Analysis
-
max time kernel
119s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 07:02
Static task
static1
Behavioral task
behavioral1
Sample
1576a15cba5a0a9e24f0846b019db18434b7062a0cfd8fdc73a12b3ee62f0be4.dll
Resource
win7-20241023-en
General
-
Target
1576a15cba5a0a9e24f0846b019db18434b7062a0cfd8fdc73a12b3ee62f0be4.dll
-
Size
120KB
-
MD5
1b84e8112f5b82d53f9205ba2655ccc4
-
SHA1
c59d0a6ca58755cc020422a2f269a5727ab7e503
-
SHA256
1576a15cba5a0a9e24f0846b019db18434b7062a0cfd8fdc73a12b3ee62f0be4
-
SHA512
7556a19b35c1571e7a0bcdf1fb1ff454b1da74af172738d726fdc07968c6071a8acf8be3c4514ce3017e692eb08b6a285826456e38fadabadad45a2652b24243
-
SSDEEP
1536:IawtvhzPFCLpSU7gvAzsIWI9Np/hBgASj+9d8AYRmXKWcmXVGvvlrXQfmmJ:IauvhztIAU7zzsZSNppBV3mXWcmokmmJ
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f76cdab.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f76e946.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f76e946.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f76e946.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f76cdab.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f76cdab.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76cdab.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76e946.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76cdab.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76cdab.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76e946.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76e946.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76e946.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76cdab.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76cdab.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76cdab.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76cdab.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76e946.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76e946.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76e946.exe -
Executes dropped EXE 3 IoCs
pid Process 2348 f76cdab.exe 2960 f76cf6f.exe 2772 f76e946.exe -
Loads dropped DLL 6 IoCs
pid Process 2652 rundll32.exe 2652 rundll32.exe 2652 rundll32.exe 2652 rundll32.exe 2652 rundll32.exe 2652 rundll32.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76e946.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76e946.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76e946.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f76cdab.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76e946.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76e946.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76e946.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f76e946.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76cdab.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76cdab.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76cdab.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76cdab.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76cdab.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76cdab.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76e946.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76cdab.exe -
Enumerates connected drives 3 TTPs 17 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\L: f76cdab.exe File opened (read-only) \??\Q: f76cdab.exe File opened (read-only) \??\T: f76cdab.exe File opened (read-only) \??\M: f76cdab.exe File opened (read-only) \??\O: f76cdab.exe File opened (read-only) \??\E: f76cdab.exe File opened (read-only) \??\I: f76cdab.exe File opened (read-only) \??\J: f76cdab.exe File opened (read-only) \??\K: f76cdab.exe File opened (read-only) \??\R: f76cdab.exe File opened (read-only) \??\S: f76cdab.exe File opened (read-only) \??\E: f76e946.exe File opened (read-only) \??\G: f76e946.exe File opened (read-only) \??\G: f76cdab.exe File opened (read-only) \??\H: f76cdab.exe File opened (read-only) \??\N: f76cdab.exe File opened (read-only) \??\P: f76cdab.exe -
resource yara_rule behavioral1/memory/2348-16-0x0000000000620000-0x00000000016DA000-memory.dmp upx behavioral1/memory/2348-13-0x0000000000620000-0x00000000016DA000-memory.dmp upx behavioral1/memory/2348-15-0x0000000000620000-0x00000000016DA000-memory.dmp upx behavioral1/memory/2348-19-0x0000000000620000-0x00000000016DA000-memory.dmp upx behavioral1/memory/2348-20-0x0000000000620000-0x00000000016DA000-memory.dmp upx behavioral1/memory/2348-17-0x0000000000620000-0x00000000016DA000-memory.dmp upx behavioral1/memory/2348-21-0x0000000000620000-0x00000000016DA000-memory.dmp upx behavioral1/memory/2348-14-0x0000000000620000-0x00000000016DA000-memory.dmp upx behavioral1/memory/2348-22-0x0000000000620000-0x00000000016DA000-memory.dmp upx behavioral1/memory/2348-18-0x0000000000620000-0x00000000016DA000-memory.dmp upx behavioral1/memory/2348-62-0x0000000000620000-0x00000000016DA000-memory.dmp upx behavioral1/memory/2348-63-0x0000000000620000-0x00000000016DA000-memory.dmp upx behavioral1/memory/2348-64-0x0000000000620000-0x00000000016DA000-memory.dmp upx behavioral1/memory/2348-65-0x0000000000620000-0x00000000016DA000-memory.dmp upx behavioral1/memory/2348-66-0x0000000000620000-0x00000000016DA000-memory.dmp upx behavioral1/memory/2348-68-0x0000000000620000-0x00000000016DA000-memory.dmp upx behavioral1/memory/2348-69-0x0000000000620000-0x00000000016DA000-memory.dmp upx behavioral1/memory/2348-83-0x0000000000620000-0x00000000016DA000-memory.dmp upx behavioral1/memory/2348-85-0x0000000000620000-0x00000000016DA000-memory.dmp upx behavioral1/memory/2348-86-0x0000000000620000-0x00000000016DA000-memory.dmp upx behavioral1/memory/2348-153-0x0000000000620000-0x00000000016DA000-memory.dmp upx behavioral1/memory/2772-169-0x0000000000950000-0x0000000001A0A000-memory.dmp upx behavioral1/memory/2772-209-0x0000000000950000-0x0000000001A0A000-memory.dmp upx -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\f76ce09 f76cdab.exe File opened for modification C:\Windows\SYSTEM.INI f76cdab.exe File created C:\Windows\f771e69 f76e946.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f76cdab.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f76e946.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2348 f76cdab.exe 2348 f76cdab.exe 2772 f76e946.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeDebugPrivilege 2348 f76cdab.exe Token: SeDebugPrivilege 2348 f76cdab.exe Token: SeDebugPrivilege 2348 f76cdab.exe Token: SeDebugPrivilege 2348 f76cdab.exe Token: SeDebugPrivilege 2348 f76cdab.exe Token: SeDebugPrivilege 2348 f76cdab.exe Token: SeDebugPrivilege 2348 f76cdab.exe Token: SeDebugPrivilege 2348 f76cdab.exe Token: SeDebugPrivilege 2348 f76cdab.exe Token: SeDebugPrivilege 2348 f76cdab.exe Token: SeDebugPrivilege 2348 f76cdab.exe Token: SeDebugPrivilege 2348 f76cdab.exe Token: SeDebugPrivilege 2348 f76cdab.exe Token: SeDebugPrivilege 2348 f76cdab.exe Token: SeDebugPrivilege 2348 f76cdab.exe Token: SeDebugPrivilege 2348 f76cdab.exe Token: SeDebugPrivilege 2348 f76cdab.exe Token: SeDebugPrivilege 2348 f76cdab.exe Token: SeDebugPrivilege 2348 f76cdab.exe Token: SeDebugPrivilege 2348 f76cdab.exe Token: SeDebugPrivilege 2348 f76cdab.exe Token: SeDebugPrivilege 2348 f76cdab.exe Token: SeDebugPrivilege 2348 f76cdab.exe Token: SeDebugPrivilege 2348 f76cdab.exe Token: SeDebugPrivilege 2772 f76e946.exe Token: SeDebugPrivilege 2772 f76e946.exe Token: SeDebugPrivilege 2772 f76e946.exe Token: SeDebugPrivilege 2772 f76e946.exe Token: SeDebugPrivilege 2772 f76e946.exe Token: SeDebugPrivilege 2772 f76e946.exe Token: SeDebugPrivilege 2772 f76e946.exe Token: SeDebugPrivilege 2772 f76e946.exe Token: SeDebugPrivilege 2772 f76e946.exe Token: SeDebugPrivilege 2772 f76e946.exe Token: SeDebugPrivilege 2772 f76e946.exe Token: SeDebugPrivilege 2772 f76e946.exe Token: SeDebugPrivilege 2772 f76e946.exe Token: SeDebugPrivilege 2772 f76e946.exe Token: SeDebugPrivilege 2772 f76e946.exe Token: SeDebugPrivilege 2772 f76e946.exe Token: SeDebugPrivilege 2772 f76e946.exe Token: SeDebugPrivilege 2772 f76e946.exe Token: SeDebugPrivilege 2772 f76e946.exe Token: SeDebugPrivilege 2772 f76e946.exe Token: SeDebugPrivilege 2772 f76e946.exe Token: SeDebugPrivilege 2772 f76e946.exe -
Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 1268 wrote to memory of 2652 1268 rundll32.exe 31 PID 1268 wrote to memory of 2652 1268 rundll32.exe 31 PID 1268 wrote to memory of 2652 1268 rundll32.exe 31 PID 1268 wrote to memory of 2652 1268 rundll32.exe 31 PID 1268 wrote to memory of 2652 1268 rundll32.exe 31 PID 1268 wrote to memory of 2652 1268 rundll32.exe 31 PID 1268 wrote to memory of 2652 1268 rundll32.exe 31 PID 2652 wrote to memory of 2348 2652 rundll32.exe 32 PID 2652 wrote to memory of 2348 2652 rundll32.exe 32 PID 2652 wrote to memory of 2348 2652 rundll32.exe 32 PID 2652 wrote to memory of 2348 2652 rundll32.exe 32 PID 2348 wrote to memory of 1124 2348 f76cdab.exe 19 PID 2348 wrote to memory of 1176 2348 f76cdab.exe 20 PID 2348 wrote to memory of 1212 2348 f76cdab.exe 21 PID 2348 wrote to memory of 672 2348 f76cdab.exe 25 PID 2348 wrote to memory of 1268 2348 f76cdab.exe 30 PID 2348 wrote to memory of 2652 2348 f76cdab.exe 31 PID 2348 wrote to memory of 2652 2348 f76cdab.exe 31 PID 2652 wrote to memory of 2960 2652 rundll32.exe 33 PID 2652 wrote to memory of 2960 2652 rundll32.exe 33 PID 2652 wrote to memory of 2960 2652 rundll32.exe 33 PID 2652 wrote to memory of 2960 2652 rundll32.exe 33 PID 2652 wrote to memory of 2772 2652 rundll32.exe 34 PID 2652 wrote to memory of 2772 2652 rundll32.exe 34 PID 2652 wrote to memory of 2772 2652 rundll32.exe 34 PID 2652 wrote to memory of 2772 2652 rundll32.exe 34 PID 2348 wrote to memory of 1124 2348 f76cdab.exe 19 PID 2348 wrote to memory of 1176 2348 f76cdab.exe 20 PID 2348 wrote to memory of 1212 2348 f76cdab.exe 21 PID 2348 wrote to memory of 672 2348 f76cdab.exe 25 PID 2348 wrote to memory of 2960 2348 f76cdab.exe 33 PID 2348 wrote to memory of 2960 2348 f76cdab.exe 33 PID 2348 wrote to memory of 2772 2348 f76cdab.exe 34 PID 2348 wrote to memory of 2772 2348 f76cdab.exe 34 PID 2772 wrote to memory of 1124 2772 f76e946.exe 19 PID 2772 wrote to memory of 1176 2772 f76e946.exe 20 PID 2772 wrote to memory of 1212 2772 f76e946.exe 21 PID 2772 wrote to memory of 672 2772 f76e946.exe 25 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76cdab.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76e946.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1124
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1176
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1212
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1576a15cba5a0a9e24f0846b019db18434b7062a0cfd8fdc73a12b3ee62f0be4.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1576a15cba5a0a9e24f0846b019db18434b7062a0cfd8fdc73a12b3ee62f0be4.dll,#13⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\f76cdab.exeC:\Users\Admin\AppData\Local\Temp\f76cdab.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2348
-
-
C:\Users\Admin\AppData\Local\Temp\f76cf6f.exeC:\Users\Admin\AppData\Local\Temp\f76cf6f.exe4⤵
- Executes dropped EXE
PID:2960
-
-
C:\Users\Admin\AppData\Local\Temp\f76e946.exeC:\Users\Admin\AppData\Local\Temp\f76e946.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2772
-
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:672
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD5cf4f0c4ed0258f2e372fe8a002602b51
SHA19083c4d1927115e28f7edad58659d71c3129e23e
SHA256662c9e87d28efef397704048d62ab4f634f9e1798223322e14bc371f059bc6f6
SHA5125a838ef66118cbeea1d63203917d46bca03afc2172a3df16fbbb61fa99c91e2977a5757d41358c360dce511fe21cdad2be70cda6a8904fe046ba4b90c3ecb0f1
-
Filesize
257B
MD548a6f21fb998aff53bc0af6b047f244d
SHA120eee30d68ef025ce4e88432f9a17c6dbce80829
SHA256c3ce6139d011185c692d6efeeb6edd811758d92430276496470ff11fdae10bd0
SHA512ee227c3dca014e051e891372410848802df17964d9ec969301d37c1e5cacced8b0537f8630d46561038b9391f72c835e53d2d2a2e33a1b1029a2be099c9f0274