Analysis
-
max time kernel
93s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
18-12-2024 00:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c42d1ef850fad9273171894a47cf43a3e9fe5b97f74931b59aa577bdb7bc94c6.exe
Resource
win7-20240903-en
windows7-x64
15 signatures
150 seconds
General
-
Target
c42d1ef850fad9273171894a47cf43a3e9fe5b97f74931b59aa577bdb7bc94c6.exe
-
Size
806KB
-
MD5
d270e440a391f8cc2611e688e183a7f6
-
SHA1
35e2b912f059f9749236d4b66d0ea7b75bdf0c2b
-
SHA256
c42d1ef850fad9273171894a47cf43a3e9fe5b97f74931b59aa577bdb7bc94c6
-
SHA512
714ab13a29412bcb10839057b478c7d75bec74ebf267a31c565c60bcc8c3a4955e503571ccac42c3c361c1daaac6b164e125ffb6d0b4f3e4d5eaf2ddebc4c649
-
SSDEEP
12288:qITsqgmDWSpR+GqW1gOSJVSKdet5RVu5ihnYQspCp9qWvX9fRBN4pI:qIXgCWSpRyWdSJVDsVu5unzqWvX194S
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" c42d1ef850fad9273171894a47cf43a3e9fe5b97f74931b59aa577bdb7bc94c6.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" c42d1ef850fad9273171894a47cf43a3e9fe5b97f74931b59aa577bdb7bc94c6.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" c42d1ef850fad9273171894a47cf43a3e9fe5b97f74931b59aa577bdb7bc94c6.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" c42d1ef850fad9273171894a47cf43a3e9fe5b97f74931b59aa577bdb7bc94c6.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" c42d1ef850fad9273171894a47cf43a3e9fe5b97f74931b59aa577bdb7bc94c6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" c42d1ef850fad9273171894a47cf43a3e9fe5b97f74931b59aa577bdb7bc94c6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" c42d1ef850fad9273171894a47cf43a3e9fe5b97f74931b59aa577bdb7bc94c6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" c42d1ef850fad9273171894a47cf43a3e9fe5b97f74931b59aa577bdb7bc94c6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" c42d1ef850fad9273171894a47cf43a3e9fe5b97f74931b59aa577bdb7bc94c6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" c42d1ef850fad9273171894a47cf43a3e9fe5b97f74931b59aa577bdb7bc94c6.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" c42d1ef850fad9273171894a47cf43a3e9fe5b97f74931b59aa577bdb7bc94c6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" c42d1ef850fad9273171894a47cf43a3e9fe5b97f74931b59aa577bdb7bc94c6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" c42d1ef850fad9273171894a47cf43a3e9fe5b97f74931b59aa577bdb7bc94c6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" c42d1ef850fad9273171894a47cf43a3e9fe5b97f74931b59aa577bdb7bc94c6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" c42d1ef850fad9273171894a47cf43a3e9fe5b97f74931b59aa577bdb7bc94c6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" c42d1ef850fad9273171894a47cf43a3e9fe5b97f74931b59aa577bdb7bc94c6.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc c42d1ef850fad9273171894a47cf43a3e9fe5b97f74931b59aa577bdb7bc94c6.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" c42d1ef850fad9273171894a47cf43a3e9fe5b97f74931b59aa577bdb7bc94c6.exe -
resource yara_rule behavioral2/memory/1692-1-0x00000000023C0000-0x000000000347A000-memory.dmp upx behavioral2/memory/1692-6-0x00000000023C0000-0x000000000347A000-memory.dmp upx behavioral2/memory/1692-7-0x00000000023C0000-0x000000000347A000-memory.dmp upx behavioral2/memory/1692-13-0x00000000023C0000-0x000000000347A000-memory.dmp upx behavioral2/memory/1692-5-0x00000000023C0000-0x000000000347A000-memory.dmp upx behavioral2/memory/1692-4-0x00000000023C0000-0x000000000347A000-memory.dmp upx behavioral2/memory/1692-3-0x00000000023C0000-0x000000000347A000-memory.dmp upx -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\e579cdc c42d1ef850fad9273171894a47cf43a3e9fe5b97f74931b59aa577bdb7bc94c6.exe File opened for modification C:\Windows\SYSTEM.INI c42d1ef850fad9273171894a47cf43a3e9fe5b97f74931b59aa577bdb7bc94c6.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c42d1ef850fad9273171894a47cf43a3e9fe5b97f74931b59aa577bdb7bc94c6.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1692 c42d1ef850fad9273171894a47cf43a3e9fe5b97f74931b59aa577bdb7bc94c6.exe 1692 c42d1ef850fad9273171894a47cf43a3e9fe5b97f74931b59aa577bdb7bc94c6.exe -
Suspicious use of AdjustPrivilegeToken 63 IoCs
description pid Process Token: SeDebugPrivilege 1692 c42d1ef850fad9273171894a47cf43a3e9fe5b97f74931b59aa577bdb7bc94c6.exe Token: SeDebugPrivilege 1692 c42d1ef850fad9273171894a47cf43a3e9fe5b97f74931b59aa577bdb7bc94c6.exe Token: SeDebugPrivilege 1692 c42d1ef850fad9273171894a47cf43a3e9fe5b97f74931b59aa577bdb7bc94c6.exe Token: SeDebugPrivilege 1692 c42d1ef850fad9273171894a47cf43a3e9fe5b97f74931b59aa577bdb7bc94c6.exe Token: SeDebugPrivilege 1692 c42d1ef850fad9273171894a47cf43a3e9fe5b97f74931b59aa577bdb7bc94c6.exe Token: SeDebugPrivilege 1692 c42d1ef850fad9273171894a47cf43a3e9fe5b97f74931b59aa577bdb7bc94c6.exe Token: SeDebugPrivilege 1692 c42d1ef850fad9273171894a47cf43a3e9fe5b97f74931b59aa577bdb7bc94c6.exe Token: SeDebugPrivilege 1692 c42d1ef850fad9273171894a47cf43a3e9fe5b97f74931b59aa577bdb7bc94c6.exe Token: SeDebugPrivilege 1692 c42d1ef850fad9273171894a47cf43a3e9fe5b97f74931b59aa577bdb7bc94c6.exe Token: SeDebugPrivilege 1692 c42d1ef850fad9273171894a47cf43a3e9fe5b97f74931b59aa577bdb7bc94c6.exe Token: SeDebugPrivilege 1692 c42d1ef850fad9273171894a47cf43a3e9fe5b97f74931b59aa577bdb7bc94c6.exe Token: SeDebugPrivilege 1692 c42d1ef850fad9273171894a47cf43a3e9fe5b97f74931b59aa577bdb7bc94c6.exe Token: SeDebugPrivilege 1692 c42d1ef850fad9273171894a47cf43a3e9fe5b97f74931b59aa577bdb7bc94c6.exe Token: SeDebugPrivilege 1692 c42d1ef850fad9273171894a47cf43a3e9fe5b97f74931b59aa577bdb7bc94c6.exe Token: SeDebugPrivilege 1692 c42d1ef850fad9273171894a47cf43a3e9fe5b97f74931b59aa577bdb7bc94c6.exe Token: SeDebugPrivilege 1692 c42d1ef850fad9273171894a47cf43a3e9fe5b97f74931b59aa577bdb7bc94c6.exe Token: SeDebugPrivilege 1692 c42d1ef850fad9273171894a47cf43a3e9fe5b97f74931b59aa577bdb7bc94c6.exe Token: SeDebugPrivilege 1692 c42d1ef850fad9273171894a47cf43a3e9fe5b97f74931b59aa577bdb7bc94c6.exe Token: SeDebugPrivilege 1692 c42d1ef850fad9273171894a47cf43a3e9fe5b97f74931b59aa577bdb7bc94c6.exe Token: SeDebugPrivilege 1692 c42d1ef850fad9273171894a47cf43a3e9fe5b97f74931b59aa577bdb7bc94c6.exe Token: SeDebugPrivilege 1692 c42d1ef850fad9273171894a47cf43a3e9fe5b97f74931b59aa577bdb7bc94c6.exe Token: SeDebugPrivilege 1692 c42d1ef850fad9273171894a47cf43a3e9fe5b97f74931b59aa577bdb7bc94c6.exe Token: SeDebugPrivilege 1692 c42d1ef850fad9273171894a47cf43a3e9fe5b97f74931b59aa577bdb7bc94c6.exe Token: SeDebugPrivilege 1692 c42d1ef850fad9273171894a47cf43a3e9fe5b97f74931b59aa577bdb7bc94c6.exe Token: SeDebugPrivilege 1692 c42d1ef850fad9273171894a47cf43a3e9fe5b97f74931b59aa577bdb7bc94c6.exe Token: SeDebugPrivilege 1692 c42d1ef850fad9273171894a47cf43a3e9fe5b97f74931b59aa577bdb7bc94c6.exe Token: SeDebugPrivilege 1692 c42d1ef850fad9273171894a47cf43a3e9fe5b97f74931b59aa577bdb7bc94c6.exe Token: SeDebugPrivilege 1692 c42d1ef850fad9273171894a47cf43a3e9fe5b97f74931b59aa577bdb7bc94c6.exe Token: SeDebugPrivilege 1692 c42d1ef850fad9273171894a47cf43a3e9fe5b97f74931b59aa577bdb7bc94c6.exe Token: SeDebugPrivilege 1692 c42d1ef850fad9273171894a47cf43a3e9fe5b97f74931b59aa577bdb7bc94c6.exe Token: SeDebugPrivilege 1692 c42d1ef850fad9273171894a47cf43a3e9fe5b97f74931b59aa577bdb7bc94c6.exe Token: SeDebugPrivilege 1692 c42d1ef850fad9273171894a47cf43a3e9fe5b97f74931b59aa577bdb7bc94c6.exe Token: SeDebugPrivilege 1692 c42d1ef850fad9273171894a47cf43a3e9fe5b97f74931b59aa577bdb7bc94c6.exe Token: SeDebugPrivilege 1692 c42d1ef850fad9273171894a47cf43a3e9fe5b97f74931b59aa577bdb7bc94c6.exe Token: SeDebugPrivilege 1692 c42d1ef850fad9273171894a47cf43a3e9fe5b97f74931b59aa577bdb7bc94c6.exe Token: SeDebugPrivilege 1692 c42d1ef850fad9273171894a47cf43a3e9fe5b97f74931b59aa577bdb7bc94c6.exe Token: SeDebugPrivilege 1692 c42d1ef850fad9273171894a47cf43a3e9fe5b97f74931b59aa577bdb7bc94c6.exe Token: SeDebugPrivilege 1692 c42d1ef850fad9273171894a47cf43a3e9fe5b97f74931b59aa577bdb7bc94c6.exe Token: SeDebugPrivilege 1692 c42d1ef850fad9273171894a47cf43a3e9fe5b97f74931b59aa577bdb7bc94c6.exe Token: SeDebugPrivilege 1692 c42d1ef850fad9273171894a47cf43a3e9fe5b97f74931b59aa577bdb7bc94c6.exe Token: SeDebugPrivilege 1692 c42d1ef850fad9273171894a47cf43a3e9fe5b97f74931b59aa577bdb7bc94c6.exe Token: SeDebugPrivilege 1692 c42d1ef850fad9273171894a47cf43a3e9fe5b97f74931b59aa577bdb7bc94c6.exe Token: SeDebugPrivilege 1692 c42d1ef850fad9273171894a47cf43a3e9fe5b97f74931b59aa577bdb7bc94c6.exe Token: SeDebugPrivilege 1692 c42d1ef850fad9273171894a47cf43a3e9fe5b97f74931b59aa577bdb7bc94c6.exe Token: SeDebugPrivilege 1692 c42d1ef850fad9273171894a47cf43a3e9fe5b97f74931b59aa577bdb7bc94c6.exe Token: SeDebugPrivilege 1692 c42d1ef850fad9273171894a47cf43a3e9fe5b97f74931b59aa577bdb7bc94c6.exe Token: SeDebugPrivilege 1692 c42d1ef850fad9273171894a47cf43a3e9fe5b97f74931b59aa577bdb7bc94c6.exe Token: SeDebugPrivilege 1692 c42d1ef850fad9273171894a47cf43a3e9fe5b97f74931b59aa577bdb7bc94c6.exe Token: SeDebugPrivilege 1692 c42d1ef850fad9273171894a47cf43a3e9fe5b97f74931b59aa577bdb7bc94c6.exe Token: SeDebugPrivilege 1692 c42d1ef850fad9273171894a47cf43a3e9fe5b97f74931b59aa577bdb7bc94c6.exe Token: SeDebugPrivilege 1692 c42d1ef850fad9273171894a47cf43a3e9fe5b97f74931b59aa577bdb7bc94c6.exe Token: SeDebugPrivilege 1692 c42d1ef850fad9273171894a47cf43a3e9fe5b97f74931b59aa577bdb7bc94c6.exe Token: SeDebugPrivilege 1692 c42d1ef850fad9273171894a47cf43a3e9fe5b97f74931b59aa577bdb7bc94c6.exe Token: SeDebugPrivilege 1692 c42d1ef850fad9273171894a47cf43a3e9fe5b97f74931b59aa577bdb7bc94c6.exe Token: SeDebugPrivilege 1692 c42d1ef850fad9273171894a47cf43a3e9fe5b97f74931b59aa577bdb7bc94c6.exe Token: SeDebugPrivilege 1692 c42d1ef850fad9273171894a47cf43a3e9fe5b97f74931b59aa577bdb7bc94c6.exe Token: SeDebugPrivilege 1692 c42d1ef850fad9273171894a47cf43a3e9fe5b97f74931b59aa577bdb7bc94c6.exe Token: SeDebugPrivilege 1692 c42d1ef850fad9273171894a47cf43a3e9fe5b97f74931b59aa577bdb7bc94c6.exe Token: SeDebugPrivilege 1692 c42d1ef850fad9273171894a47cf43a3e9fe5b97f74931b59aa577bdb7bc94c6.exe Token: SeDebugPrivilege 1692 c42d1ef850fad9273171894a47cf43a3e9fe5b97f74931b59aa577bdb7bc94c6.exe Token: SeDebugPrivilege 1692 c42d1ef850fad9273171894a47cf43a3e9fe5b97f74931b59aa577bdb7bc94c6.exe Token: SeDebugPrivilege 1692 c42d1ef850fad9273171894a47cf43a3e9fe5b97f74931b59aa577bdb7bc94c6.exe Token: SeDebugPrivilege 1692 c42d1ef850fad9273171894a47cf43a3e9fe5b97f74931b59aa577bdb7bc94c6.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 1692 wrote to memory of 796 1692 c42d1ef850fad9273171894a47cf43a3e9fe5b97f74931b59aa577bdb7bc94c6.exe 8 PID 1692 wrote to memory of 804 1692 c42d1ef850fad9273171894a47cf43a3e9fe5b97f74931b59aa577bdb7bc94c6.exe 9 PID 1692 wrote to memory of 376 1692 c42d1ef850fad9273171894a47cf43a3e9fe5b97f74931b59aa577bdb7bc94c6.exe 13 PID 1692 wrote to memory of 2552 1692 c42d1ef850fad9273171894a47cf43a3e9fe5b97f74931b59aa577bdb7bc94c6.exe 42 PID 1692 wrote to memory of 2580 1692 c42d1ef850fad9273171894a47cf43a3e9fe5b97f74931b59aa577bdb7bc94c6.exe 43 PID 1692 wrote to memory of 2660 1692 c42d1ef850fad9273171894a47cf43a3e9fe5b97f74931b59aa577bdb7bc94c6.exe 45 PID 1692 wrote to memory of 3452 1692 c42d1ef850fad9273171894a47cf43a3e9fe5b97f74931b59aa577bdb7bc94c6.exe 56 PID 1692 wrote to memory of 3620 1692 c42d1ef850fad9273171894a47cf43a3e9fe5b97f74931b59aa577bdb7bc94c6.exe 57 PID 1692 wrote to memory of 3836 1692 c42d1ef850fad9273171894a47cf43a3e9fe5b97f74931b59aa577bdb7bc94c6.exe 58 PID 1692 wrote to memory of 3928 1692 c42d1ef850fad9273171894a47cf43a3e9fe5b97f74931b59aa577bdb7bc94c6.exe 59 PID 1692 wrote to memory of 3992 1692 c42d1ef850fad9273171894a47cf43a3e9fe5b97f74931b59aa577bdb7bc94c6.exe 60 PID 1692 wrote to memory of 4088 1692 c42d1ef850fad9273171894a47cf43a3e9fe5b97f74931b59aa577bdb7bc94c6.exe 61 PID 1692 wrote to memory of 3676 1692 c42d1ef850fad9273171894a47cf43a3e9fe5b97f74931b59aa577bdb7bc94c6.exe 62 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" c42d1ef850fad9273171894a47cf43a3e9fe5b97f74931b59aa577bdb7bc94c6.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:796
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:804
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:376
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2552
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2580
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2660
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3452
-
C:\Users\Admin\AppData\Local\Temp\c42d1ef850fad9273171894a47cf43a3e9fe5b97f74931b59aa577bdb7bc94c6.exe"C:\Users\Admin\AppData\Local\Temp\c42d1ef850fad9273171894a47cf43a3e9fe5b97f74931b59aa577bdb7bc94c6.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1692
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3620
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3836
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3928
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3992
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4088
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3676
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5