Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20241023-en
  • resource tags

    arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
  • submitted
    18/12/2024, 04:22 UTC

General

  • Target

    b5c443265eaa3d3cd2e54481ef68fa15cc188107a130af4d6eb3654882a1f486.dll

  • Size

    120KB

  • MD5

    360c97700bffa464699a8fa2e6e417d8

  • SHA1

    27fed44aae9248625daf417a536338a7e997a098

  • SHA256

    b5c443265eaa3d3cd2e54481ef68fa15cc188107a130af4d6eb3654882a1f486

  • SHA512

    edc73061c1689de82a948c53f9eba59eb75e8d242b818564112dd85565ad03684bf4ca8c0b0fa37df50daae0f9beb960ab5526fc69dd2146c7a7abb901a80f39

  • SSDEEP

    1536:r2Abx4SLivmRTqtZ5fbp8stVqyVLwW1u868nj0CIwB4PEHdjj77gPWvlyxzPYecW:r54SLSZ5zbVLw8nj0z8gEFj78uvlydJ

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Signatures

  • Modifies firewall policy service 3 TTPs 6 IoCs
  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

  • Sality family
  • UAC bypass 3 TTPs 2 IoCs
  • Windows security bypass 2 TTPs 12 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 6 IoCs
  • Windows security modification 2 TTPs 14 IoCs
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
  • Enumerates connected drives 3 TTPs 18 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file 25 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Windows directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 45 IoCs
  • Suspicious use of WriteProcessMemory 38 IoCs
  • System policy modification 1 TTPs 2 IoCs

Processes

  • C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    1⤵
      PID:1112
    • C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      1⤵
        PID:1176
      • C:\Windows\Explorer.EXE
        C:\Windows\Explorer.EXE
        1⤵
          PID:1216
          • C:\Windows\system32\rundll32.exe
            rundll32.exe C:\Users\Admin\AppData\Local\Temp\b5c443265eaa3d3cd2e54481ef68fa15cc188107a130af4d6eb3654882a1f486.dll,#1
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:2132
            • C:\Windows\SysWOW64\rundll32.exe
              rundll32.exe C:\Users\Admin\AppData\Local\Temp\b5c443265eaa3d3cd2e54481ef68fa15cc188107a130af4d6eb3654882a1f486.dll,#1
              3⤵
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2128
              • C:\Users\Admin\AppData\Local\Temp\f77190c.exe
                C:\Users\Admin\AppData\Local\Temp\f77190c.exe
                4⤵
                • Modifies firewall policy service
                • UAC bypass
                • Windows security bypass
                • Executes dropped EXE
                • Windows security modification
                • Checks whether UAC is enabled
                • Enumerates connected drives
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                • System policy modification
                PID:2512
              • C:\Users\Admin\AppData\Local\Temp\f771ad1.exe
                C:\Users\Admin\AppData\Local\Temp\f771ad1.exe
                4⤵
                • Executes dropped EXE
                PID:2820
              • C:\Users\Admin\AppData\Local\Temp\f773756.exe
                C:\Users\Admin\AppData\Local\Temp\f773756.exe
                4⤵
                • Modifies firewall policy service
                • UAC bypass
                • Windows security bypass
                • Executes dropped EXE
                • Windows security modification
                • Checks whether UAC is enabled
                • Enumerates connected drives
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                • System policy modification
                PID:2932
        • C:\Windows\system32\DllHost.exe
          C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
          1⤵
            PID:1348

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\f77190c.exe

            Filesize

            97KB

            MD5

            0b648bee0e2a596c58e0a7cf0297bd65

            SHA1

            e0806b9d6ddc4e11c071dac49050626db283d677

            SHA256

            465767ce209587f92f037a55f168e80b9f67d4c60bc28852c9075c21ec13bc93

            SHA512

            e399a0ce4e7b3f4f177edad054100c299a9303009279db28423ff268bc43fb0feead0c76664c0c50da25e94ee36f5219f7b11c427e39e5176e5f2293d21b8471

          • C:\Windows\SYSTEM.INI

            Filesize

            257B

            MD5

            fda98564f84205a80bd1e9eedd0707ce

            SHA1

            cd7106486300706d7e3b3990354fc56e27eed9f5

            SHA256

            f1d0ce0eee1793635c4eb4b82c7b7bb56a35b2935b5ebf69917c8bce7e921558

            SHA512

            d0fab543a6985241bd96995608b8da1ea692f91cf7708183cd290e3228d129940cd7fd69e4d2500da833ef508d3f3143e5ca5e44e25be6a093303d19d44212ee

          • memory/1112-25-0x0000000000410000-0x0000000000412000-memory.dmp

            Filesize

            8KB

          • memory/2128-12-0x0000000000120000-0x0000000000132000-memory.dmp

            Filesize

            72KB

          • memory/2128-0-0x0000000010000000-0x0000000010020000-memory.dmp

            Filesize

            128KB

          • memory/2128-1-0x0000000010000000-0x0000000010020000-memory.dmp

            Filesize

            128KB

          • memory/2128-56-0x0000000000140000-0x0000000000142000-memory.dmp

            Filesize

            8KB

          • memory/2128-2-0x0000000010000000-0x0000000010020000-memory.dmp

            Filesize

            128KB

          • memory/2128-4-0x0000000010000000-0x0000000010020000-memory.dmp

            Filesize

            128KB

          • memory/2128-32-0x0000000000140000-0x0000000000142000-memory.dmp

            Filesize

            8KB

          • memory/2128-33-0x0000000000150000-0x0000000000151000-memory.dmp

            Filesize

            4KB

          • memory/2128-59-0x0000000000140000-0x0000000000142000-memory.dmp

            Filesize

            8KB

          • memory/2128-58-0x0000000000220000-0x0000000000232000-memory.dmp

            Filesize

            72KB

          • memory/2128-41-0x0000000000150000-0x0000000000151000-memory.dmp

            Filesize

            4KB

          • memory/2512-23-0x00000000006A0000-0x000000000175A000-memory.dmp

            Filesize

            16.7MB

          • memory/2512-68-0x00000000006A0000-0x000000000175A000-memory.dmp

            Filesize

            16.7MB

          • memory/2512-47-0x0000000000320000-0x0000000000321000-memory.dmp

            Filesize

            4KB

          • memory/2512-57-0x0000000000310000-0x0000000000312000-memory.dmp

            Filesize

            8KB

          • memory/2512-18-0x00000000006A0000-0x000000000175A000-memory.dmp

            Filesize

            16.7MB

          • memory/2512-24-0x00000000006A0000-0x000000000175A000-memory.dmp

            Filesize

            16.7MB

          • memory/2512-49-0x0000000000310000-0x0000000000312000-memory.dmp

            Filesize

            8KB

          • memory/2512-20-0x00000000006A0000-0x000000000175A000-memory.dmp

            Filesize

            16.7MB

          • memory/2512-17-0x00000000006A0000-0x000000000175A000-memory.dmp

            Filesize

            16.7MB

          • memory/2512-22-0x00000000006A0000-0x000000000175A000-memory.dmp

            Filesize

            16.7MB

          • memory/2512-19-0x00000000006A0000-0x000000000175A000-memory.dmp

            Filesize

            16.7MB

          • memory/2512-16-0x00000000006A0000-0x000000000175A000-memory.dmp

            Filesize

            16.7MB

          • memory/2512-14-0x00000000006A0000-0x000000000175A000-memory.dmp

            Filesize

            16.7MB

          • memory/2512-61-0x00000000006A0000-0x000000000175A000-memory.dmp

            Filesize

            16.7MB

          • memory/2512-63-0x00000000006A0000-0x000000000175A000-memory.dmp

            Filesize

            16.7MB

          • memory/2512-65-0x00000000006A0000-0x000000000175A000-memory.dmp

            Filesize

            16.7MB

          • memory/2512-62-0x00000000006A0000-0x000000000175A000-memory.dmp

            Filesize

            16.7MB

          • memory/2512-64-0x00000000006A0000-0x000000000175A000-memory.dmp

            Filesize

            16.7MB

          • memory/2512-67-0x00000000006A0000-0x000000000175A000-memory.dmp

            Filesize

            16.7MB

          • memory/2512-21-0x00000000006A0000-0x000000000175A000-memory.dmp

            Filesize

            16.7MB

          • memory/2512-69-0x00000000006A0000-0x000000000175A000-memory.dmp

            Filesize

            16.7MB

          • memory/2512-70-0x00000000006A0000-0x000000000175A000-memory.dmp

            Filesize

            16.7MB

          • memory/2512-13-0x0000000000400000-0x0000000000412000-memory.dmp

            Filesize

            72KB

          • memory/2512-85-0x00000000006A0000-0x000000000175A000-memory.dmp

            Filesize

            16.7MB

          • memory/2512-86-0x00000000006A0000-0x000000000175A000-memory.dmp

            Filesize

            16.7MB

          • memory/2512-153-0x0000000000400000-0x0000000000412000-memory.dmp

            Filesize

            72KB

          • memory/2512-154-0x00000000006A0000-0x000000000175A000-memory.dmp

            Filesize

            16.7MB

          • memory/2512-107-0x00000000006A0000-0x000000000175A000-memory.dmp

            Filesize

            16.7MB

          • memory/2820-96-0x0000000000260000-0x0000000000262000-memory.dmp

            Filesize

            8KB

          • memory/2820-95-0x00000000002B0000-0x00000000002B1000-memory.dmp

            Filesize

            4KB

          • memory/2820-104-0x0000000000260000-0x0000000000262000-memory.dmp

            Filesize

            8KB

          • memory/2820-183-0x0000000000400000-0x0000000000412000-memory.dmp

            Filesize

            72KB

          • memory/2932-102-0x00000000001C0000-0x00000000001C1000-memory.dmp

            Filesize

            4KB

          • memory/2932-105-0x00000000001B0000-0x00000000001B2000-memory.dmp

            Filesize

            8KB

          • memory/2932-103-0x00000000001B0000-0x00000000001B2000-memory.dmp

            Filesize

            8KB

          • memory/2932-82-0x0000000000400000-0x0000000000412000-memory.dmp

            Filesize

            72KB

          • memory/2932-169-0x0000000000920000-0x00000000019DA000-memory.dmp

            Filesize

            16.7MB

          • memory/2932-213-0x0000000000400000-0x0000000000412000-memory.dmp

            Filesize

            72KB

          • memory/2932-212-0x0000000000920000-0x00000000019DA000-memory.dmp

            Filesize

            16.7MB

          We care about your privacy.

          This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.