Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
20-12-2024 04:27
Static task
static1
Behavioral task
behavioral1
Sample
9c1054f7f33dd2d87546e499b6bd4fba6e217f91ea028586575664e8b42a3f72.dll
Resource
win7-20241023-en
General
-
Target
9c1054f7f33dd2d87546e499b6bd4fba6e217f91ea028586575664e8b42a3f72.dll
-
Size
120KB
-
MD5
965da73d34db48a935c7af0a15191aa8
-
SHA1
6140db745edca7c83ba79bd02e9c1e3ea49f5cdf
-
SHA256
9c1054f7f33dd2d87546e499b6bd4fba6e217f91ea028586575664e8b42a3f72
-
SHA512
ba1ed188af0eb4eb5479bae8c68437b671c5b491eeced083760c9ffca78c9058b85ea216d81c346b0185ea57ed7ab22c9de8bbcb5a41d6f6e7e7b39b815720ed
-
SSDEEP
1536:pb1O0BRgUt2rmHvb1WNR/xt/z7Bd9uepicJxG3oMqbxu/xpMnro:pxNRgUtvPb1gxtrFDjpiCQ7qWEnro
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f76c810.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f76c810.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f76ac65.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f76ac65.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f76ac65.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f76c810.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76c810.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76ac65.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76ac65.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76ac65.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76c810.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76c810.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76ac65.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76ac65.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76ac65.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76ac65.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76c810.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76c810.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76c810.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76c810.exe -
Executes dropped EXE 3 IoCs
pid Process 2432 f76ac65.exe 2288 f76ae0b.exe 2712 f76c810.exe -
Loads dropped DLL 6 IoCs
pid Process 1788 rundll32.exe 1788 rundll32.exe 1788 rundll32.exe 1788 rundll32.exe 1788 rundll32.exe 1788 rundll32.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f76ac65.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76c810.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76c810.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76c810.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f76c810.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76ac65.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76c810.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76c810.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76ac65.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76c810.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76ac65.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76ac65.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76ac65.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76ac65.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76ac65.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76c810.exe -
Enumerates connected drives 3 TTPs 17 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: f76ac65.exe File opened (read-only) \??\I: f76ac65.exe File opened (read-only) \??\Q: f76ac65.exe File opened (read-only) \??\S: f76ac65.exe File opened (read-only) \??\G: f76ac65.exe File opened (read-only) \??\J: f76ac65.exe File opened (read-only) \??\M: f76ac65.exe File opened (read-only) \??\N: f76ac65.exe File opened (read-only) \??\P: f76ac65.exe File opened (read-only) \??\T: f76ac65.exe File opened (read-only) \??\L: f76ac65.exe File opened (read-only) \??\O: f76ac65.exe File opened (read-only) \??\H: f76ac65.exe File opened (read-only) \??\K: f76ac65.exe File opened (read-only) \??\R: f76ac65.exe File opened (read-only) \??\E: f76c810.exe File opened (read-only) \??\G: f76c810.exe -
resource yara_rule behavioral1/memory/2432-14-0x00000000005E0000-0x000000000169A000-memory.dmp upx behavioral1/memory/2432-18-0x00000000005E0000-0x000000000169A000-memory.dmp upx behavioral1/memory/2432-20-0x00000000005E0000-0x000000000169A000-memory.dmp upx behavioral1/memory/2432-17-0x00000000005E0000-0x000000000169A000-memory.dmp upx behavioral1/memory/2432-23-0x00000000005E0000-0x000000000169A000-memory.dmp upx behavioral1/memory/2432-21-0x00000000005E0000-0x000000000169A000-memory.dmp upx behavioral1/memory/2432-19-0x00000000005E0000-0x000000000169A000-memory.dmp upx behavioral1/memory/2432-16-0x00000000005E0000-0x000000000169A000-memory.dmp upx behavioral1/memory/2432-22-0x00000000005E0000-0x000000000169A000-memory.dmp upx behavioral1/memory/2432-24-0x00000000005E0000-0x000000000169A000-memory.dmp upx behavioral1/memory/2432-60-0x00000000005E0000-0x000000000169A000-memory.dmp upx behavioral1/memory/2432-61-0x00000000005E0000-0x000000000169A000-memory.dmp upx behavioral1/memory/2432-62-0x00000000005E0000-0x000000000169A000-memory.dmp upx behavioral1/memory/2432-64-0x00000000005E0000-0x000000000169A000-memory.dmp upx behavioral1/memory/2432-63-0x00000000005E0000-0x000000000169A000-memory.dmp upx behavioral1/memory/2432-66-0x00000000005E0000-0x000000000169A000-memory.dmp upx behavioral1/memory/2432-67-0x00000000005E0000-0x000000000169A000-memory.dmp upx behavioral1/memory/2432-81-0x00000000005E0000-0x000000000169A000-memory.dmp upx behavioral1/memory/2432-82-0x00000000005E0000-0x000000000169A000-memory.dmp upx behavioral1/memory/2432-85-0x00000000005E0000-0x000000000169A000-memory.dmp upx behavioral1/memory/2432-104-0x00000000005E0000-0x000000000169A000-memory.dmp upx behavioral1/memory/2432-106-0x00000000005E0000-0x000000000169A000-memory.dmp upx behavioral1/memory/2432-107-0x00000000005E0000-0x000000000169A000-memory.dmp upx behavioral1/memory/2432-148-0x00000000005E0000-0x000000000169A000-memory.dmp upx behavioral1/memory/2712-160-0x0000000000910000-0x00000000019CA000-memory.dmp upx behavioral1/memory/2712-201-0x0000000000910000-0x00000000019CA000-memory.dmp upx -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\f76ace2 f76ac65.exe File opened for modification C:\Windows\SYSTEM.INI f76ac65.exe File created C:\Windows\f76fca7 f76c810.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f76ac65.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f76c810.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2432 f76ac65.exe 2432 f76ac65.exe 2712 f76c810.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeDebugPrivilege 2432 f76ac65.exe Token: SeDebugPrivilege 2432 f76ac65.exe Token: SeDebugPrivilege 2432 f76ac65.exe Token: SeDebugPrivilege 2432 f76ac65.exe Token: SeDebugPrivilege 2432 f76ac65.exe Token: SeDebugPrivilege 2432 f76ac65.exe Token: SeDebugPrivilege 2432 f76ac65.exe Token: SeDebugPrivilege 2432 f76ac65.exe Token: SeDebugPrivilege 2432 f76ac65.exe Token: SeDebugPrivilege 2432 f76ac65.exe Token: SeDebugPrivilege 2432 f76ac65.exe Token: SeDebugPrivilege 2432 f76ac65.exe Token: SeDebugPrivilege 2432 f76ac65.exe Token: SeDebugPrivilege 2432 f76ac65.exe Token: SeDebugPrivilege 2432 f76ac65.exe Token: SeDebugPrivilege 2432 f76ac65.exe Token: SeDebugPrivilege 2432 f76ac65.exe Token: SeDebugPrivilege 2432 f76ac65.exe Token: SeDebugPrivilege 2432 f76ac65.exe Token: SeDebugPrivilege 2432 f76ac65.exe Token: SeDebugPrivilege 2432 f76ac65.exe Token: SeDebugPrivilege 2432 f76ac65.exe Token: SeDebugPrivilege 2432 f76ac65.exe Token: SeDebugPrivilege 2432 f76ac65.exe Token: SeDebugPrivilege 2712 f76c810.exe Token: SeDebugPrivilege 2712 f76c810.exe Token: SeDebugPrivilege 2712 f76c810.exe Token: SeDebugPrivilege 2712 f76c810.exe Token: SeDebugPrivilege 2712 f76c810.exe Token: SeDebugPrivilege 2712 f76c810.exe Token: SeDebugPrivilege 2712 f76c810.exe Token: SeDebugPrivilege 2712 f76c810.exe Token: SeDebugPrivilege 2712 f76c810.exe Token: SeDebugPrivilege 2712 f76c810.exe Token: SeDebugPrivilege 2712 f76c810.exe Token: SeDebugPrivilege 2712 f76c810.exe Token: SeDebugPrivilege 2712 f76c810.exe Token: SeDebugPrivilege 2712 f76c810.exe Token: SeDebugPrivilege 2712 f76c810.exe Token: SeDebugPrivilege 2712 f76c810.exe Token: SeDebugPrivilege 2712 f76c810.exe Token: SeDebugPrivilege 2712 f76c810.exe Token: SeDebugPrivilege 2712 f76c810.exe Token: SeDebugPrivilege 2712 f76c810.exe Token: SeDebugPrivilege 2712 f76c810.exe Token: SeDebugPrivilege 2712 f76c810.exe -
Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 1272 wrote to memory of 1788 1272 rundll32.exe 30 PID 1272 wrote to memory of 1788 1272 rundll32.exe 30 PID 1272 wrote to memory of 1788 1272 rundll32.exe 30 PID 1272 wrote to memory of 1788 1272 rundll32.exe 30 PID 1272 wrote to memory of 1788 1272 rundll32.exe 30 PID 1272 wrote to memory of 1788 1272 rundll32.exe 30 PID 1272 wrote to memory of 1788 1272 rundll32.exe 30 PID 1788 wrote to memory of 2432 1788 rundll32.exe 31 PID 1788 wrote to memory of 2432 1788 rundll32.exe 31 PID 1788 wrote to memory of 2432 1788 rundll32.exe 31 PID 1788 wrote to memory of 2432 1788 rundll32.exe 31 PID 2432 wrote to memory of 1104 2432 f76ac65.exe 19 PID 2432 wrote to memory of 1160 2432 f76ac65.exe 20 PID 2432 wrote to memory of 1200 2432 f76ac65.exe 21 PID 2432 wrote to memory of 1876 2432 f76ac65.exe 25 PID 2432 wrote to memory of 1272 2432 f76ac65.exe 29 PID 2432 wrote to memory of 1788 2432 f76ac65.exe 30 PID 2432 wrote to memory of 1788 2432 f76ac65.exe 30 PID 1788 wrote to memory of 2288 1788 rundll32.exe 32 PID 1788 wrote to memory of 2288 1788 rundll32.exe 32 PID 1788 wrote to memory of 2288 1788 rundll32.exe 32 PID 1788 wrote to memory of 2288 1788 rundll32.exe 32 PID 1788 wrote to memory of 2712 1788 rundll32.exe 33 PID 1788 wrote to memory of 2712 1788 rundll32.exe 33 PID 1788 wrote to memory of 2712 1788 rundll32.exe 33 PID 1788 wrote to memory of 2712 1788 rundll32.exe 33 PID 2432 wrote to memory of 1104 2432 f76ac65.exe 19 PID 2432 wrote to memory of 1160 2432 f76ac65.exe 20 PID 2432 wrote to memory of 1200 2432 f76ac65.exe 21 PID 2432 wrote to memory of 1876 2432 f76ac65.exe 25 PID 2432 wrote to memory of 2288 2432 f76ac65.exe 32 PID 2432 wrote to memory of 2288 2432 f76ac65.exe 32 PID 2432 wrote to memory of 2712 2432 f76ac65.exe 33 PID 2432 wrote to memory of 2712 2432 f76ac65.exe 33 PID 2712 wrote to memory of 1104 2712 f76c810.exe 19 PID 2712 wrote to memory of 1160 2712 f76c810.exe 20 PID 2712 wrote to memory of 1200 2712 f76c810.exe 21 PID 2712 wrote to memory of 1876 2712 f76c810.exe 25 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76c810.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76ac65.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1104
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1160
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1200
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9c1054f7f33dd2d87546e499b6bd4fba6e217f91ea028586575664e8b42a3f72.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9c1054f7f33dd2d87546e499b6bd4fba6e217f91ea028586575664e8b42a3f72.dll,#13⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\f76ac65.exeC:\Users\Admin\AppData\Local\Temp\f76ac65.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2432
-
-
C:\Users\Admin\AppData\Local\Temp\f76ae0b.exeC:\Users\Admin\AppData\Local\Temp\f76ae0b.exe4⤵
- Executes dropped EXE
PID:2288
-
-
C:\Users\Admin\AppData\Local\Temp\f76c810.exeC:\Users\Admin\AppData\Local\Temp\f76c810.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2712
-
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1876
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
257B
MD58d8f55db2d8f63e980a89e8f2e67f2b3
SHA1b93ae41ee810ff428538bd5eb0a5c76b970d9fd3
SHA2561debcaabf9ac8eb5a8c1ed1ca1eedaae01720bf9b2c27ae986fcd4e9901b72b8
SHA5125c1cb06a15c4693c68b9367843164e982a33dce8422bfb340e5c576613634f0e7c00ecc659e3b2323b8c79b95c8c32769d03e0f82233ed45b1984a5a3b52a8bb
-
Filesize
97KB
MD518fa6a9029d394c213856f3320c2ead0
SHA10d24f3bbbe2a93f17a0cd21e067874b22af7ebb1
SHA256d75161848e5549212f5bc5b49965171d52afb7bffa25db91ce3001695ff02c7f
SHA5125bf718d3df094d20f5ec3ea09a0afa9d502fc0a727d2b39ec45c9875942c5f2911264122c5af4edb0a1a5803929042e7692de7f8599b4e44826cd13106a050d1