Analysis
-
max time kernel
27s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
18-12-2024 22:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9040a657901436fed2c37e9ee5d268924c1785ecbb5e3a40b8e629025cbf1338.dll
Resource
win7-20241010-en
windows7-x64
17 signatures
120 seconds
General
-
Target
9040a657901436fed2c37e9ee5d268924c1785ecbb5e3a40b8e629025cbf1338.dll
-
Size
120KB
-
MD5
734415e0581cc9c8816c9ed1a48b213b
-
SHA1
1a9530a4db6e6c3abe79904199807f77954764af
-
SHA256
9040a657901436fed2c37e9ee5d268924c1785ecbb5e3a40b8e629025cbf1338
-
SHA512
634519ac70f522e10f6dae51444e40d0ff47c80386c228d2c1478d9f56c72bcf761db2bac52fd8d789d8de8e8ca460d1546cd999467716b1327a976015c54ae7
-
SSDEEP
1536:E0O6HgE563cIYzfa1ZR7uvM3dBDUMmLs65xDhiqYXMTg8/mNlGs5U6NlUTDJFJ:nO6Ai6PZbdBg665xDUcF/mrR5jN6JFJ
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f76b09a.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f76b09a.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f76b09a.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f76cc35.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f76cc35.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f76cc35.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76b09a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76cc35.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76b09a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76cc35.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76cc35.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76cc35.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76b09a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76b09a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76b09a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76cc35.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76cc35.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76cc35.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76b09a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76b09a.exe -
Executes dropped EXE 3 IoCs
pid Process 2312 f76b09a.exe 2304 f76b27d.exe 2672 f76cc35.exe -
Loads dropped DLL 6 IoCs
pid Process 1600 rundll32.exe 1600 rundll32.exe 1600 rundll32.exe 1600 rundll32.exe 1600 rundll32.exe 1600 rundll32.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f76cc35.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76b09a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76b09a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76cc35.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76b09a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76b09a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76cc35.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76b09a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76cc35.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76cc35.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76cc35.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76cc35.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76b09a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f76b09a.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76b09a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76cc35.exe -
Enumerates connected drives 3 TTPs 17 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: f76b09a.exe File opened (read-only) \??\J: f76b09a.exe File opened (read-only) \??\L: f76b09a.exe File opened (read-only) \??\M: f76b09a.exe File opened (read-only) \??\I: f76b09a.exe File opened (read-only) \??\O: f76b09a.exe File opened (read-only) \??\T: f76b09a.exe File opened (read-only) \??\G: f76b09a.exe File opened (read-only) \??\H: f76b09a.exe File opened (read-only) \??\N: f76b09a.exe File opened (read-only) \??\R: f76b09a.exe File opened (read-only) \??\S: f76b09a.exe File opened (read-only) \??\E: f76cc35.exe File opened (read-only) \??\G: f76cc35.exe File opened (read-only) \??\K: f76b09a.exe File opened (read-only) \??\P: f76b09a.exe File opened (read-only) \??\Q: f76b09a.exe -
resource yara_rule behavioral1/memory/2312-14-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2312-17-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2312-19-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2312-21-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2312-20-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2312-18-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2312-16-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2312-15-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2312-13-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2312-11-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2312-61-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2312-60-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2312-62-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2312-63-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2312-64-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2312-66-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2312-67-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2312-83-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2312-84-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2312-85-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2312-156-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2672-168-0x0000000000910000-0x00000000019CA000-memory.dmp upx behavioral1/memory/2672-208-0x0000000000910000-0x00000000019CA000-memory.dmp upx -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\f76b0f7 f76b09a.exe File opened for modification C:\Windows\SYSTEM.INI f76b09a.exe File created C:\Windows\f770139 f76cc35.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f76b09a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f76cc35.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2312 f76b09a.exe 2312 f76b09a.exe 2672 f76cc35.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeDebugPrivilege 2312 f76b09a.exe Token: SeDebugPrivilege 2312 f76b09a.exe Token: SeDebugPrivilege 2312 f76b09a.exe Token: SeDebugPrivilege 2312 f76b09a.exe Token: SeDebugPrivilege 2312 f76b09a.exe Token: SeDebugPrivilege 2312 f76b09a.exe Token: SeDebugPrivilege 2312 f76b09a.exe Token: SeDebugPrivilege 2312 f76b09a.exe Token: SeDebugPrivilege 2312 f76b09a.exe Token: SeDebugPrivilege 2312 f76b09a.exe Token: SeDebugPrivilege 2312 f76b09a.exe Token: SeDebugPrivilege 2312 f76b09a.exe Token: SeDebugPrivilege 2312 f76b09a.exe Token: SeDebugPrivilege 2312 f76b09a.exe Token: SeDebugPrivilege 2312 f76b09a.exe Token: SeDebugPrivilege 2312 f76b09a.exe Token: SeDebugPrivilege 2312 f76b09a.exe Token: SeDebugPrivilege 2312 f76b09a.exe Token: SeDebugPrivilege 2312 f76b09a.exe Token: SeDebugPrivilege 2312 f76b09a.exe Token: SeDebugPrivilege 2312 f76b09a.exe Token: SeDebugPrivilege 2312 f76b09a.exe Token: SeDebugPrivilege 2312 f76b09a.exe Token: SeDebugPrivilege 2312 f76b09a.exe Token: SeDebugPrivilege 2672 f76cc35.exe Token: SeDebugPrivilege 2672 f76cc35.exe Token: SeDebugPrivilege 2672 f76cc35.exe Token: SeDebugPrivilege 2672 f76cc35.exe Token: SeDebugPrivilege 2672 f76cc35.exe Token: SeDebugPrivilege 2672 f76cc35.exe Token: SeDebugPrivilege 2672 f76cc35.exe Token: SeDebugPrivilege 2672 f76cc35.exe Token: SeDebugPrivilege 2672 f76cc35.exe Token: SeDebugPrivilege 2672 f76cc35.exe Token: SeDebugPrivilege 2672 f76cc35.exe Token: SeDebugPrivilege 2672 f76cc35.exe Token: SeDebugPrivilege 2672 f76cc35.exe Token: SeDebugPrivilege 2672 f76cc35.exe Token: SeDebugPrivilege 2672 f76cc35.exe Token: SeDebugPrivilege 2672 f76cc35.exe Token: SeDebugPrivilege 2672 f76cc35.exe Token: SeDebugPrivilege 2672 f76cc35.exe Token: SeDebugPrivilege 2672 f76cc35.exe Token: SeDebugPrivilege 2672 f76cc35.exe Token: SeDebugPrivilege 2672 f76cc35.exe Token: SeDebugPrivilege 2672 f76cc35.exe -
Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 1304 wrote to memory of 1600 1304 rundll32.exe 30 PID 1304 wrote to memory of 1600 1304 rundll32.exe 30 PID 1304 wrote to memory of 1600 1304 rundll32.exe 30 PID 1304 wrote to memory of 1600 1304 rundll32.exe 30 PID 1304 wrote to memory of 1600 1304 rundll32.exe 30 PID 1304 wrote to memory of 1600 1304 rundll32.exe 30 PID 1304 wrote to memory of 1600 1304 rundll32.exe 30 PID 1600 wrote to memory of 2312 1600 rundll32.exe 31 PID 1600 wrote to memory of 2312 1600 rundll32.exe 31 PID 1600 wrote to memory of 2312 1600 rundll32.exe 31 PID 1600 wrote to memory of 2312 1600 rundll32.exe 31 PID 2312 wrote to memory of 1100 2312 f76b09a.exe 19 PID 2312 wrote to memory of 1148 2312 f76b09a.exe 20 PID 2312 wrote to memory of 1184 2312 f76b09a.exe 21 PID 2312 wrote to memory of 2008 2312 f76b09a.exe 23 PID 2312 wrote to memory of 1304 2312 f76b09a.exe 29 PID 2312 wrote to memory of 1600 2312 f76b09a.exe 30 PID 2312 wrote to memory of 1600 2312 f76b09a.exe 30 PID 1600 wrote to memory of 2304 1600 rundll32.exe 32 PID 1600 wrote to memory of 2304 1600 rundll32.exe 32 PID 1600 wrote to memory of 2304 1600 rundll32.exe 32 PID 1600 wrote to memory of 2304 1600 rundll32.exe 32 PID 1600 wrote to memory of 2672 1600 rundll32.exe 33 PID 1600 wrote to memory of 2672 1600 rundll32.exe 33 PID 1600 wrote to memory of 2672 1600 rundll32.exe 33 PID 1600 wrote to memory of 2672 1600 rundll32.exe 33 PID 2312 wrote to memory of 1100 2312 f76b09a.exe 19 PID 2312 wrote to memory of 1148 2312 f76b09a.exe 20 PID 2312 wrote to memory of 1184 2312 f76b09a.exe 21 PID 2312 wrote to memory of 2008 2312 f76b09a.exe 23 PID 2312 wrote to memory of 2304 2312 f76b09a.exe 32 PID 2312 wrote to memory of 2304 2312 f76b09a.exe 32 PID 2312 wrote to memory of 2672 2312 f76b09a.exe 33 PID 2312 wrote to memory of 2672 2312 f76b09a.exe 33 PID 2672 wrote to memory of 1100 2672 f76cc35.exe 19 PID 2672 wrote to memory of 1148 2672 f76cc35.exe 20 PID 2672 wrote to memory of 1184 2672 f76cc35.exe 21 PID 2672 wrote to memory of 2008 2672 f76cc35.exe 23 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76b09a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76cc35.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1100
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1148
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1184
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9040a657901436fed2c37e9ee5d268924c1785ecbb5e3a40b8e629025cbf1338.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9040a657901436fed2c37e9ee5d268924c1785ecbb5e3a40b8e629025cbf1338.dll,#13⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\f76b09a.exeC:\Users\Admin\AppData\Local\Temp\f76b09a.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2312
-
-
C:\Users\Admin\AppData\Local\Temp\f76b27d.exeC:\Users\Admin\AppData\Local\Temp\f76b27d.exe4⤵
- Executes dropped EXE
PID:2304
-
-
C:\Users\Admin\AppData\Local\Temp\f76cc35.exeC:\Users\Admin\AppData\Local\Temp\f76cc35.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2672
-
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:2008
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
257B
MD575b86e93c2c96037959b73575f4acca7
SHA1255e5415fcb19995fa3fb3271d2d36ea67f01e83
SHA25624365f8fe171b26857f6e3de54e8d7b77716c58725c5dc69d6227fc988e185c2
SHA5124a53f0e789a1be18c7f8badbc1c560bb11a0aa7ecf862f9969d9b59d43b0c305aee99fe2c00fd4d4e9b3137fd403f191bf816baab0c1c74c0a7195af964891e4
-
Filesize
97KB
MD5dfce022d3fae16dea84078a6055dc248
SHA1ba7b6ba3b64d42525bab4337563cc9bb1eed4787
SHA2564bd9462bdbe07741a5aa6712377948e83a690a32bc1af9d785795902d292df15
SHA512b7f49a210497e32a55cd114fe33949e86e678bc5cbda83e3cefe4174ca4dc3aa7c2d3a6c51e7563d71a1ed55c427abb966f0da666ac2e893724e80cfae965855