Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
20-12-2024 00:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
620b0bab5c60ab814d3b5135676626d880f91e56ce692f0689cb90833ca31c76.dll
Resource
win7-20241010-en
windows7-x64
17 signatures
150 seconds
General
-
Target
620b0bab5c60ab814d3b5135676626d880f91e56ce692f0689cb90833ca31c76.dll
-
Size
120KB
-
MD5
cc0fd9b0d58626d415de6d97a9957a76
-
SHA1
7f7a010827cd9985d855ece5087eb9d2ca764ccd
-
SHA256
620b0bab5c60ab814d3b5135676626d880f91e56ce692f0689cb90833ca31c76
-
SHA512
b8f119f8825a8cf866f5234d37952a0aadb50fdc7ce00e26e43c18ffd23a741e6868c4b3235199702811363ecd7322684a1463e2f545acf12b9afa2f8c0d542d
-
SSDEEP
3072:HsyCQWozvCVnlaZNW/d8pPzQzxLHbLUC0a:NFCplaRpPMz97LU0
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f76e254.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f76fdb0.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f76fdb0.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f76fdb0.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f76e254.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f76e254.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76e254.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76fdb0.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76fdb0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76fdb0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76fdb0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76e254.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76e254.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76fdb0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76e254.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76fdb0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76fdb0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76e254.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76e254.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76e254.exe -
Executes dropped EXE 3 IoCs
pid Process 864 f76e254.exe 2400 f76e4e3.exe 2448 f76fdb0.exe -
Loads dropped DLL 6 IoCs
pid Process 1672 rundll32.exe 1672 rundll32.exe 1672 rundll32.exe 1672 rundll32.exe 1672 rundll32.exe 1672 rundll32.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76e254.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76e254.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76fdb0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76fdb0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76e254.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76fdb0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f76fdb0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76fdb0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76fdb0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76e254.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76e254.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76e254.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f76e254.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76fdb0.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76e254.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76fdb0.exe -
Enumerates connected drives 3 TTPs 15 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: f76fdb0.exe File opened (read-only) \??\I: f76e254.exe File opened (read-only) \??\J: f76e254.exe File opened (read-only) \??\O: f76e254.exe File opened (read-only) \??\S: f76e254.exe File opened (read-only) \??\R: f76e254.exe File opened (read-only) \??\E: f76e254.exe File opened (read-only) \??\K: f76e254.exe File opened (read-only) \??\L: f76e254.exe File opened (read-only) \??\N: f76e254.exe File opened (read-only) \??\P: f76e254.exe File opened (read-only) \??\Q: f76e254.exe File opened (read-only) \??\G: f76e254.exe File opened (read-only) \??\H: f76e254.exe File opened (read-only) \??\M: f76e254.exe -
resource yara_rule behavioral1/memory/864-14-0x0000000000660000-0x000000000171A000-memory.dmp upx behavioral1/memory/864-17-0x0000000000660000-0x000000000171A000-memory.dmp upx behavioral1/memory/864-19-0x0000000000660000-0x000000000171A000-memory.dmp upx behavioral1/memory/864-15-0x0000000000660000-0x000000000171A000-memory.dmp upx behavioral1/memory/864-23-0x0000000000660000-0x000000000171A000-memory.dmp upx behavioral1/memory/864-21-0x0000000000660000-0x000000000171A000-memory.dmp upx behavioral1/memory/864-20-0x0000000000660000-0x000000000171A000-memory.dmp upx behavioral1/memory/864-18-0x0000000000660000-0x000000000171A000-memory.dmp upx behavioral1/memory/864-16-0x0000000000660000-0x000000000171A000-memory.dmp upx behavioral1/memory/864-50-0x0000000000660000-0x000000000171A000-memory.dmp upx behavioral1/memory/864-51-0x0000000000660000-0x000000000171A000-memory.dmp upx behavioral1/memory/864-22-0x0000000000660000-0x000000000171A000-memory.dmp upx behavioral1/memory/864-60-0x0000000000660000-0x000000000171A000-memory.dmp upx behavioral1/memory/864-61-0x0000000000660000-0x000000000171A000-memory.dmp upx behavioral1/memory/864-62-0x0000000000660000-0x000000000171A000-memory.dmp upx behavioral1/memory/864-65-0x0000000000660000-0x000000000171A000-memory.dmp upx behavioral1/memory/864-66-0x0000000000660000-0x000000000171A000-memory.dmp upx behavioral1/memory/864-79-0x0000000000660000-0x000000000171A000-memory.dmp upx behavioral1/memory/864-81-0x0000000000660000-0x000000000171A000-memory.dmp upx behavioral1/memory/864-83-0x0000000000660000-0x000000000171A000-memory.dmp upx behavioral1/memory/864-86-0x0000000000660000-0x000000000171A000-memory.dmp upx behavioral1/memory/864-152-0x0000000000660000-0x000000000171A000-memory.dmp upx behavioral1/memory/2448-169-0x0000000000930000-0x00000000019EA000-memory.dmp upx behavioral1/memory/2448-206-0x0000000000930000-0x00000000019EA000-memory.dmp upx -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\f76e2c1 f76e254.exe File opened for modification C:\Windows\SYSTEM.INI f76e254.exe File created C:\Windows\f77386e f76fdb0.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f76e254.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f76fdb0.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 864 f76e254.exe 864 f76e254.exe 2448 f76fdb0.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeDebugPrivilege 864 f76e254.exe Token: SeDebugPrivilege 864 f76e254.exe Token: SeDebugPrivilege 864 f76e254.exe Token: SeDebugPrivilege 864 f76e254.exe Token: SeDebugPrivilege 864 f76e254.exe Token: SeDebugPrivilege 864 f76e254.exe Token: SeDebugPrivilege 864 f76e254.exe Token: SeDebugPrivilege 864 f76e254.exe Token: SeDebugPrivilege 864 f76e254.exe Token: SeDebugPrivilege 864 f76e254.exe Token: SeDebugPrivilege 864 f76e254.exe Token: SeDebugPrivilege 864 f76e254.exe Token: SeDebugPrivilege 864 f76e254.exe Token: SeDebugPrivilege 864 f76e254.exe Token: SeDebugPrivilege 864 f76e254.exe Token: SeDebugPrivilege 864 f76e254.exe Token: SeDebugPrivilege 864 f76e254.exe Token: SeDebugPrivilege 864 f76e254.exe Token: SeDebugPrivilege 864 f76e254.exe Token: SeDebugPrivilege 864 f76e254.exe Token: SeDebugPrivilege 864 f76e254.exe Token: SeDebugPrivilege 864 f76e254.exe Token: SeDebugPrivilege 864 f76e254.exe Token: SeDebugPrivilege 864 f76e254.exe Token: SeDebugPrivilege 2448 f76fdb0.exe Token: SeDebugPrivilege 2448 f76fdb0.exe Token: SeDebugPrivilege 2448 f76fdb0.exe Token: SeDebugPrivilege 2448 f76fdb0.exe Token: SeDebugPrivilege 2448 f76fdb0.exe Token: SeDebugPrivilege 2448 f76fdb0.exe Token: SeDebugPrivilege 2448 f76fdb0.exe Token: SeDebugPrivilege 2448 f76fdb0.exe Token: SeDebugPrivilege 2448 f76fdb0.exe Token: SeDebugPrivilege 2448 f76fdb0.exe Token: SeDebugPrivilege 2448 f76fdb0.exe Token: SeDebugPrivilege 2448 f76fdb0.exe Token: SeDebugPrivilege 2448 f76fdb0.exe Token: SeDebugPrivilege 2448 f76fdb0.exe Token: SeDebugPrivilege 2448 f76fdb0.exe Token: SeDebugPrivilege 2448 f76fdb0.exe Token: SeDebugPrivilege 2448 f76fdb0.exe Token: SeDebugPrivilege 2448 f76fdb0.exe Token: SeDebugPrivilege 2448 f76fdb0.exe Token: SeDebugPrivilege 2448 f76fdb0.exe Token: SeDebugPrivilege 2448 f76fdb0.exe Token: SeDebugPrivilege 2448 f76fdb0.exe -
Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 2328 wrote to memory of 1672 2328 rundll32.exe 31 PID 2328 wrote to memory of 1672 2328 rundll32.exe 31 PID 2328 wrote to memory of 1672 2328 rundll32.exe 31 PID 2328 wrote to memory of 1672 2328 rundll32.exe 31 PID 2328 wrote to memory of 1672 2328 rundll32.exe 31 PID 2328 wrote to memory of 1672 2328 rundll32.exe 31 PID 2328 wrote to memory of 1672 2328 rundll32.exe 31 PID 1672 wrote to memory of 864 1672 rundll32.exe 32 PID 1672 wrote to memory of 864 1672 rundll32.exe 32 PID 1672 wrote to memory of 864 1672 rundll32.exe 32 PID 1672 wrote to memory of 864 1672 rundll32.exe 32 PID 864 wrote to memory of 1076 864 f76e254.exe 18 PID 864 wrote to memory of 1136 864 f76e254.exe 19 PID 864 wrote to memory of 1196 864 f76e254.exe 21 PID 864 wrote to memory of 1580 864 f76e254.exe 23 PID 864 wrote to memory of 2328 864 f76e254.exe 30 PID 864 wrote to memory of 1672 864 f76e254.exe 31 PID 864 wrote to memory of 1672 864 f76e254.exe 31 PID 1672 wrote to memory of 2400 1672 rundll32.exe 33 PID 1672 wrote to memory of 2400 1672 rundll32.exe 33 PID 1672 wrote to memory of 2400 1672 rundll32.exe 33 PID 1672 wrote to memory of 2400 1672 rundll32.exe 33 PID 1672 wrote to memory of 2448 1672 rundll32.exe 34 PID 1672 wrote to memory of 2448 1672 rundll32.exe 34 PID 1672 wrote to memory of 2448 1672 rundll32.exe 34 PID 1672 wrote to memory of 2448 1672 rundll32.exe 34 PID 864 wrote to memory of 1076 864 f76e254.exe 18 PID 864 wrote to memory of 1136 864 f76e254.exe 19 PID 864 wrote to memory of 1196 864 f76e254.exe 21 PID 864 wrote to memory of 1580 864 f76e254.exe 23 PID 864 wrote to memory of 2400 864 f76e254.exe 33 PID 864 wrote to memory of 2400 864 f76e254.exe 33 PID 864 wrote to memory of 2448 864 f76e254.exe 34 PID 864 wrote to memory of 2448 864 f76e254.exe 34 PID 2448 wrote to memory of 1076 2448 f76fdb0.exe 18 PID 2448 wrote to memory of 1136 2448 f76fdb0.exe 19 PID 2448 wrote to memory of 1196 2448 f76fdb0.exe 21 PID 2448 wrote to memory of 1580 2448 f76fdb0.exe 23 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76e254.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76fdb0.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1076
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1136
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1196
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\620b0bab5c60ab814d3b5135676626d880f91e56ce692f0689cb90833ca31c76.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\620b0bab5c60ab814d3b5135676626d880f91e56ce692f0689cb90833ca31c76.dll,#13⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\f76e254.exeC:\Users\Admin\AppData\Local\Temp\f76e254.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:864
-
-
C:\Users\Admin\AppData\Local\Temp\f76e4e3.exeC:\Users\Admin\AppData\Local\Temp\f76e4e3.exe4⤵
- Executes dropped EXE
PID:2400
-
-
C:\Users\Admin\AppData\Local\Temp\f76fdb0.exeC:\Users\Admin\AppData\Local\Temp\f76fdb0.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2448
-
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1580
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
257B
MD5a01b91abd83c8363e56d6ca20b775323
SHA1ee527a722090944acb22acc1fb9d819e6f23c890
SHA25628be2a644882f6bf65113c8579c3eac9b0032c34adc7c02745922d32558ecc36
SHA51252fb162ba7b993cef693cd363ab56b163409fd89f4d75039a1d88792371e7971b073f7fb2e279c4b2557f9f5371f73c9bd7a6b5e8c4d7c48e6b306d7e0a04cff
-
Filesize
97KB
MD5b49eece445425a0336cc9c2f4e479384
SHA1a8da18de0b9ca6a9bd359c92abcef4e7bb96e0a3
SHA256e3a993d0fe81f4566db264c3b7569d43534455562dd0df795cdb747f7a3bba80
SHA512ec8a82b0e13bb6b3d0ada8a754b7251126e88c93cc4834bdf31e5df2826f73fb77d9ac6dbf6a18414754b302a3fbf61e2438d178ea30d4aa662fdf947978b00e