Analysis
-
max time kernel
27s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 09:22
Static task
static1
Behavioral task
behavioral1
Sample
5ad27176608dae8e7b2833f8fc41b1051f532996dbfbf1c838910e7d38c04eacN.dll
Resource
win7-20240708-en
General
-
Target
5ad27176608dae8e7b2833f8fc41b1051f532996dbfbf1c838910e7d38c04eacN.dll
-
Size
120KB
-
MD5
b60ecec4e897b588d82f0f6979731480
-
SHA1
51e13f7ea436c940d5ca5808da4cffaaee9aa664
-
SHA256
5ad27176608dae8e7b2833f8fc41b1051f532996dbfbf1c838910e7d38c04eac
-
SHA512
3cf83f9406760f8a3fd12ec6908600d73197a057e72c764cb267c74454a1392d35c0100f6c4023fe4894a6261dadf95c2c648fd6a7f3cc8eec67c89919e74662
-
SSDEEP
3072:Ho+CyN4Xnld4YwjcNi+g4dzAm8Ws4Py7+1:7Cyanld4HGPJdznjDPy0
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f76b79c.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f76b79c.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f76b79c.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f76b960.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f76b960.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f76b960.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76b79c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76b960.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76b960.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76b960.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76b79c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76b79c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76b79c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76b79c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76b960.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76b960.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76b960.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76b960.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76b79c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76b79c.exe -
Executes dropped EXE 3 IoCs
pid Process 2384 f76b79c.exe 524 f76b960.exe 2920 f76d346.exe -
Loads dropped DLL 6 IoCs
pid Process 2372 rundll32.exe 2372 rundll32.exe 2372 rundll32.exe 2372 rundll32.exe 2372 rundll32.exe 2372 rundll32.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f76b960.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76b79c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f76b79c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76b960.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76b960.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76b79c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76b79c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76b79c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76b960.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76b960.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76b960.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76b79c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76b960.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76b79c.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76b79c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76b960.exe -
Enumerates connected drives 3 TTPs 15 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: f76b79c.exe File opened (read-only) \??\G: f76b79c.exe File opened (read-only) \??\M: f76b79c.exe File opened (read-only) \??\Q: f76b79c.exe File opened (read-only) \??\H: f76b79c.exe File opened (read-only) \??\P: f76b79c.exe File opened (read-only) \??\T: f76b79c.exe File opened (read-only) \??\K: f76b79c.exe File opened (read-only) \??\L: f76b79c.exe File opened (read-only) \??\N: f76b79c.exe File opened (read-only) \??\R: f76b79c.exe File opened (read-only) \??\S: f76b79c.exe File opened (read-only) \??\I: f76b79c.exe File opened (read-only) \??\J: f76b79c.exe File opened (read-only) \??\O: f76b79c.exe -
resource yara_rule behavioral1/memory/2384-20-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/2384-21-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/2384-15-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/2384-24-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/2384-25-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/2384-23-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/2384-22-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/2384-19-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/2384-26-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/2384-18-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/2384-17-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/2384-65-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/2384-64-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/2384-66-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/2384-67-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/2384-68-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/2384-70-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/2384-71-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/2384-85-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/2384-88-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/2384-92-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/2384-162-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/524-176-0x0000000000910000-0x00000000019CA000-memory.dmp upx behavioral1/memory/524-201-0x0000000000910000-0x00000000019CA000-memory.dmp upx -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\f77084a f76b960.exe File created C:\Windows\f76b7ea f76b79c.exe File opened for modification C:\Windows\SYSTEM.INI f76b79c.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f76b79c.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f76b960.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2384 f76b79c.exe 2384 f76b79c.exe 524 f76b960.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeDebugPrivilege 2384 f76b79c.exe Token: SeDebugPrivilege 2384 f76b79c.exe Token: SeDebugPrivilege 2384 f76b79c.exe Token: SeDebugPrivilege 2384 f76b79c.exe Token: SeDebugPrivilege 2384 f76b79c.exe Token: SeDebugPrivilege 2384 f76b79c.exe Token: SeDebugPrivilege 2384 f76b79c.exe Token: SeDebugPrivilege 2384 f76b79c.exe Token: SeDebugPrivilege 2384 f76b79c.exe Token: SeDebugPrivilege 2384 f76b79c.exe Token: SeDebugPrivilege 2384 f76b79c.exe Token: SeDebugPrivilege 2384 f76b79c.exe Token: SeDebugPrivilege 2384 f76b79c.exe Token: SeDebugPrivilege 2384 f76b79c.exe Token: SeDebugPrivilege 2384 f76b79c.exe Token: SeDebugPrivilege 2384 f76b79c.exe Token: SeDebugPrivilege 2384 f76b79c.exe Token: SeDebugPrivilege 2384 f76b79c.exe Token: SeDebugPrivilege 2384 f76b79c.exe Token: SeDebugPrivilege 2384 f76b79c.exe Token: SeDebugPrivilege 2384 f76b79c.exe Token: SeDebugPrivilege 2384 f76b79c.exe Token: SeDebugPrivilege 2384 f76b79c.exe Token: SeDebugPrivilege 2384 f76b79c.exe Token: SeDebugPrivilege 524 f76b960.exe Token: SeDebugPrivilege 524 f76b960.exe Token: SeDebugPrivilege 524 f76b960.exe Token: SeDebugPrivilege 524 f76b960.exe Token: SeDebugPrivilege 524 f76b960.exe Token: SeDebugPrivilege 524 f76b960.exe Token: SeDebugPrivilege 524 f76b960.exe Token: SeDebugPrivilege 524 f76b960.exe Token: SeDebugPrivilege 524 f76b960.exe Token: SeDebugPrivilege 524 f76b960.exe Token: SeDebugPrivilege 524 f76b960.exe Token: SeDebugPrivilege 524 f76b960.exe Token: SeDebugPrivilege 524 f76b960.exe Token: SeDebugPrivilege 524 f76b960.exe Token: SeDebugPrivilege 524 f76b960.exe Token: SeDebugPrivilege 524 f76b960.exe Token: SeDebugPrivilege 524 f76b960.exe Token: SeDebugPrivilege 524 f76b960.exe Token: SeDebugPrivilege 524 f76b960.exe Token: SeDebugPrivilege 524 f76b960.exe Token: SeDebugPrivilege 524 f76b960.exe Token: SeDebugPrivilege 524 f76b960.exe -
Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 1244 wrote to memory of 2372 1244 rundll32.exe 30 PID 1244 wrote to memory of 2372 1244 rundll32.exe 30 PID 1244 wrote to memory of 2372 1244 rundll32.exe 30 PID 1244 wrote to memory of 2372 1244 rundll32.exe 30 PID 1244 wrote to memory of 2372 1244 rundll32.exe 30 PID 1244 wrote to memory of 2372 1244 rundll32.exe 30 PID 1244 wrote to memory of 2372 1244 rundll32.exe 30 PID 2372 wrote to memory of 2384 2372 rundll32.exe 31 PID 2372 wrote to memory of 2384 2372 rundll32.exe 31 PID 2372 wrote to memory of 2384 2372 rundll32.exe 31 PID 2372 wrote to memory of 2384 2372 rundll32.exe 31 PID 2384 wrote to memory of 1112 2384 f76b79c.exe 19 PID 2384 wrote to memory of 1172 2384 f76b79c.exe 20 PID 2384 wrote to memory of 1204 2384 f76b79c.exe 21 PID 2384 wrote to memory of 284 2384 f76b79c.exe 25 PID 2384 wrote to memory of 1244 2384 f76b79c.exe 29 PID 2384 wrote to memory of 2372 2384 f76b79c.exe 30 PID 2384 wrote to memory of 2372 2384 f76b79c.exe 30 PID 2372 wrote to memory of 524 2372 rundll32.exe 32 PID 2372 wrote to memory of 524 2372 rundll32.exe 32 PID 2372 wrote to memory of 524 2372 rundll32.exe 32 PID 2372 wrote to memory of 524 2372 rundll32.exe 32 PID 2372 wrote to memory of 2920 2372 rundll32.exe 34 PID 2372 wrote to memory of 2920 2372 rundll32.exe 34 PID 2372 wrote to memory of 2920 2372 rundll32.exe 34 PID 2372 wrote to memory of 2920 2372 rundll32.exe 34 PID 2384 wrote to memory of 1112 2384 f76b79c.exe 19 PID 2384 wrote to memory of 1172 2384 f76b79c.exe 20 PID 2384 wrote to memory of 1204 2384 f76b79c.exe 21 PID 2384 wrote to memory of 284 2384 f76b79c.exe 25 PID 2384 wrote to memory of 524 2384 f76b79c.exe 32 PID 2384 wrote to memory of 524 2384 f76b79c.exe 32 PID 2384 wrote to memory of 2920 2384 f76b79c.exe 34 PID 2384 wrote to memory of 2920 2384 f76b79c.exe 34 PID 524 wrote to memory of 1112 524 f76b960.exe 19 PID 524 wrote to memory of 1172 524 f76b960.exe 20 PID 524 wrote to memory of 1204 524 f76b960.exe 21 PID 524 wrote to memory of 284 524 f76b960.exe 25 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76b79c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76b960.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1112
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1172
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1204
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5ad27176608dae8e7b2833f8fc41b1051f532996dbfbf1c838910e7d38c04eacN.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5ad27176608dae8e7b2833f8fc41b1051f532996dbfbf1c838910e7d38c04eacN.dll,#13⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\f76b79c.exeC:\Users\Admin\AppData\Local\Temp\f76b79c.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2384
-
-
C:\Users\Admin\AppData\Local\Temp\f76b960.exeC:\Users\Admin\AppData\Local\Temp\f76b960.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:524
-
-
C:\Users\Admin\AppData\Local\Temp\f76d346.exeC:\Users\Admin\AppData\Local\Temp\f76d346.exe4⤵
- Executes dropped EXE
PID:2920
-
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:284
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD59f6dc47fa19382690d19ed8a359696f1
SHA10a673df77cb1219e5372db041ddcf9fafe31328a
SHA256bc2793599caa0e6703b7370c3508de4543ef98e7581be1ed55acd4731ab59148
SHA51283c673802c192a7866faef2e077fa1b85bde25429a0efc9df48471bf0431617b0c24a03f11574c012dc83e5ab145ea86dad736439324724dc7a9a3a002b8c450
-
Filesize
257B
MD5889c27bd6f28def2358272582621e93b
SHA13c6e997a0185b99fff3e7f23c4bbb7d12c9d009a
SHA2560601414b32d8bb65d846909e1f29a974ca073225b60a3c3889eb72c0e4ea7758
SHA512a541b65fa4fbcdd09e3f9de22ee0e6d89948baa229f51c1e58513ba71de5f54babe6e5851fabe9f0cbf519712805d7fbf944855265d6a6d4e44b1a362aeb3f9e