Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
18-12-2024 09:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
91f1465d2e0bc9194558018f5d76ee67585ab9a5cacc4af76aad8a8b5e54c792.dll
Resource
win7-20240903-en
windows7-x64
17 signatures
120 seconds
General
-
Target
91f1465d2e0bc9194558018f5d76ee67585ab9a5cacc4af76aad8a8b5e54c792.dll
-
Size
120KB
-
MD5
d40c1410cd2c9bfd68935cf2d1d2aa93
-
SHA1
15e89c3e1779f6c0f062e263de2695adbac718d1
-
SHA256
91f1465d2e0bc9194558018f5d76ee67585ab9a5cacc4af76aad8a8b5e54c792
-
SHA512
3fbd0759f9f439133e3540509b10d891f98feb1c3e4674121dc9d11b0ed22063693c620f9132b8438cdc69184df6419e77b46738a50e57ff6815e1fc1f51fa6e
-
SSDEEP
3072:DsQ+oxdyoCE8n1YSFBB6DNKPfnGH8uwCK3:n9CE8nRb6D42H6P3
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f76dc99.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f76dc99.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f76dc99.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f76f882.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f76f882.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f76f882.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76dc99.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76f882.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76f882.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76f882.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76f882.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76f882.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76f882.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76dc99.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76dc99.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76dc99.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76dc99.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76f882.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76dc99.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76dc99.exe -
Executes dropped EXE 3 IoCs
pid Process 3060 f76dc99.exe 2844 f76de6d.exe 3040 f76f882.exe -
Loads dropped DLL 6 IoCs
pid Process 2308 rundll32.exe 2308 rundll32.exe 2308 rundll32.exe 2308 rundll32.exe 2308 rundll32.exe 2308 rundll32.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76f882.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76dc99.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f76dc99.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76f882.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76dc99.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76f882.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f76f882.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76dc99.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76dc99.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76dc99.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76f882.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76dc99.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76f882.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76f882.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76dc99.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76f882.exe -
Enumerates connected drives 3 TTPs 15 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\N: f76dc99.exe File opened (read-only) \??\H: f76dc99.exe File opened (read-only) \??\I: f76dc99.exe File opened (read-only) \??\P: f76dc99.exe File opened (read-only) \??\E: f76f882.exe File opened (read-only) \??\G: f76f882.exe File opened (read-only) \??\J: f76dc99.exe File opened (read-only) \??\M: f76dc99.exe File opened (read-only) \??\Q: f76dc99.exe File opened (read-only) \??\R: f76dc99.exe File opened (read-only) \??\E: f76dc99.exe File opened (read-only) \??\G: f76dc99.exe File opened (read-only) \??\K: f76dc99.exe File opened (read-only) \??\L: f76dc99.exe File opened (read-only) \??\O: f76dc99.exe -
resource yara_rule behavioral1/memory/3060-18-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/3060-13-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/3060-15-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/3060-14-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/3060-16-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/3060-19-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/3060-22-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/3060-21-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/3060-17-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/3060-20-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/3060-62-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/3060-63-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/3060-64-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/3060-65-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/3060-66-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/3060-68-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/3060-82-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/3060-84-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/3060-85-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/3060-109-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/3060-152-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/3040-169-0x0000000000A00000-0x0000000001ABA000-memory.dmp upx behavioral1/memory/3040-209-0x0000000000A00000-0x0000000001ABA000-memory.dmp upx -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\f76dd16 f76dc99.exe File opened for modification C:\Windows\SYSTEM.INI f76dc99.exe File created C:\Windows\f772d38 f76f882.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f76f882.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f76dc99.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 3060 f76dc99.exe 3060 f76dc99.exe 3040 f76f882.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeDebugPrivilege 3060 f76dc99.exe Token: SeDebugPrivilege 3060 f76dc99.exe Token: SeDebugPrivilege 3060 f76dc99.exe Token: SeDebugPrivilege 3060 f76dc99.exe Token: SeDebugPrivilege 3060 f76dc99.exe Token: SeDebugPrivilege 3060 f76dc99.exe Token: SeDebugPrivilege 3060 f76dc99.exe Token: SeDebugPrivilege 3060 f76dc99.exe Token: SeDebugPrivilege 3060 f76dc99.exe Token: SeDebugPrivilege 3060 f76dc99.exe Token: SeDebugPrivilege 3060 f76dc99.exe Token: SeDebugPrivilege 3060 f76dc99.exe Token: SeDebugPrivilege 3060 f76dc99.exe Token: SeDebugPrivilege 3060 f76dc99.exe Token: SeDebugPrivilege 3060 f76dc99.exe Token: SeDebugPrivilege 3060 f76dc99.exe Token: SeDebugPrivilege 3060 f76dc99.exe Token: SeDebugPrivilege 3060 f76dc99.exe Token: SeDebugPrivilege 3060 f76dc99.exe Token: SeDebugPrivilege 3060 f76dc99.exe Token: SeDebugPrivilege 3060 f76dc99.exe Token: SeDebugPrivilege 3060 f76dc99.exe Token: SeDebugPrivilege 3060 f76dc99.exe Token: SeDebugPrivilege 3060 f76dc99.exe Token: SeDebugPrivilege 3040 f76f882.exe Token: SeDebugPrivilege 3040 f76f882.exe Token: SeDebugPrivilege 3040 f76f882.exe Token: SeDebugPrivilege 3040 f76f882.exe Token: SeDebugPrivilege 3040 f76f882.exe Token: SeDebugPrivilege 3040 f76f882.exe Token: SeDebugPrivilege 3040 f76f882.exe Token: SeDebugPrivilege 3040 f76f882.exe Token: SeDebugPrivilege 3040 f76f882.exe Token: SeDebugPrivilege 3040 f76f882.exe Token: SeDebugPrivilege 3040 f76f882.exe Token: SeDebugPrivilege 3040 f76f882.exe Token: SeDebugPrivilege 3040 f76f882.exe Token: SeDebugPrivilege 3040 f76f882.exe Token: SeDebugPrivilege 3040 f76f882.exe Token: SeDebugPrivilege 3040 f76f882.exe Token: SeDebugPrivilege 3040 f76f882.exe Token: SeDebugPrivilege 3040 f76f882.exe Token: SeDebugPrivilege 3040 f76f882.exe Token: SeDebugPrivilege 3040 f76f882.exe Token: SeDebugPrivilege 3040 f76f882.exe Token: SeDebugPrivilege 3040 f76f882.exe -
Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 2024 wrote to memory of 2308 2024 rundll32.exe 31 PID 2024 wrote to memory of 2308 2024 rundll32.exe 31 PID 2024 wrote to memory of 2308 2024 rundll32.exe 31 PID 2024 wrote to memory of 2308 2024 rundll32.exe 31 PID 2024 wrote to memory of 2308 2024 rundll32.exe 31 PID 2024 wrote to memory of 2308 2024 rundll32.exe 31 PID 2024 wrote to memory of 2308 2024 rundll32.exe 31 PID 2308 wrote to memory of 3060 2308 rundll32.exe 32 PID 2308 wrote to memory of 3060 2308 rundll32.exe 32 PID 2308 wrote to memory of 3060 2308 rundll32.exe 32 PID 2308 wrote to memory of 3060 2308 rundll32.exe 32 PID 3060 wrote to memory of 1060 3060 f76dc99.exe 18 PID 3060 wrote to memory of 1140 3060 f76dc99.exe 20 PID 3060 wrote to memory of 1184 3060 f76dc99.exe 21 PID 3060 wrote to memory of 2040 3060 f76dc99.exe 23 PID 3060 wrote to memory of 2024 3060 f76dc99.exe 30 PID 3060 wrote to memory of 2308 3060 f76dc99.exe 31 PID 3060 wrote to memory of 2308 3060 f76dc99.exe 31 PID 2308 wrote to memory of 2844 2308 rundll32.exe 33 PID 2308 wrote to memory of 2844 2308 rundll32.exe 33 PID 2308 wrote to memory of 2844 2308 rundll32.exe 33 PID 2308 wrote to memory of 2844 2308 rundll32.exe 33 PID 2308 wrote to memory of 3040 2308 rundll32.exe 34 PID 2308 wrote to memory of 3040 2308 rundll32.exe 34 PID 2308 wrote to memory of 3040 2308 rundll32.exe 34 PID 2308 wrote to memory of 3040 2308 rundll32.exe 34 PID 3060 wrote to memory of 1060 3060 f76dc99.exe 18 PID 3060 wrote to memory of 1140 3060 f76dc99.exe 20 PID 3060 wrote to memory of 1184 3060 f76dc99.exe 21 PID 3060 wrote to memory of 2040 3060 f76dc99.exe 23 PID 3060 wrote to memory of 2844 3060 f76dc99.exe 33 PID 3060 wrote to memory of 2844 3060 f76dc99.exe 33 PID 3060 wrote to memory of 3040 3060 f76dc99.exe 34 PID 3060 wrote to memory of 3040 3060 f76dc99.exe 34 PID 3040 wrote to memory of 1060 3040 f76f882.exe 18 PID 3040 wrote to memory of 1140 3040 f76f882.exe 20 PID 3040 wrote to memory of 1184 3040 f76f882.exe 21 PID 3040 wrote to memory of 2040 3040 f76f882.exe 23 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76dc99.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76f882.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1060
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1140
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1184
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\91f1465d2e0bc9194558018f5d76ee67585ab9a5cacc4af76aad8a8b5e54c792.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\91f1465d2e0bc9194558018f5d76ee67585ab9a5cacc4af76aad8a8b5e54c792.dll,#13⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\f76dc99.exeC:\Users\Admin\AppData\Local\Temp\f76dc99.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3060
-
-
C:\Users\Admin\AppData\Local\Temp\f76de6d.exeC:\Users\Admin\AppData\Local\Temp\f76de6d.exe4⤵
- Executes dropped EXE
PID:2844
-
-
C:\Users\Admin\AppData\Local\Temp\f76f882.exeC:\Users\Admin\AppData\Local\Temp\f76f882.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3040
-
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:2040
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
257B
MD5b23b5b8f1757b2cc3c1b8fbbf7fa487c
SHA11e50066e896d0617b7504ce10c0a7543692f718f
SHA256d1c42f60c484e99d71c647e19a482321fc880a26eeb4cf0edb4cf6e756808b7b
SHA512a12497eafea634c17cb2b7b0a14ff9f6e08b245d55293e024427a6443336a44efe7dd13c1e15b48372c6648824b5422b4339ba0aee0afdbf0da3c9dda4f631cd
-
Filesize
97KB
MD5c7a703584ec8786beb1983c1aa601f0d
SHA1188b974f824e2c1eba89dcbe2c6e830b9516e3d6
SHA25630c3c27d539d478593afeb3ef93f0f0b2a6450c47eb818abb8267394fcab39d1
SHA51285019b4cdc94461c1ae075415a075d6157d7b57868199cf1541c4f21b17337bca43ce4b6cb8f7a5265879ce22cfd6284e5811a8650d81a431c33408a32d18335