Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
29s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
18/12/2024, 02:08
Static task
static1
Behavioral task
behavioral1
Sample
c96e84c57bbe2993fccef83cac472d5bad0b19ca4c73ab7b581346a54b4c5dafN.dll
Resource
win7-20240729-en
General
-
Target
c96e84c57bbe2993fccef83cac472d5bad0b19ca4c73ab7b581346a54b4c5dafN.dll
-
Size
120KB
-
MD5
aad77b942a97206464e1a9c279889b30
-
SHA1
3d9d3171a77a351adc4ba71b349a0a65be4757b1
-
SHA256
c96e84c57bbe2993fccef83cac472d5bad0b19ca4c73ab7b581346a54b4c5daf
-
SHA512
4e520b60f255905c734e2159493d7d6f4148d697a4bb8c7d0cff8d269925f028e87e492c91dc2bc05d4e59853103f984e5fc434470e048821125d2cddf684092
-
SSDEEP
3072:shTeRa1aq0mP4Laf1I3pXrzYjYE3wr1JIy:shTqOavfZbcTk1JI
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f77a841.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f77c909.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f77c909.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f77c909.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f77a841.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f77a841.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f77a841.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f77c909.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f77c909.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f77c909.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f77a841.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f77a841.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f77c909.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f77c909.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f77c909.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f77c909.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f77a841.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f77a841.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f77a841.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f77a841.exe -
Executes dropped EXE 3 IoCs
pid Process 2644 f77a841.exe 2804 f77abc9.exe 1616 f77c909.exe -
Loads dropped DLL 6 IoCs
pid Process 1704 rundll32.exe 1704 rundll32.exe 1704 rundll32.exe 1704 rundll32.exe 1704 rundll32.exe 1704 rundll32.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f77a841.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f77c909.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f77a841.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f77a841.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f77c909.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f77a841.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f77c909.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f77c909.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f77a841.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f77a841.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f77a841.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f77c909.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f77c909.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f77c909.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f77a841.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f77c909.exe -
Enumerates connected drives 3 TTPs 17 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Q: f77a841.exe File opened (read-only) \??\S: f77a841.exe File opened (read-only) \??\G: f77c909.exe File opened (read-only) \??\E: f77c909.exe File opened (read-only) \??\J: f77a841.exe File opened (read-only) \??\M: f77a841.exe File opened (read-only) \??\N: f77a841.exe File opened (read-only) \??\P: f77a841.exe File opened (read-only) \??\O: f77a841.exe File opened (read-only) \??\E: f77a841.exe File opened (read-only) \??\G: f77a841.exe File opened (read-only) \??\H: f77a841.exe File opened (read-only) \??\I: f77a841.exe File opened (read-only) \??\K: f77a841.exe File opened (read-only) \??\L: f77a841.exe File opened (read-only) \??\R: f77a841.exe File opened (read-only) \??\H: f77c909.exe -
resource yara_rule behavioral1/memory/2644-14-0x00000000005F0000-0x00000000016AA000-memory.dmp upx behavioral1/memory/2644-13-0x00000000005F0000-0x00000000016AA000-memory.dmp upx behavioral1/memory/2644-15-0x00000000005F0000-0x00000000016AA000-memory.dmp upx behavioral1/memory/2644-17-0x00000000005F0000-0x00000000016AA000-memory.dmp upx behavioral1/memory/2644-19-0x00000000005F0000-0x00000000016AA000-memory.dmp upx behavioral1/memory/2644-22-0x00000000005F0000-0x00000000016AA000-memory.dmp upx behavioral1/memory/2644-21-0x00000000005F0000-0x00000000016AA000-memory.dmp upx behavioral1/memory/2644-20-0x00000000005F0000-0x00000000016AA000-memory.dmp upx behavioral1/memory/2644-18-0x00000000005F0000-0x00000000016AA000-memory.dmp upx behavioral1/memory/2644-16-0x00000000005F0000-0x00000000016AA000-memory.dmp upx behavioral1/memory/2644-61-0x00000000005F0000-0x00000000016AA000-memory.dmp upx behavioral1/memory/2644-62-0x00000000005F0000-0x00000000016AA000-memory.dmp upx behavioral1/memory/2644-63-0x00000000005F0000-0x00000000016AA000-memory.dmp upx behavioral1/memory/2644-64-0x00000000005F0000-0x00000000016AA000-memory.dmp upx behavioral1/memory/2644-66-0x00000000005F0000-0x00000000016AA000-memory.dmp upx behavioral1/memory/2644-68-0x00000000005F0000-0x00000000016AA000-memory.dmp upx behavioral1/memory/2644-70-0x00000000005F0000-0x00000000016AA000-memory.dmp upx behavioral1/memory/2644-71-0x00000000005F0000-0x00000000016AA000-memory.dmp upx behavioral1/memory/1704-81-0x00000000001D0000-0x00000000001E2000-memory.dmp upx behavioral1/memory/2644-88-0x00000000005F0000-0x00000000016AA000-memory.dmp upx behavioral1/memory/2644-90-0x00000000005F0000-0x00000000016AA000-memory.dmp upx behavioral1/memory/2644-110-0x00000000005F0000-0x00000000016AA000-memory.dmp upx behavioral1/memory/2644-112-0x00000000005F0000-0x00000000016AA000-memory.dmp upx behavioral1/memory/2644-152-0x00000000005F0000-0x00000000016AA000-memory.dmp upx behavioral1/memory/1616-168-0x0000000000A80000-0x0000000001B3A000-memory.dmp upx behavioral1/memory/1616-211-0x0000000000A80000-0x0000000001B3A000-memory.dmp upx -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\f77a8ae f77a841.exe File opened for modification C:\Windows\SYSTEM.INI f77a841.exe File created C:\Windows\f77faf2 f77c909.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f77a841.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f77c909.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2644 f77a841.exe 2644 f77a841.exe 1616 f77c909.exe -
Suspicious use of AdjustPrivilegeToken 44 IoCs
description pid Process Token: SeDebugPrivilege 2644 f77a841.exe Token: SeDebugPrivilege 2644 f77a841.exe Token: SeDebugPrivilege 2644 f77a841.exe Token: SeDebugPrivilege 2644 f77a841.exe Token: SeDebugPrivilege 2644 f77a841.exe Token: SeDebugPrivilege 2644 f77a841.exe Token: SeDebugPrivilege 2644 f77a841.exe Token: SeDebugPrivilege 2644 f77a841.exe Token: SeDebugPrivilege 2644 f77a841.exe Token: SeDebugPrivilege 2644 f77a841.exe Token: SeDebugPrivilege 2644 f77a841.exe Token: SeDebugPrivilege 2644 f77a841.exe Token: SeDebugPrivilege 2644 f77a841.exe Token: SeDebugPrivilege 2644 f77a841.exe Token: SeDebugPrivilege 2644 f77a841.exe Token: SeDebugPrivilege 2644 f77a841.exe Token: SeDebugPrivilege 2644 f77a841.exe Token: SeDebugPrivilege 2644 f77a841.exe Token: SeDebugPrivilege 2644 f77a841.exe Token: SeDebugPrivilege 2644 f77a841.exe Token: SeDebugPrivilege 2644 f77a841.exe Token: SeDebugPrivilege 2644 f77a841.exe Token: SeDebugPrivilege 2644 f77a841.exe Token: SeDebugPrivilege 1616 f77c909.exe Token: SeDebugPrivilege 1616 f77c909.exe Token: SeDebugPrivilege 1616 f77c909.exe Token: SeDebugPrivilege 1616 f77c909.exe Token: SeDebugPrivilege 1616 f77c909.exe Token: SeDebugPrivilege 1616 f77c909.exe Token: SeDebugPrivilege 1616 f77c909.exe Token: SeDebugPrivilege 1616 f77c909.exe Token: SeDebugPrivilege 1616 f77c909.exe Token: SeDebugPrivilege 1616 f77c909.exe Token: SeDebugPrivilege 1616 f77c909.exe Token: SeDebugPrivilege 1616 f77c909.exe Token: SeDebugPrivilege 1616 f77c909.exe Token: SeDebugPrivilege 1616 f77c909.exe Token: SeDebugPrivilege 1616 f77c909.exe Token: SeDebugPrivilege 1616 f77c909.exe Token: SeDebugPrivilege 1616 f77c909.exe Token: SeDebugPrivilege 1616 f77c909.exe Token: SeDebugPrivilege 1616 f77c909.exe Token: SeDebugPrivilege 1616 f77c909.exe Token: SeDebugPrivilege 1616 f77c909.exe -
Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 2308 wrote to memory of 1704 2308 rundll32.exe 30 PID 2308 wrote to memory of 1704 2308 rundll32.exe 30 PID 2308 wrote to memory of 1704 2308 rundll32.exe 30 PID 2308 wrote to memory of 1704 2308 rundll32.exe 30 PID 2308 wrote to memory of 1704 2308 rundll32.exe 30 PID 2308 wrote to memory of 1704 2308 rundll32.exe 30 PID 2308 wrote to memory of 1704 2308 rundll32.exe 30 PID 1704 wrote to memory of 2644 1704 rundll32.exe 31 PID 1704 wrote to memory of 2644 1704 rundll32.exe 31 PID 1704 wrote to memory of 2644 1704 rundll32.exe 31 PID 1704 wrote to memory of 2644 1704 rundll32.exe 31 PID 2644 wrote to memory of 1116 2644 f77a841.exe 19 PID 2644 wrote to memory of 1164 2644 f77a841.exe 20 PID 2644 wrote to memory of 1204 2644 f77a841.exe 21 PID 2644 wrote to memory of 324 2644 f77a841.exe 25 PID 2644 wrote to memory of 2308 2644 f77a841.exe 29 PID 2644 wrote to memory of 1704 2644 f77a841.exe 30 PID 2644 wrote to memory of 1704 2644 f77a841.exe 30 PID 1704 wrote to memory of 2804 1704 rundll32.exe 32 PID 1704 wrote to memory of 2804 1704 rundll32.exe 32 PID 1704 wrote to memory of 2804 1704 rundll32.exe 32 PID 1704 wrote to memory of 2804 1704 rundll32.exe 32 PID 1704 wrote to memory of 1616 1704 rundll32.exe 33 PID 1704 wrote to memory of 1616 1704 rundll32.exe 33 PID 1704 wrote to memory of 1616 1704 rundll32.exe 33 PID 1704 wrote to memory of 1616 1704 rundll32.exe 33 PID 2644 wrote to memory of 1116 2644 f77a841.exe 19 PID 2644 wrote to memory of 1164 2644 f77a841.exe 20 PID 2644 wrote to memory of 1204 2644 f77a841.exe 21 PID 2644 wrote to memory of 324 2644 f77a841.exe 25 PID 2644 wrote to memory of 2804 2644 f77a841.exe 32 PID 2644 wrote to memory of 2804 2644 f77a841.exe 32 PID 2644 wrote to memory of 1616 2644 f77a841.exe 33 PID 2644 wrote to memory of 1616 2644 f77a841.exe 33 PID 1616 wrote to memory of 1116 1616 f77c909.exe 19 PID 1616 wrote to memory of 1164 1616 f77c909.exe 20 PID 1616 wrote to memory of 1204 1616 f77c909.exe 21 PID 1616 wrote to memory of 324 1616 f77c909.exe 25 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f77a841.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f77c909.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1116
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1164
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1204
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c96e84c57bbe2993fccef83cac472d5bad0b19ca4c73ab7b581346a54b4c5dafN.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c96e84c57bbe2993fccef83cac472d5bad0b19ca4c73ab7b581346a54b4c5dafN.dll,#13⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\f77a841.exeC:\Users\Admin\AppData\Local\Temp\f77a841.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2644
-
-
C:\Users\Admin\AppData\Local\Temp\f77abc9.exeC:\Users\Admin\AppData\Local\Temp\f77abc9.exe4⤵
- Executes dropped EXE
PID:2804
-
-
C:\Users\Admin\AppData\Local\Temp\f77c909.exeC:\Users\Admin\AppData\Local\Temp\f77c909.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1616
-
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:324
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD5e7913e106e0eb68257bafcffe4038960
SHA14db431107c9f1c7e7d9a3d008aaf307989502ae6
SHA25609966d9328e2e0d0e663f9a7a29c9a6cd436277ed27835a33c37a2f9ec699670
SHA512eb4dc30529c5576ff75d2ad6f0db115ec9c0c3cbc168c0901f311b3521061a0fb8510db94c1b767e42463a94a13324636aaf745153480c0d7ab67d9df90664b2
-
Filesize
257B
MD5b814783319ce20ab88a9b90f13155b75
SHA1c98c288ed4a019fa0a92cad06f8771fab3512be9
SHA256fd41741ca86238151dfb9b45f226e56208ada381233df57f2296db83c137faaa
SHA512a36f1b91b1e669f7bf054b3ff8cf016210d39464a237ca230633189c1360e892704833766e973826526b548f494227d2d2aab8b886cc25e3069853ffd4feccee