 764 4328 e57690a.exe 9 PID 4328 wrote to memory of 316 4328 e57690a.exe 13 PID 4328 wrote to memory of 2900 4328 e57690a.exe 50 PID 4328 wrote to memory of 3056 4328 e57690a.exe 52 PID 4328 wrote to memory of 916 4328 e57690a.exe 53 PID 4328 wrote to memory of 3432 4328 e57690a.exe 56 PID 4328 wrote to memory of 3568 4328 e57690a.exe 57 PID 4328 wrote to memory of 3776 4328 e57690a.exe 58 PID 4328 wrote to memory of 3864 4328 e57690a.exe 59 PID 4328 wrote to memory of 3928 4328 e57690a.exe 60 PID 4328 wrote to memory of 4012 4328 e57690a.exe 61 PID 4328 wrote to memory of 432 4328 e57690a.exe 62 PID 4328 wrote to memory of 4920 4328 e57690a.exe 75 PID 4328 wrote to memory of 412 4328 e57690a.exe 76 PID 4328 wrote to memory of 2788 4328 e57690a.exe 81 PID 4328 wrote to memory of 2344 4328 e57690a.exe 82 PID 4328 wrote to memory of 748 4328 e57690a.exe 83 PID 4328 wrote to memory of 748 4328 e57690a.exe 83 PID 748 wrote to memory of 2300 748 rundll32.exe 85 PID 748 wrote to memory of 2300 748 rundll32.exe 85 PID 748 wrote to memory of 2300 748 rundll32.exe 85 PID 748 wrote to memory of 1044 748 rundll32.exe 86 PID 748 wrote to memory of 1044 748 rundll32.exe 86 PID 748 wrote to memory of 1044 748 rundll32.exe 86 PID 748 wrote to memory of 468 748 rundll32.exe 87 PID 748 wrote to memory of 468 748 rundll32.exe 87 PID 748 wrote to memory of 468 748 rundll32.exe 87 PID 4328 wrote to memory of 756 4328 e57690a.exe 8 PID 4328 wrote to memory of 764 4328 e57690a.exe 9 PID 4328 wrote to memory of 316 4328 e57690a.exe 13 PID 4328 wrote to memory of 2900 4328 e57690a.exe 50 PID 4328 wrote to memory of 3056 4328 e57690a.exe 52 PID 4328 wrote to memory of 916 4328 e57690a.exe 53 PID 4328 wrote to memory of 3432 4328 e57690a.exe 56 PID 4328 wrote to memory of 3568 4328 e57690a.exe 57 PID 4328 wrote to memory of 3776 4328 e57690a.exe 58 PID 4328 wrote to memory of 3864 4328 e57690a.exe 59 PID 4328 wrote to memory of 3928 4328 e57690a.exe 60 PID 4328 wrote to memory of 4012 4328 e57690a.exe 61 PID 4328 wrote to memory of 432 4328 e57690a.exe 62 PID 4328 wrote to memory of 4920 4328 e57690a.exe 75 PID 4328 wrote to memory of 412 4328 e57690a.exe 76 PID 4328 wrote to memory of 2300 4328 e57690a.exe 85 PID 4328 wrote to memory of 2300 4328 e57690a.exe 85 PID 4328 wrote to memory of 1044 4328 e57690a.exe 86 PID 4328 wrote to memory of 1044 4328 e57690a.exe 86 PID 4328 wrote to memory of 468 4328 e57690a.exe 87 PID 4328 wrote to memory of 468 4328 e57690a.exe 87 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57690a.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:756
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:764
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:316
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2900
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:3056
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:916
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3432
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\dd99f4d2b50d85e626b5792a8dc4b92255df56bb26bbb5f1fa9dfc0e716aa740N.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\dd99f4d2b50d85e626b5792a8dc4b92255df56bb26bbb5f1fa9dfc0e716aa740N.dll,#13⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:748 -
C:\Users\Admin\AppData\Local\Temp\e57690a.exeC:\Users\Admin\AppData\Local\Temp\e57690a.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4328
-
-
C:\Users\Admin\AppData\Local\Temp\e576ac0.exeC:\Users\Admin\AppData\Local\Temp\e576ac0.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2300
-
-
C:\Users\Admin\AppData\Local\Temp\e5784ff.exeC:\Users\Admin\AppData\Local\Temp\e5784ff.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1044
-
-
C:\Users\Admin\AppData\Local\Temp\e57853d.exeC:\Users\Admin\AppData\Local\Temp\e57853d.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:468
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3568
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3776
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3864
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3928
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4012
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:432
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:4920
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:412
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:2788
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD53229e5fd6f89ef823fcc4d70cc9f3ece
SHA1aa9e498b365891f893f64e7643c440a65107f9e5
SHA25640f1752cc468baa0c6275d107df617e13c6d421710bdb18d81087ffaef3662e1
SHA512136760d409e23121904ff71b7177ec4d5d0aacc42dd877aeeaadb2ff3ab9a7bf85ccea4d441c4e683ee57cccc2d83fb2e7edfbab8ccc63b38e821405e2a1a498