Analysis
-
max time kernel
15s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
18-12-2024 09:14
Static task
static1
Behavioral task
behavioral1
Sample
53f780c2a5f175cc96cb3452d50c5cb8b370a571c9222b61b32f91a7f3b23e99N.exe
Resource
win7-20240903-en
General
-
Target
53f780c2a5f175cc96cb3452d50c5cb8b370a571c9222b61b32f91a7f3b23e99N.exe
-
Size
483KB
-
MD5
82bafdfbfcaa374e8e4b5b9dc0a01230
-
SHA1
7a4c1ac08b56611a7b2d4bdf6502b01943bbd516
-
SHA256
53f780c2a5f175cc96cb3452d50c5cb8b370a571c9222b61b32f91a7f3b23e99
-
SHA512
231014a52999022513af4d382952768b8b504eb3e15676fc6c089ae0e4199b0110288bf63ddcdff88b637acc164b544f56e3a22fe28f2d789932fc0550c98814
-
SSDEEP
12288:7ORXMExJ7REzeA82PYY6ZaHHBQQvJfOAaygfGhfh1auuZrgZDx:7OR8I7WzeA8EYY6ZKhQQvVOAaycGhfhd
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Modifies firewall policy service 3 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 53f780c2a5f175cc96cb3452d50c5cb8b370a571c9222b61b32f91a7f3b23e99N.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 53f780c2a5f175cc96cb3452d50c5cb8b370a571c9222b61b32f91a7f3b23e99N.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 53f780c2a5f175cc96cb3452d50c5cb8b370a571c9222b61b32f91a7f3b23e99N.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 53f780c2a5f175cc96cb3452d50c5cb8b370a571c9222b61b32f91a7f3b23e99N.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 53f780c2a5f175cc96cb3452d50c5cb8b370a571c9222b61b32f91a7f3b23e99N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 53f780c2a5f175cc96cb3452d50c5cb8b370a571c9222b61b32f91a7f3b23e99N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 53f780c2a5f175cc96cb3452d50c5cb8b370a571c9222b61b32f91a7f3b23e99N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 53f780c2a5f175cc96cb3452d50c5cb8b370a571c9222b61b32f91a7f3b23e99N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 53f780c2a5f175cc96cb3452d50c5cb8b370a571c9222b61b32f91a7f3b23e99N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 53f780c2a5f175cc96cb3452d50c5cb8b370a571c9222b61b32f91a7f3b23e99N.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 53f780c2a5f175cc96cb3452d50c5cb8b370a571c9222b61b32f91a7f3b23e99N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 53f780c2a5f175cc96cb3452d50c5cb8b370a571c9222b61b32f91a7f3b23e99N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 53f780c2a5f175cc96cb3452d50c5cb8b370a571c9222b61b32f91a7f3b23e99N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc 53f780c2a5f175cc96cb3452d50c5cb8b370a571c9222b61b32f91a7f3b23e99N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 53f780c2a5f175cc96cb3452d50c5cb8b370a571c9222b61b32f91a7f3b23e99N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 53f780c2a5f175cc96cb3452d50c5cb8b370a571c9222b61b32f91a7f3b23e99N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 53f780c2a5f175cc96cb3452d50c5cb8b370a571c9222b61b32f91a7f3b23e99N.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 53f780c2a5f175cc96cb3452d50c5cb8b370a571c9222b61b32f91a7f3b23e99N.exe -
resource yara_rule behavioral1/memory/880-1-0x0000000002220000-0x00000000032AE000-memory.dmp upx behavioral1/memory/880-4-0x0000000002220000-0x00000000032AE000-memory.dmp upx -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 53f780c2a5f175cc96cb3452d50c5cb8b370a571c9222b61b32f91a7f3b23e99N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\53f780c2a5f175cc96cb3452d50c5cb8b370a571c9222b61b32f91a7f3b23e99N.exe"C:\Users\Admin\AppData\Local\Temp\53f780c2a5f175cc96cb3452d50c5cb8b370a571c9222b61b32f91a7f3b23e99N.exe"1⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- System policy modification
PID:880
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1