Analysis
-
max time kernel
122s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 07:05
Static task
static1
Behavioral task
behavioral1
Sample
1576a15cba5a0a9e24f0846b019db18434b7062a0cfd8fdc73a12b3ee62f0be4.dll
Resource
win7-20240708-en
General
-
Target
1576a15cba5a0a9e24f0846b019db18434b7062a0cfd8fdc73a12b3ee62f0be4.dll
-
Size
120KB
-
MD5
1b84e8112f5b82d53f9205ba2655ccc4
-
SHA1
c59d0a6ca58755cc020422a2f269a5727ab7e503
-
SHA256
1576a15cba5a0a9e24f0846b019db18434b7062a0cfd8fdc73a12b3ee62f0be4
-
SHA512
7556a19b35c1571e7a0bcdf1fb1ff454b1da74af172738d726fdc07968c6071a8acf8be3c4514ce3017e692eb08b6a285826456e38fadabadad45a2652b24243
-
SSDEEP
1536:IawtvhzPFCLpSU7gvAzsIWI9Np/hBgASj+9d8AYRmXKWcmXVGvvlrXQfmmJ:IauvhztIAU7zzsZSNppBV3mXWcmokmmJ
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f7705ac.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f7705ac.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f7703c8.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f7703c8.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f7703c8.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f7705ac.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f7703c8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f7705ac.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f7703c8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f7705ac.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f7705ac.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f7703c8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f7703c8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f7703c8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f7705ac.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f7705ac.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f7705ac.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f7705ac.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f7703c8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f7703c8.exe -
Executes dropped EXE 3 IoCs
pid Process 2144 f7703c8.exe 2672 f7705ac.exe 2628 f771f72.exe -
Loads dropped DLL 6 IoCs
pid Process 2856 rundll32.exe 2856 rundll32.exe 2856 rundll32.exe 2856 rundll32.exe 2856 rundll32.exe 2856 rundll32.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f7705ac.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f7703c8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f7703c8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f7703c8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f7705ac.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f7705ac.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f7703c8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f7705ac.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f7705ac.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f7703c8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f7705ac.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f7703c8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f7703c8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f7705ac.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f7703c8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f7705ac.exe -
Enumerates connected drives 3 TTPs 15 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: f7703c8.exe File opened (read-only) \??\H: f7703c8.exe File opened (read-only) \??\J: f7703c8.exe File opened (read-only) \??\L: f7703c8.exe File opened (read-only) \??\P: f7703c8.exe File opened (read-only) \??\S: f7703c8.exe File opened (read-only) \??\I: f7703c8.exe File opened (read-only) \??\K: f7703c8.exe File opened (read-only) \??\E: f7703c8.exe File opened (read-only) \??\M: f7703c8.exe File opened (read-only) \??\Q: f7703c8.exe File opened (read-only) \??\T: f7703c8.exe File opened (read-only) \??\N: f7703c8.exe File opened (read-only) \??\O: f7703c8.exe File opened (read-only) \??\R: f7703c8.exe -
resource yara_rule behavioral1/memory/2144-18-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2144-17-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2144-21-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2144-23-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2144-24-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2144-22-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2144-20-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2144-16-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2144-15-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2144-19-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2144-63-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2144-64-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2144-65-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2144-66-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2144-67-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2144-69-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2144-70-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2144-86-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2144-88-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2144-91-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2144-109-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2144-153-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2672-158-0x00000000009C0000-0x0000000001A7A000-memory.dmp upx -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\f770406 f7703c8.exe File opened for modification C:\Windows\SYSTEM.INI f7703c8.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f7703c8.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2144 f7703c8.exe 2144 f7703c8.exe -
Suspicious use of AdjustPrivilegeToken 23 IoCs
description pid Process Token: SeDebugPrivilege 2144 f7703c8.exe Token: SeDebugPrivilege 2144 f7703c8.exe Token: SeDebugPrivilege 2144 f7703c8.exe Token: SeDebugPrivilege 2144 f7703c8.exe Token: SeDebugPrivilege 2144 f7703c8.exe Token: SeDebugPrivilege 2144 f7703c8.exe Token: SeDebugPrivilege 2144 f7703c8.exe Token: SeDebugPrivilege 2144 f7703c8.exe Token: SeDebugPrivilege 2144 f7703c8.exe Token: SeDebugPrivilege 2144 f7703c8.exe Token: SeDebugPrivilege 2144 f7703c8.exe Token: SeDebugPrivilege 2144 f7703c8.exe Token: SeDebugPrivilege 2144 f7703c8.exe Token: SeDebugPrivilege 2144 f7703c8.exe Token: SeDebugPrivilege 2144 f7703c8.exe Token: SeDebugPrivilege 2144 f7703c8.exe Token: SeDebugPrivilege 2144 f7703c8.exe Token: SeDebugPrivilege 2144 f7703c8.exe Token: SeDebugPrivilege 2144 f7703c8.exe Token: SeDebugPrivilege 2144 f7703c8.exe Token: SeDebugPrivilege 2144 f7703c8.exe Token: SeDebugPrivilege 2144 f7703c8.exe Token: SeDebugPrivilege 2144 f7703c8.exe -
Suspicious use of WriteProcessMemory 34 IoCs
description pid Process procid_target PID 2644 wrote to memory of 2856 2644 rundll32.exe 30 PID 2644 wrote to memory of 2856 2644 rundll32.exe 30 PID 2644 wrote to memory of 2856 2644 rundll32.exe 30 PID 2644 wrote to memory of 2856 2644 rundll32.exe 30 PID 2644 wrote to memory of 2856 2644 rundll32.exe 30 PID 2644 wrote to memory of 2856 2644 rundll32.exe 30 PID 2644 wrote to memory of 2856 2644 rundll32.exe 30 PID 2856 wrote to memory of 2144 2856 rundll32.exe 31 PID 2856 wrote to memory of 2144 2856 rundll32.exe 31 PID 2856 wrote to memory of 2144 2856 rundll32.exe 31 PID 2856 wrote to memory of 2144 2856 rundll32.exe 31 PID 2144 wrote to memory of 1116 2144 f7703c8.exe 19 PID 2144 wrote to memory of 1172 2144 f7703c8.exe 20 PID 2144 wrote to memory of 1196 2144 f7703c8.exe 21 PID 2144 wrote to memory of 1192 2144 f7703c8.exe 25 PID 2144 wrote to memory of 2644 2144 f7703c8.exe 29 PID 2144 wrote to memory of 2856 2144 f7703c8.exe 30 PID 2144 wrote to memory of 2856 2144 f7703c8.exe 30 PID 2856 wrote to memory of 2672 2856 rundll32.exe 32 PID 2856 wrote to memory of 2672 2856 rundll32.exe 32 PID 2856 wrote to memory of 2672 2856 rundll32.exe 32 PID 2856 wrote to memory of 2672 2856 rundll32.exe 32 PID 2856 wrote to memory of 2628 2856 rundll32.exe 33 PID 2856 wrote to memory of 2628 2856 rundll32.exe 33 PID 2856 wrote to memory of 2628 2856 rundll32.exe 33 PID 2856 wrote to memory of 2628 2856 rundll32.exe 33 PID 2144 wrote to memory of 1116 2144 f7703c8.exe 19 PID 2144 wrote to memory of 1172 2144 f7703c8.exe 20 PID 2144 wrote to memory of 1196 2144 f7703c8.exe 21 PID 2144 wrote to memory of 1192 2144 f7703c8.exe 25 PID 2144 wrote to memory of 2672 2144 f7703c8.exe 32 PID 2144 wrote to memory of 2672 2144 f7703c8.exe 32 PID 2144 wrote to memory of 2628 2144 f7703c8.exe 33 PID 2144 wrote to memory of 2628 2144 f7703c8.exe 33 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f7703c8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f7705ac.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1116
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1172
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1196
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1576a15cba5a0a9e24f0846b019db18434b7062a0cfd8fdc73a12b3ee62f0be4.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1576a15cba5a0a9e24f0846b019db18434b7062a0cfd8fdc73a12b3ee62f0be4.dll,#13⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\f7703c8.exeC:\Users\Admin\AppData\Local\Temp\f7703c8.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2144
-
-
C:\Users\Admin\AppData\Local\Temp\f7705ac.exeC:\Users\Admin\AppData\Local\Temp\f7705ac.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- System policy modification
PID:2672
-
-
C:\Users\Admin\AppData\Local\Temp\f771f72.exeC:\Users\Admin\AppData\Local\Temp\f771f72.exe4⤵
- Executes dropped EXE
PID:2628
-
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1192
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD5cf4f0c4ed0258f2e372fe8a002602b51
SHA19083c4d1927115e28f7edad58659d71c3129e23e
SHA256662c9e87d28efef397704048d62ab4f634f9e1798223322e14bc371f059bc6f6
SHA5125a838ef66118cbeea1d63203917d46bca03afc2172a3df16fbbb61fa99c91e2977a5757d41358c360dce511fe21cdad2be70cda6a8904fe046ba4b90c3ecb0f1