Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 12:03
Static task
static1
Behavioral task
behavioral1
Sample
9b3b170bbb3f39d42d115b2fad701689f154cddb2e3657648d60001adc3e0e3a.dll
Resource
win7-20241023-en
General
-
Target
9b3b170bbb3f39d42d115b2fad701689f154cddb2e3657648d60001adc3e0e3a.dll
-
Size
120KB
-
MD5
86aeb089a2395c21afa40275c472ab1f
-
SHA1
20ca0aeb17cebe9d7859420f48597255dd58c11f
-
SHA256
9b3b170bbb3f39d42d115b2fad701689f154cddb2e3657648d60001adc3e0e3a
-
SHA512
4d19dc140b0b4b07644586091a881e8c9d635c0b6f41d3d2966e63391efaf7b1731c8ddd7186216c8e5c9012871ef5644d7e2e510820880cca5cd749d472cdbc
-
SSDEEP
3072:tmF5Mklw0j5u0SOKfCbS0ucOGIPYS+hhN1hDnSqmQnbHRC:tm5l7be9EJLSqJbxC
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f76afbf.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f76afbf.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f76afbf.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f76b1a3.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f76b1a3.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f76b1a3.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76afbf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76b1a3.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76afbf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76afbf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76b1a3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76b1a3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76b1a3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76afbf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76afbf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76afbf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76b1a3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76b1a3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76b1a3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76afbf.exe -
Executes dropped EXE 3 IoCs
pid Process 2488 f76afbf.exe 2804 f76b1a3.exe 2752 f76cb99.exe -
Loads dropped DLL 6 IoCs
pid Process 1124 rundll32.exe 1124 rundll32.exe 1124 rundll32.exe 1124 rundll32.exe 1124 rundll32.exe 1124 rundll32.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f76afbf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76b1a3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76afbf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76b1a3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f76b1a3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76afbf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76afbf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76b1a3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76afbf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76b1a3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76b1a3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76b1a3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76afbf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76afbf.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76afbf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76b1a3.exe -
Enumerates connected drives 3 TTPs 15 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: f76afbf.exe File opened (read-only) \??\J: f76afbf.exe File opened (read-only) \??\K: f76afbf.exe File opened (read-only) \??\O: f76afbf.exe File opened (read-only) \??\P: f76afbf.exe File opened (read-only) \??\R: f76afbf.exe File opened (read-only) \??\T: f76afbf.exe File opened (read-only) \??\I: f76afbf.exe File opened (read-only) \??\N: f76afbf.exe File opened (read-only) \??\Q: f76afbf.exe File opened (read-only) \??\S: f76afbf.exe File opened (read-only) \??\G: f76afbf.exe File opened (read-only) \??\H: f76afbf.exe File opened (read-only) \??\L: f76afbf.exe File opened (read-only) \??\M: f76afbf.exe -
resource yara_rule behavioral1/memory/2488-15-0x00000000006D0000-0x000000000178A000-memory.dmp upx behavioral1/memory/2488-19-0x00000000006D0000-0x000000000178A000-memory.dmp upx behavioral1/memory/2488-18-0x00000000006D0000-0x000000000178A000-memory.dmp upx behavioral1/memory/2488-25-0x00000000006D0000-0x000000000178A000-memory.dmp upx behavioral1/memory/2488-24-0x00000000006D0000-0x000000000178A000-memory.dmp upx behavioral1/memory/2488-22-0x00000000006D0000-0x000000000178A000-memory.dmp upx behavioral1/memory/2488-21-0x00000000006D0000-0x000000000178A000-memory.dmp upx behavioral1/memory/2488-20-0x00000000006D0000-0x000000000178A000-memory.dmp upx behavioral1/memory/2488-23-0x00000000006D0000-0x000000000178A000-memory.dmp upx behavioral1/memory/2488-17-0x00000000006D0000-0x000000000178A000-memory.dmp upx behavioral1/memory/2488-62-0x00000000006D0000-0x000000000178A000-memory.dmp upx behavioral1/memory/2488-63-0x00000000006D0000-0x000000000178A000-memory.dmp upx behavioral1/memory/2488-64-0x00000000006D0000-0x000000000178A000-memory.dmp upx behavioral1/memory/2488-65-0x00000000006D0000-0x000000000178A000-memory.dmp upx behavioral1/memory/2488-66-0x00000000006D0000-0x000000000178A000-memory.dmp upx behavioral1/memory/2488-68-0x00000000006D0000-0x000000000178A000-memory.dmp upx behavioral1/memory/2488-69-0x00000000006D0000-0x000000000178A000-memory.dmp upx behavioral1/memory/2488-82-0x00000000006D0000-0x000000000178A000-memory.dmp upx behavioral1/memory/2488-83-0x00000000006D0000-0x000000000178A000-memory.dmp upx behavioral1/memory/2488-87-0x00000000006D0000-0x000000000178A000-memory.dmp upx behavioral1/memory/2488-88-0x00000000006D0000-0x000000000178A000-memory.dmp upx behavioral1/memory/2488-159-0x00000000006D0000-0x000000000178A000-memory.dmp upx behavioral1/memory/2804-172-0x0000000000910000-0x00000000019CA000-memory.dmp upx behavioral1/memory/2804-199-0x0000000000910000-0x00000000019CA000-memory.dmp upx -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\f7701c5 f76b1a3.exe File created C:\Windows\f76b05b f76afbf.exe File opened for modification C:\Windows\SYSTEM.INI f76afbf.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f76afbf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f76b1a3.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2488 f76afbf.exe 2488 f76afbf.exe 2804 f76b1a3.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeDebugPrivilege 2488 f76afbf.exe Token: SeDebugPrivilege 2488 f76afbf.exe Token: SeDebugPrivilege 2488 f76afbf.exe Token: SeDebugPrivilege 2488 f76afbf.exe Token: SeDebugPrivilege 2488 f76afbf.exe Token: SeDebugPrivilege 2488 f76afbf.exe Token: SeDebugPrivilege 2488 f76afbf.exe Token: SeDebugPrivilege 2488 f76afbf.exe Token: SeDebugPrivilege 2488 f76afbf.exe Token: SeDebugPrivilege 2488 f76afbf.exe Token: SeDebugPrivilege 2488 f76afbf.exe Token: SeDebugPrivilege 2488 f76afbf.exe Token: SeDebugPrivilege 2488 f76afbf.exe Token: SeDebugPrivilege 2488 f76afbf.exe Token: SeDebugPrivilege 2488 f76afbf.exe Token: SeDebugPrivilege 2488 f76afbf.exe Token: SeDebugPrivilege 2488 f76afbf.exe Token: SeDebugPrivilege 2488 f76afbf.exe Token: SeDebugPrivilege 2488 f76afbf.exe Token: SeDebugPrivilege 2488 f76afbf.exe Token: SeDebugPrivilege 2488 f76afbf.exe Token: SeDebugPrivilege 2488 f76afbf.exe Token: SeDebugPrivilege 2488 f76afbf.exe Token: SeDebugPrivilege 2488 f76afbf.exe Token: SeDebugPrivilege 2804 f76b1a3.exe Token: SeDebugPrivilege 2804 f76b1a3.exe Token: SeDebugPrivilege 2804 f76b1a3.exe Token: SeDebugPrivilege 2804 f76b1a3.exe Token: SeDebugPrivilege 2804 f76b1a3.exe Token: SeDebugPrivilege 2804 f76b1a3.exe Token: SeDebugPrivilege 2804 f76b1a3.exe Token: SeDebugPrivilege 2804 f76b1a3.exe Token: SeDebugPrivilege 2804 f76b1a3.exe Token: SeDebugPrivilege 2804 f76b1a3.exe Token: SeDebugPrivilege 2804 f76b1a3.exe Token: SeDebugPrivilege 2804 f76b1a3.exe Token: SeDebugPrivilege 2804 f76b1a3.exe Token: SeDebugPrivilege 2804 f76b1a3.exe Token: SeDebugPrivilege 2804 f76b1a3.exe Token: SeDebugPrivilege 2804 f76b1a3.exe Token: SeDebugPrivilege 2804 f76b1a3.exe Token: SeDebugPrivilege 2804 f76b1a3.exe Token: SeDebugPrivilege 2804 f76b1a3.exe Token: SeDebugPrivilege 2804 f76b1a3.exe Token: SeDebugPrivilege 2804 f76b1a3.exe Token: SeDebugPrivilege 2804 f76b1a3.exe -
Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 772 wrote to memory of 1124 772 rundll32.exe 30 PID 772 wrote to memory of 1124 772 rundll32.exe 30 PID 772 wrote to memory of 1124 772 rundll32.exe 30 PID 772 wrote to memory of 1124 772 rundll32.exe 30 PID 772 wrote to memory of 1124 772 rundll32.exe 30 PID 772 wrote to memory of 1124 772 rundll32.exe 30 PID 772 wrote to memory of 1124 772 rundll32.exe 30 PID 1124 wrote to memory of 2488 1124 rundll32.exe 31 PID 1124 wrote to memory of 2488 1124 rundll32.exe 31 PID 1124 wrote to memory of 2488 1124 rundll32.exe 31 PID 1124 wrote to memory of 2488 1124 rundll32.exe 31 PID 2488 wrote to memory of 1100 2488 f76afbf.exe 19 PID 2488 wrote to memory of 1156 2488 f76afbf.exe 20 PID 2488 wrote to memory of 1192 2488 f76afbf.exe 21 PID 2488 wrote to memory of 1388 2488 f76afbf.exe 23 PID 2488 wrote to memory of 772 2488 f76afbf.exe 29 PID 2488 wrote to memory of 1124 2488 f76afbf.exe 30 PID 2488 wrote to memory of 1124 2488 f76afbf.exe 30 PID 1124 wrote to memory of 2804 1124 rundll32.exe 32 PID 1124 wrote to memory of 2804 1124 rundll32.exe 32 PID 1124 wrote to memory of 2804 1124 rundll32.exe 32 PID 1124 wrote to memory of 2804 1124 rundll32.exe 32 PID 1124 wrote to memory of 2752 1124 rundll32.exe 34 PID 1124 wrote to memory of 2752 1124 rundll32.exe 34 PID 1124 wrote to memory of 2752 1124 rundll32.exe 34 PID 1124 wrote to memory of 2752 1124 rundll32.exe 34 PID 2488 wrote to memory of 1100 2488 f76afbf.exe 19 PID 2488 wrote to memory of 1156 2488 f76afbf.exe 20 PID 2488 wrote to memory of 1192 2488 f76afbf.exe 21 PID 2488 wrote to memory of 1388 2488 f76afbf.exe 23 PID 2488 wrote to memory of 2804 2488 f76afbf.exe 32 PID 2488 wrote to memory of 2804 2488 f76afbf.exe 32 PID 2488 wrote to memory of 2752 2488 f76afbf.exe 34 PID 2488 wrote to memory of 2752 2488 f76afbf.exe 34 PID 2804 wrote to memory of 1100 2804 f76b1a3.exe 19 PID 2804 wrote to memory of 1156 2804 f76b1a3.exe 20 PID 2804 wrote to memory of 1192 2804 f76b1a3.exe 21 PID 2804 wrote to memory of 1388 2804 f76b1a3.exe 23 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76afbf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76b1a3.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1100
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1156
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1192
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9b3b170bbb3f39d42d115b2fad701689f154cddb2e3657648d60001adc3e0e3a.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:772 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9b3b170bbb3f39d42d115b2fad701689f154cddb2e3657648d60001adc3e0e3a.dll,#13⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1124 -
C:\Users\Admin\AppData\Local\Temp\f76afbf.exeC:\Users\Admin\AppData\Local\Temp\f76afbf.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2488
-
-
C:\Users\Admin\AppData\Local\Temp\f76b1a3.exeC:\Users\Admin\AppData\Local\Temp\f76b1a3.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2804
-
-
C:\Users\Admin\AppData\Local\Temp\f76cb99.exeC:\Users\Admin\AppData\Local\Temp\f76cb99.exe4⤵
- Executes dropped EXE
PID:2752
-
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1388
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
257B
MD5b94d3ec0f07a1c6e99bc9419aa8487ae
SHA14a1d802e559f426930150d8e8dd6694bc14d6b29
SHA256202c38f059cd78e7a6f1308b5f95803138809bbd16f691bbd53dbced534ce325
SHA5124b4592e6530c5fd66aecc0341a0fd30f7950c55740c6655771e2ea7cba9d7b7d534ceadb374780f0186595238662d61c994374caa0fc1668ca0cb8b544b15b03
-
Filesize
97KB
MD53737e71afb6f2bb2581baf33d0d1480b
SHA19f1e0831c229df901ef95e3f41fdc476eaca0152
SHA256cc9820428c01f5e3bed586e85727be81269a3a746f5fff7dd65882cc7f31ff81
SHA512b6098c3fa29f3965de2c25472a633779c035a9d65466c33d41c97bd000ad067d8252ce009e990d96505fed0729cbffb283da78def32b57e991ca5bdf533d6ba7