Analysis
-
max time kernel
27s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
18-12-2024 00:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a338a47e555ce3b6df0223777d4a7c9886dabb83dbb31a2d70b2618d63e9110d.dll
Resource
win7-20240903-en
windows7-x64
17 signatures
120 seconds
General
-
Target
a338a47e555ce3b6df0223777d4a7c9886dabb83dbb31a2d70b2618d63e9110d.dll
-
Size
120KB
-
MD5
c850d056cc0d91ca955cdf7ccca4ac59
-
SHA1
705496d93152c25d6f4b0ddaa07fd1048e924ffa
-
SHA256
a338a47e555ce3b6df0223777d4a7c9886dabb83dbb31a2d70b2618d63e9110d
-
SHA512
3fe54507833c2b3d3f2791cf7d15d14811caf576d4e7df0cec13d238b19a439d1ad2d56ea3c4049389b02c7069379d13df98c2fba641f7265e8e731dd37a1612
-
SSDEEP
3072:1VaQc7YLD0OHwM2mq349baISXXaRT+5oWjB:s4AOHwMW34ZI+YoW1
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f76b02d.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f769482.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f769482.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f769482.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f76b02d.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f76b02d.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f769482.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76b02d.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f769482.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f769482.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76b02d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76b02d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76b02d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f769482.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f769482.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f769482.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76b02d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76b02d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76b02d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f769482.exe -
Executes dropped EXE 3 IoCs
pid Process 2100 f769482.exe 2756 f769618.exe 2648 f76b02d.exe -
Loads dropped DLL 6 IoCs
pid Process 2192 rundll32.exe 2192 rundll32.exe 2192 rundll32.exe 2192 rundll32.exe 2192 rundll32.exe 2192 rundll32.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f769482.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f769482.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f769482.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f769482.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76b02d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76b02d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76b02d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f769482.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76b02d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76b02d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f76b02d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f769482.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f769482.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76b02d.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f769482.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76b02d.exe -
Enumerates connected drives 3 TTPs 17 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\K: f769482.exe File opened (read-only) \??\Q: f769482.exe File opened (read-only) \??\E: f76b02d.exe File opened (read-only) \??\E: f769482.exe File opened (read-only) \??\J: f769482.exe File opened (read-only) \??\L: f769482.exe File opened (read-only) \??\N: f769482.exe File opened (read-only) \??\H: f769482.exe File opened (read-only) \??\I: f769482.exe File opened (read-only) \??\M: f769482.exe File opened (read-only) \??\O: f769482.exe File opened (read-only) \??\T: f769482.exe File opened (read-only) \??\G: f769482.exe File opened (read-only) \??\P: f769482.exe File opened (read-only) \??\R: f769482.exe File opened (read-only) \??\S: f769482.exe File opened (read-only) \??\G: f76b02d.exe -
resource yara_rule behavioral1/memory/2100-15-0x0000000000960000-0x0000000001A1A000-memory.dmp upx behavioral1/memory/2100-17-0x0000000000960000-0x0000000001A1A000-memory.dmp upx behavioral1/memory/2100-21-0x0000000000960000-0x0000000001A1A000-memory.dmp upx behavioral1/memory/2100-13-0x0000000000960000-0x0000000001A1A000-memory.dmp upx behavioral1/memory/2100-19-0x0000000000960000-0x0000000001A1A000-memory.dmp upx behavioral1/memory/2100-20-0x0000000000960000-0x0000000001A1A000-memory.dmp upx behavioral1/memory/2100-22-0x0000000000960000-0x0000000001A1A000-memory.dmp upx behavioral1/memory/2100-18-0x0000000000960000-0x0000000001A1A000-memory.dmp upx behavioral1/memory/2100-16-0x0000000000960000-0x0000000001A1A000-memory.dmp upx behavioral1/memory/2100-14-0x0000000000960000-0x0000000001A1A000-memory.dmp upx behavioral1/memory/2100-60-0x0000000000960000-0x0000000001A1A000-memory.dmp upx behavioral1/memory/2100-59-0x0000000000960000-0x0000000001A1A000-memory.dmp upx behavioral1/memory/2100-61-0x0000000000960000-0x0000000001A1A000-memory.dmp upx behavioral1/memory/2100-63-0x0000000000960000-0x0000000001A1A000-memory.dmp upx behavioral1/memory/2100-62-0x0000000000960000-0x0000000001A1A000-memory.dmp upx behavioral1/memory/2100-65-0x0000000000960000-0x0000000001A1A000-memory.dmp upx behavioral1/memory/2100-66-0x0000000000960000-0x0000000001A1A000-memory.dmp upx behavioral1/memory/2100-81-0x0000000000960000-0x0000000001A1A000-memory.dmp upx behavioral1/memory/2100-84-0x0000000000960000-0x0000000001A1A000-memory.dmp upx behavioral1/memory/2100-85-0x0000000000960000-0x0000000001A1A000-memory.dmp upx behavioral1/memory/2100-87-0x0000000000960000-0x0000000001A1A000-memory.dmp upx behavioral1/memory/2100-155-0x0000000000960000-0x0000000001A1A000-memory.dmp upx behavioral1/memory/2648-176-0x0000000000930000-0x00000000019EA000-memory.dmp upx behavioral1/memory/2648-208-0x0000000000930000-0x00000000019EA000-memory.dmp upx -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\f7694c1 f769482.exe File opened for modification C:\Windows\SYSTEM.INI f769482.exe File created C:\Windows\f76e512 f76b02d.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f769482.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f76b02d.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2100 f769482.exe 2100 f769482.exe 2648 f76b02d.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeDebugPrivilege 2100 f769482.exe Token: SeDebugPrivilege 2100 f769482.exe Token: SeDebugPrivilege 2100 f769482.exe Token: SeDebugPrivilege 2100 f769482.exe Token: SeDebugPrivilege 2100 f769482.exe Token: SeDebugPrivilege 2100 f769482.exe Token: SeDebugPrivilege 2100 f769482.exe Token: SeDebugPrivilege 2100 f769482.exe Token: SeDebugPrivilege 2100 f769482.exe Token: SeDebugPrivilege 2100 f769482.exe Token: SeDebugPrivilege 2100 f769482.exe Token: SeDebugPrivilege 2100 f769482.exe Token: SeDebugPrivilege 2100 f769482.exe Token: SeDebugPrivilege 2100 f769482.exe Token: SeDebugPrivilege 2100 f769482.exe Token: SeDebugPrivilege 2100 f769482.exe Token: SeDebugPrivilege 2100 f769482.exe Token: SeDebugPrivilege 2100 f769482.exe Token: SeDebugPrivilege 2100 f769482.exe Token: SeDebugPrivilege 2100 f769482.exe Token: SeDebugPrivilege 2100 f769482.exe Token: SeDebugPrivilege 2100 f769482.exe Token: SeDebugPrivilege 2100 f769482.exe Token: SeDebugPrivilege 2648 f76b02d.exe Token: SeDebugPrivilege 2648 f76b02d.exe Token: SeDebugPrivilege 2648 f76b02d.exe Token: SeDebugPrivilege 2648 f76b02d.exe Token: SeDebugPrivilege 2648 f76b02d.exe Token: SeDebugPrivilege 2648 f76b02d.exe Token: SeDebugPrivilege 2648 f76b02d.exe Token: SeDebugPrivilege 2648 f76b02d.exe Token: SeDebugPrivilege 2648 f76b02d.exe Token: SeDebugPrivilege 2648 f76b02d.exe Token: SeDebugPrivilege 2648 f76b02d.exe Token: SeDebugPrivilege 2648 f76b02d.exe Token: SeDebugPrivilege 2648 f76b02d.exe Token: SeDebugPrivilege 2648 f76b02d.exe Token: SeDebugPrivilege 2648 f76b02d.exe Token: SeDebugPrivilege 2648 f76b02d.exe Token: SeDebugPrivilege 2648 f76b02d.exe Token: SeDebugPrivilege 2648 f76b02d.exe Token: SeDebugPrivilege 2648 f76b02d.exe Token: SeDebugPrivilege 2648 f76b02d.exe Token: SeDebugPrivilege 2648 f76b02d.exe Token: SeDebugPrivilege 2648 f76b02d.exe Token: SeDebugPrivilege 2648 f76b02d.exe -
Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 1804 wrote to memory of 2192 1804 rundll32.exe 30 PID 1804 wrote to memory of 2192 1804 rundll32.exe 30 PID 1804 wrote to memory of 2192 1804 rundll32.exe 30 PID 1804 wrote to memory of 2192 1804 rundll32.exe 30 PID 1804 wrote to memory of 2192 1804 rundll32.exe 30 PID 1804 wrote to memory of 2192 1804 rundll32.exe 30 PID 1804 wrote to memory of 2192 1804 rundll32.exe 30 PID 2192 wrote to memory of 2100 2192 rundll32.exe 31 PID 2192 wrote to memory of 2100 2192 rundll32.exe 31 PID 2192 wrote to memory of 2100 2192 rundll32.exe 31 PID 2192 wrote to memory of 2100 2192 rundll32.exe 31 PID 2100 wrote to memory of 1112 2100 f769482.exe 19 PID 2100 wrote to memory of 1168 2100 f769482.exe 20 PID 2100 wrote to memory of 1208 2100 f769482.exe 21 PID 2100 wrote to memory of 1268 2100 f769482.exe 23 PID 2100 wrote to memory of 1804 2100 f769482.exe 29 PID 2100 wrote to memory of 2192 2100 f769482.exe 30 PID 2100 wrote to memory of 2192 2100 f769482.exe 30 PID 2192 wrote to memory of 2756 2192 rundll32.exe 32 PID 2192 wrote to memory of 2756 2192 rundll32.exe 32 PID 2192 wrote to memory of 2756 2192 rundll32.exe 32 PID 2192 wrote to memory of 2756 2192 rundll32.exe 32 PID 2192 wrote to memory of 2648 2192 rundll32.exe 33 PID 2192 wrote to memory of 2648 2192 rundll32.exe 33 PID 2192 wrote to memory of 2648 2192 rundll32.exe 33 PID 2192 wrote to memory of 2648 2192 rundll32.exe 33 PID 2100 wrote to memory of 1112 2100 f769482.exe 19 PID 2100 wrote to memory of 1168 2100 f769482.exe 20 PID 2100 wrote to memory of 1208 2100 f769482.exe 21 PID 2100 wrote to memory of 1268 2100 f769482.exe 23 PID 2100 wrote to memory of 2756 2100 f769482.exe 32 PID 2100 wrote to memory of 2756 2100 f769482.exe 32 PID 2100 wrote to memory of 2648 2100 f769482.exe 33 PID 2100 wrote to memory of 2648 2100 f769482.exe 33 PID 2648 wrote to memory of 1112 2648 f76b02d.exe 19 PID 2648 wrote to memory of 1168 2648 f76b02d.exe 20 PID 2648 wrote to memory of 1208 2648 f76b02d.exe 21 PID 2648 wrote to memory of 1268 2648 f76b02d.exe 23 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f769482.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76b02d.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1112
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1168
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1208
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a338a47e555ce3b6df0223777d4a7c9886dabb83dbb31a2d70b2618d63e9110d.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a338a47e555ce3b6df0223777d4a7c9886dabb83dbb31a2d70b2618d63e9110d.dll,#13⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\f769482.exeC:\Users\Admin\AppData\Local\Temp\f769482.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2100
-
-
C:\Users\Admin\AppData\Local\Temp\f769618.exeC:\Users\Admin\AppData\Local\Temp\f769618.exe4⤵
- Executes dropped EXE
PID:2756
-
-
C:\Users\Admin\AppData\Local\Temp\f76b02d.exeC:\Users\Admin\AppData\Local\Temp\f76b02d.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2648
-
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1268
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
256B
MD5427eae760f81c0804bb9a4bb33ec2680
SHA17241634c9298ba4e651cd224010c452721277995
SHA2567d784f54cb71b4b40a0fc6f251a2144ed9a238993e79a7441b5dd3b71ee194ca
SHA512b2c6c9986c21c88e235d342744948aa66bdddba6e30670ecd8b4493d64d6d1f7ad267c73e8e5638d4bfc1acf14b3c11ac893e611020e4089401df0923c3afe2c
-
Filesize
97KB
MD5d0f0188ff00e0af16ac796c8fe62404d
SHA1b41943df0049f0a2dc5385627055cdbffc0678aa
SHA256443659c41f012d0a0d0c12e03766a61033df262e7e28c3ef38bbad1f90ef9ff0
SHA512cad504fb0cd0036e7e4a919f25a186640ad20ac970c74189efe69f5322a6127ea73cf20113e1ba08c5f83e50fe2f86413e636a0ae7b0e02cf90a85cee9d46894