Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
27s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20/12/2024, 01:34
Static task
static1
Behavioral task
behavioral1
Sample
0005fccb19fae2cf4df979e86c8165111ef686e3354934ca5400d3b7a474abdeN.dll
Resource
win7-20240903-en
General
-
Target
0005fccb19fae2cf4df979e86c8165111ef686e3354934ca5400d3b7a474abdeN.dll
-
Size
120KB
-
MD5
072850072997a7e56dfb84cf7f3d2300
-
SHA1
f8fd931a1516339b6e5f11fcade29865fd5cd2da
-
SHA256
0005fccb19fae2cf4df979e86c8165111ef686e3354934ca5400d3b7a474abde
-
SHA512
ed500e12b9c9d3f1ab9205b75ff624bc681809efed36cd2b43fa3223275e4631826711e328df5afe4a4cabb3e5b18268738f603ea03706e9f30c91da9f462dc3
-
SSDEEP
1536:P+NqEkM2KHKP6+J1bm/xvXOUbWuMLtrl8CVPEllffAAIYiwvzTIryGDf8dIofyx:PxX8HG6S1S/x2/fVqCAIxazcrt4mofC
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f76b54b.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f76b54b.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f76b54b.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f76b6f0.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f76b6f0.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f76b6f0.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76b54b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76b6f0.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76b54b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76b6f0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76b6f0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76b6f0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76b6f0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76b54b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76b54b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76b54b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76b54b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76b54b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76b6f0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76b6f0.exe -
Executes dropped EXE 3 IoCs
pid Process 2232 f76b54b.exe 2816 f76b6f0.exe 2576 f76d124.exe -
Loads dropped DLL 6 IoCs
pid Process 2504 rundll32.exe 2504 rundll32.exe 2504 rundll32.exe 2504 rundll32.exe 2504 rundll32.exe 2504 rundll32.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76b6f0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f76b6f0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76b54b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76b6f0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76b54b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f76b54b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76b54b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76b54b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76b6f0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76b6f0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76b6f0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76b6f0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76b54b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76b54b.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76b54b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76b6f0.exe -
Enumerates connected drives 3 TTPs 15 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Q: f76b54b.exe File opened (read-only) \??\I: f76b54b.exe File opened (read-only) \??\K: f76b54b.exe File opened (read-only) \??\M: f76b54b.exe File opened (read-only) \??\N: f76b54b.exe File opened (read-only) \??\G: f76b54b.exe File opened (read-only) \??\H: f76b54b.exe File opened (read-only) \??\L: f76b54b.exe File opened (read-only) \??\T: f76b54b.exe File opened (read-only) \??\J: f76b54b.exe File opened (read-only) \??\O: f76b54b.exe File opened (read-only) \??\S: f76b54b.exe File opened (read-only) \??\E: f76b54b.exe File opened (read-only) \??\P: f76b54b.exe File opened (read-only) \??\R: f76b54b.exe -
resource yara_rule behavioral1/memory/2232-14-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2232-17-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2232-21-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2232-23-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2232-24-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2232-20-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2232-18-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2232-16-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2232-22-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2232-19-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2232-63-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2232-64-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2232-65-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2232-67-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2232-66-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2232-69-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2232-70-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2232-85-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2232-87-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2232-88-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2232-161-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2816-174-0x0000000000910000-0x00000000019CA000-memory.dmp upx behavioral1/memory/2816-199-0x0000000000910000-0x00000000019CA000-memory.dmp upx -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\f76b5b8 f76b54b.exe File opened for modification C:\Windows\SYSTEM.INI f76b54b.exe File created C:\Windows\f77056d f76b6f0.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f76b54b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f76b6f0.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2232 f76b54b.exe 2232 f76b54b.exe 2816 f76b6f0.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeDebugPrivilege 2232 f76b54b.exe Token: SeDebugPrivilege 2232 f76b54b.exe Token: SeDebugPrivilege 2232 f76b54b.exe Token: SeDebugPrivilege 2232 f76b54b.exe Token: SeDebugPrivilege 2232 f76b54b.exe Token: SeDebugPrivilege 2232 f76b54b.exe Token: SeDebugPrivilege 2232 f76b54b.exe Token: SeDebugPrivilege 2232 f76b54b.exe Token: SeDebugPrivilege 2232 f76b54b.exe Token: SeDebugPrivilege 2232 f76b54b.exe Token: SeDebugPrivilege 2232 f76b54b.exe Token: SeDebugPrivilege 2232 f76b54b.exe Token: SeDebugPrivilege 2232 f76b54b.exe Token: SeDebugPrivilege 2232 f76b54b.exe Token: SeDebugPrivilege 2232 f76b54b.exe Token: SeDebugPrivilege 2232 f76b54b.exe Token: SeDebugPrivilege 2232 f76b54b.exe Token: SeDebugPrivilege 2232 f76b54b.exe Token: SeDebugPrivilege 2232 f76b54b.exe Token: SeDebugPrivilege 2232 f76b54b.exe Token: SeDebugPrivilege 2232 f76b54b.exe Token: SeDebugPrivilege 2232 f76b54b.exe Token: SeDebugPrivilege 2232 f76b54b.exe Token: SeDebugPrivilege 2232 f76b54b.exe Token: SeDebugPrivilege 2816 f76b6f0.exe Token: SeDebugPrivilege 2816 f76b6f0.exe Token: SeDebugPrivilege 2816 f76b6f0.exe Token: SeDebugPrivilege 2816 f76b6f0.exe Token: SeDebugPrivilege 2816 f76b6f0.exe Token: SeDebugPrivilege 2816 f76b6f0.exe Token: SeDebugPrivilege 2816 f76b6f0.exe Token: SeDebugPrivilege 2816 f76b6f0.exe Token: SeDebugPrivilege 2816 f76b6f0.exe Token: SeDebugPrivilege 2816 f76b6f0.exe Token: SeDebugPrivilege 2816 f76b6f0.exe Token: SeDebugPrivilege 2816 f76b6f0.exe Token: SeDebugPrivilege 2816 f76b6f0.exe Token: SeDebugPrivilege 2816 f76b6f0.exe Token: SeDebugPrivilege 2816 f76b6f0.exe Token: SeDebugPrivilege 2816 f76b6f0.exe Token: SeDebugPrivilege 2816 f76b6f0.exe Token: SeDebugPrivilege 2816 f76b6f0.exe Token: SeDebugPrivilege 2816 f76b6f0.exe Token: SeDebugPrivilege 2816 f76b6f0.exe Token: SeDebugPrivilege 2816 f76b6f0.exe Token: SeDebugPrivilege 2816 f76b6f0.exe -
Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 2500 wrote to memory of 2504 2500 rundll32.exe 30 PID 2500 wrote to memory of 2504 2500 rundll32.exe 30 PID 2500 wrote to memory of 2504 2500 rundll32.exe 30 PID 2500 wrote to memory of 2504 2500 rundll32.exe 30 PID 2500 wrote to memory of 2504 2500 rundll32.exe 30 PID 2500 wrote to memory of 2504 2500 rundll32.exe 30 PID 2500 wrote to memory of 2504 2500 rundll32.exe 30 PID 2504 wrote to memory of 2232 2504 rundll32.exe 31 PID 2504 wrote to memory of 2232 2504 rundll32.exe 31 PID 2504 wrote to memory of 2232 2504 rundll32.exe 31 PID 2504 wrote to memory of 2232 2504 rundll32.exe 31 PID 2232 wrote to memory of 1056 2232 f76b54b.exe 17 PID 2232 wrote to memory of 1084 2232 f76b54b.exe 19 PID 2232 wrote to memory of 1176 2232 f76b54b.exe 21 PID 2232 wrote to memory of 1760 2232 f76b54b.exe 25 PID 2232 wrote to memory of 2500 2232 f76b54b.exe 29 PID 2232 wrote to memory of 2504 2232 f76b54b.exe 30 PID 2232 wrote to memory of 2504 2232 f76b54b.exe 30 PID 2504 wrote to memory of 2816 2504 rundll32.exe 32 PID 2504 wrote to memory of 2816 2504 rundll32.exe 32 PID 2504 wrote to memory of 2816 2504 rundll32.exe 32 PID 2504 wrote to memory of 2816 2504 rundll32.exe 32 PID 2504 wrote to memory of 2576 2504 rundll32.exe 34 PID 2504 wrote to memory of 2576 2504 rundll32.exe 34 PID 2504 wrote to memory of 2576 2504 rundll32.exe 34 PID 2504 wrote to memory of 2576 2504 rundll32.exe 34 PID 2232 wrote to memory of 1056 2232 f76b54b.exe 17 PID 2232 wrote to memory of 1084 2232 f76b54b.exe 19 PID 2232 wrote to memory of 1176 2232 f76b54b.exe 21 PID 2232 wrote to memory of 1760 2232 f76b54b.exe 25 PID 2232 wrote to memory of 2816 2232 f76b54b.exe 32 PID 2232 wrote to memory of 2816 2232 f76b54b.exe 32 PID 2232 wrote to memory of 2576 2232 f76b54b.exe 34 PID 2232 wrote to memory of 2576 2232 f76b54b.exe 34 PID 2816 wrote to memory of 1056 2816 f76b6f0.exe 17 PID 2816 wrote to memory of 1084 2816 f76b6f0.exe 19 PID 2816 wrote to memory of 1176 2816 f76b6f0.exe 21 PID 2816 wrote to memory of 1760 2816 f76b6f0.exe 25 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76b6f0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76b54b.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1056
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1084
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1176
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0005fccb19fae2cf4df979e86c8165111ef686e3354934ca5400d3b7a474abdeN.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0005fccb19fae2cf4df979e86c8165111ef686e3354934ca5400d3b7a474abdeN.dll,#13⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\f76b54b.exeC:\Users\Admin\AppData\Local\Temp\f76b54b.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2232
-
-
C:\Users\Admin\AppData\Local\Temp\f76b6f0.exeC:\Users\Admin\AppData\Local\Temp\f76b6f0.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2816
-
-
C:\Users\Admin\AppData\Local\Temp\f76d124.exeC:\Users\Admin\AppData\Local\Temp\f76d124.exe4⤵
- Executes dropped EXE
PID:2576
-
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1760
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD5e255b7975f0944ab7c3259afb777dcb4
SHA1fcd167f479806b47931f97bfd1ce5b7f7b4561c4
SHA2563acae65e475976d134d20c7235527a8cac97f0b3abeac99592b131c2ab6c7689
SHA512f621a872f35cefc1964387eba0c743fdb4023387f827f4211ab413841312b6d4459a23ea90568a6674652f0f3b30226043fa5fcff3c7f78d0e6ef9cfc9a07768
-
Filesize
257B
MD5d629c0b42f47c3b82c088bc679a87409
SHA19ae25a4a69108929eac64c0b2b3665ed6b8bd1a7
SHA2560a74adf546e48fd5ecd775adfd3f31aa0904dd91a12058c0f8de381bec062cb9
SHA512aba222725d24a34b3b68cb9c705a99df4a5ee6560e3e917d9216b05321ebda2b713432e8694ae345ada26540bfe9bc75c41a0595965275e3b2c7954400613c68