Analysis
-
max time kernel
117s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
18-12-2024 01:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7f062695f926c4e2a1c2fbbb198197e396bd0125448c3386e761142a160bdfb9.dll
Resource
win7-20240903-en
windows7-x64
17 signatures
120 seconds
General
-
Target
7f062695f926c4e2a1c2fbbb198197e396bd0125448c3386e761142a160bdfb9.dll
-
Size
120KB
-
MD5
66cd8f7903ebe6b3a6ca48c69b7b5fbd
-
SHA1
85386e5417c72d77b90e3d287c88cef92b0253bf
-
SHA256
7f062695f926c4e2a1c2fbbb198197e396bd0125448c3386e761142a160bdfb9
-
SHA512
62303347daa3b6af61dd2d029efb090ef545ae5f8b30b57e0de5d21b47a550dd586c8db2bcd6d150f808404c9db00d86a2d1c48fc68d1b49a7175bcad124df36
-
SSDEEP
1536:BHJPA12494n6e7Gt4nZvIbl9g+9SeJglqe3w52SBfLyMBzp8y0Tj9EEAoP:BZuvWGt4Ib/hMAiqM4Bf2W3doP
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f76a94a.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f76a94a.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f76a94a.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f76aaef.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f76aaef.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f76aaef.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76a94a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76aaef.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76a94a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76a94a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76aaef.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76aaef.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76aaef.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76a94a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76a94a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76a94a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76aaef.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76a94a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76aaef.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76aaef.exe -
Executes dropped EXE 3 IoCs
pid Process 2376 f76a94a.exe 2624 f76aaef.exe 2660 f76c504.exe -
Loads dropped DLL 6 IoCs
pid Process 600 rundll32.exe 600 rundll32.exe 600 rundll32.exe 600 rundll32.exe 600 rundll32.exe 600 rundll32.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76a94a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76aaef.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76a94a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76aaef.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76aaef.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f76aaef.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76aaef.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76a94a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76a94a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f76a94a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76aaef.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76a94a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76a94a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76aaef.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76aaef.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76a94a.exe -
Enumerates connected drives 3 TTPs 15 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: f76a94a.exe File opened (read-only) \??\J: f76a94a.exe File opened (read-only) \??\L: f76a94a.exe File opened (read-only) \??\M: f76a94a.exe File opened (read-only) \??\Q: f76a94a.exe File opened (read-only) \??\S: f76a94a.exe File opened (read-only) \??\I: f76a94a.exe File opened (read-only) \??\N: f76a94a.exe File opened (read-only) \??\R: f76a94a.exe File opened (read-only) \??\T: f76a94a.exe File opened (read-only) \??\G: f76a94a.exe File opened (read-only) \??\H: f76a94a.exe File opened (read-only) \??\K: f76a94a.exe File opened (read-only) \??\O: f76a94a.exe File opened (read-only) \??\P: f76a94a.exe -
resource yara_rule behavioral1/memory/2376-14-0x00000000005A0000-0x000000000165A000-memory.dmp upx behavioral1/memory/2376-16-0x00000000005A0000-0x000000000165A000-memory.dmp upx behavioral1/memory/2376-17-0x00000000005A0000-0x000000000165A000-memory.dmp upx behavioral1/memory/2376-13-0x00000000005A0000-0x000000000165A000-memory.dmp upx behavioral1/memory/2376-20-0x00000000005A0000-0x000000000165A000-memory.dmp upx behavioral1/memory/2376-19-0x00000000005A0000-0x000000000165A000-memory.dmp upx behavioral1/memory/2376-22-0x00000000005A0000-0x000000000165A000-memory.dmp upx behavioral1/memory/2376-21-0x00000000005A0000-0x000000000165A000-memory.dmp upx behavioral1/memory/2376-18-0x00000000005A0000-0x000000000165A000-memory.dmp upx behavioral1/memory/2376-15-0x00000000005A0000-0x000000000165A000-memory.dmp upx behavioral1/memory/2376-64-0x00000000005A0000-0x000000000165A000-memory.dmp upx behavioral1/memory/2376-63-0x00000000005A0000-0x000000000165A000-memory.dmp upx behavioral1/memory/2376-65-0x00000000005A0000-0x000000000165A000-memory.dmp upx behavioral1/memory/2376-66-0x00000000005A0000-0x000000000165A000-memory.dmp upx behavioral1/memory/2376-67-0x00000000005A0000-0x000000000165A000-memory.dmp upx behavioral1/memory/2376-69-0x00000000005A0000-0x000000000165A000-memory.dmp upx behavioral1/memory/2376-70-0x00000000005A0000-0x000000000165A000-memory.dmp upx behavioral1/memory/2376-86-0x00000000005A0000-0x000000000165A000-memory.dmp upx behavioral1/memory/2376-89-0x00000000005A0000-0x000000000165A000-memory.dmp upx behavioral1/memory/2376-91-0x00000000005A0000-0x000000000165A000-memory.dmp upx behavioral1/memory/2376-161-0x00000000005A0000-0x000000000165A000-memory.dmp upx behavioral1/memory/2624-173-0x0000000000900000-0x00000000019BA000-memory.dmp upx behavioral1/memory/2624-199-0x0000000000900000-0x00000000019BA000-memory.dmp upx -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\f76a988 f76a94a.exe File opened for modification C:\Windows\SYSTEM.INI f76a94a.exe File created C:\Windows\f76f9aa f76aaef.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f76a94a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f76aaef.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2376 f76a94a.exe 2376 f76a94a.exe 2624 f76aaef.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeDebugPrivilege 2376 f76a94a.exe Token: SeDebugPrivilege 2376 f76a94a.exe Token: SeDebugPrivilege 2376 f76a94a.exe Token: SeDebugPrivilege 2376 f76a94a.exe Token: SeDebugPrivilege 2376 f76a94a.exe Token: SeDebugPrivilege 2376 f76a94a.exe Token: SeDebugPrivilege 2376 f76a94a.exe Token: SeDebugPrivilege 2376 f76a94a.exe Token: SeDebugPrivilege 2376 f76a94a.exe Token: SeDebugPrivilege 2376 f76a94a.exe Token: SeDebugPrivilege 2376 f76a94a.exe Token: SeDebugPrivilege 2376 f76a94a.exe Token: SeDebugPrivilege 2376 f76a94a.exe Token: SeDebugPrivilege 2376 f76a94a.exe Token: SeDebugPrivilege 2376 f76a94a.exe Token: SeDebugPrivilege 2376 f76a94a.exe Token: SeDebugPrivilege 2376 f76a94a.exe Token: SeDebugPrivilege 2376 f76a94a.exe Token: SeDebugPrivilege 2376 f76a94a.exe Token: SeDebugPrivilege 2376 f76a94a.exe Token: SeDebugPrivilege 2376 f76a94a.exe Token: SeDebugPrivilege 2376 f76a94a.exe Token: SeDebugPrivilege 2376 f76a94a.exe Token: SeDebugPrivilege 2376 f76a94a.exe Token: SeDebugPrivilege 2624 f76aaef.exe Token: SeDebugPrivilege 2624 f76aaef.exe Token: SeDebugPrivilege 2624 f76aaef.exe Token: SeDebugPrivilege 2624 f76aaef.exe Token: SeDebugPrivilege 2624 f76aaef.exe Token: SeDebugPrivilege 2624 f76aaef.exe Token: SeDebugPrivilege 2624 f76aaef.exe Token: SeDebugPrivilege 2624 f76aaef.exe Token: SeDebugPrivilege 2624 f76aaef.exe Token: SeDebugPrivilege 2624 f76aaef.exe Token: SeDebugPrivilege 2624 f76aaef.exe Token: SeDebugPrivilege 2624 f76aaef.exe Token: SeDebugPrivilege 2624 f76aaef.exe Token: SeDebugPrivilege 2624 f76aaef.exe Token: SeDebugPrivilege 2624 f76aaef.exe Token: SeDebugPrivilege 2624 f76aaef.exe Token: SeDebugPrivilege 2624 f76aaef.exe Token: SeDebugPrivilege 2624 f76aaef.exe Token: SeDebugPrivilege 2624 f76aaef.exe Token: SeDebugPrivilege 2624 f76aaef.exe Token: SeDebugPrivilege 2624 f76aaef.exe Token: SeDebugPrivilege 2624 f76aaef.exe -
Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 1924 wrote to memory of 600 1924 rundll32.exe 30 PID 1924 wrote to memory of 600 1924 rundll32.exe 30 PID 1924 wrote to memory of 600 1924 rundll32.exe 30 PID 1924 wrote to memory of 600 1924 rundll32.exe 30 PID 1924 wrote to memory of 600 1924 rundll32.exe 30 PID 1924 wrote to memory of 600 1924 rundll32.exe 30 PID 1924 wrote to memory of 600 1924 rundll32.exe 30 PID 600 wrote to memory of 2376 600 rundll32.exe 31 PID 600 wrote to memory of 2376 600 rundll32.exe 31 PID 600 wrote to memory of 2376 600 rundll32.exe 31 PID 600 wrote to memory of 2376 600 rundll32.exe 31 PID 2376 wrote to memory of 1112 2376 f76a94a.exe 19 PID 2376 wrote to memory of 1164 2376 f76a94a.exe 20 PID 2376 wrote to memory of 1192 2376 f76a94a.exe 21 PID 2376 wrote to memory of 1868 2376 f76a94a.exe 25 PID 2376 wrote to memory of 1924 2376 f76a94a.exe 29 PID 2376 wrote to memory of 600 2376 f76a94a.exe 30 PID 2376 wrote to memory of 600 2376 f76a94a.exe 30 PID 600 wrote to memory of 2624 600 rundll32.exe 32 PID 600 wrote to memory of 2624 600 rundll32.exe 32 PID 600 wrote to memory of 2624 600 rundll32.exe 32 PID 600 wrote to memory of 2624 600 rundll32.exe 32 PID 600 wrote to memory of 2660 600 rundll32.exe 33 PID 600 wrote to memory of 2660 600 rundll32.exe 33 PID 600 wrote to memory of 2660 600 rundll32.exe 33 PID 600 wrote to memory of 2660 600 rundll32.exe 33 PID 2376 wrote to memory of 1112 2376 f76a94a.exe 19 PID 2376 wrote to memory of 1164 2376 f76a94a.exe 20 PID 2376 wrote to memory of 1192 2376 f76a94a.exe 21 PID 2376 wrote to memory of 1868 2376 f76a94a.exe 25 PID 2376 wrote to memory of 2624 2376 f76a94a.exe 32 PID 2376 wrote to memory of 2624 2376 f76a94a.exe 32 PID 2376 wrote to memory of 2660 2376 f76a94a.exe 33 PID 2376 wrote to memory of 2660 2376 f76a94a.exe 33 PID 2624 wrote to memory of 1112 2624 f76aaef.exe 19 PID 2624 wrote to memory of 1164 2624 f76aaef.exe 20 PID 2624 wrote to memory of 1192 2624 f76aaef.exe 21 PID 2624 wrote to memory of 1868 2624 f76aaef.exe 25 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76a94a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76aaef.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1112
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1164
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1192
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7f062695f926c4e2a1c2fbbb198197e396bd0125448c3386e761142a160bdfb9.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7f062695f926c4e2a1c2fbbb198197e396bd0125448c3386e761142a160bdfb9.dll,#13⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:600 -
C:\Users\Admin\AppData\Local\Temp\f76a94a.exeC:\Users\Admin\AppData\Local\Temp\f76a94a.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2376
-
-
C:\Users\Admin\AppData\Local\Temp\f76aaef.exeC:\Users\Admin\AppData\Local\Temp\f76aaef.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2624
-
-
C:\Users\Admin\AppData\Local\Temp\f76c504.exeC:\Users\Admin\AppData\Local\Temp\f76c504.exe4⤵
- Executes dropped EXE
PID:2660
-
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1868
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD53229e5fd6f89ef823fcc4d70cc9f3ece
SHA1aa9e498b365891f893f64e7643c440a65107f9e5
SHA25640f1752cc468baa0c6275d107df617e13c6d421710bdb18d81087ffaef3662e1
SHA512136760d409e23121904ff71b7177ec4d5d0aacc42dd877aeeaadb2ff3ab9a7bf85ccea4d441c4e683ee57cccc2d83fb2e7edfbab8ccc63b38e821405e2a1a498
-
Filesize
257B
MD526cb9e7cd6914de59f1cd1b9751ee56f
SHA11f4c3d5e8e8a24c93a762dc4a858417788d24861
SHA2561cc76c7b663b4ac3bd4dcd2cdb4e0cae9677854cad60e5f3eab5a8109eca4d72
SHA512b9e7fa22f6aa4c9d449927de6ad3b3ff562d2a6c809d904ea4e5358cf722afdf1b6d0d82689271360fb224f085c01058885c60f27f54b09557f026c86c782491