Analysis
-
max time kernel
29s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20-12-2024 05:02
Static task
static1
Behavioral task
behavioral1
Sample
4818d5262276f87833c87ab29ef1a6da1eab4b2a2fa7f62c2a6bfa4192390ec8N.dll
Resource
win7-20240903-en
General
-
Target
4818d5262276f87833c87ab29ef1a6da1eab4b2a2fa7f62c2a6bfa4192390ec8N.dll
-
Size
120KB
-
MD5
f69d5738f6e60ad76b45a53976534740
-
SHA1
42243554db53296ec078a877a1874fa04f433e05
-
SHA256
4818d5262276f87833c87ab29ef1a6da1eab4b2a2fa7f62c2a6bfa4192390ec8
-
SHA512
378e696b4ea1073445c38bb713668638fb0264cbdd9b26d9871a1d718d2487439e26e1b306e42f3f1ce07d54dd47892d104e5713440af8d5c4133024fae7f834
-
SSDEEP
3072:KL8soUkHY96RI6PELCJdYrqn5dhm1ADl:9szJ9EIYAWd7l
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f76bd75.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f76bd75.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f769ccc.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f769ccc.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f769ccc.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f76bd75.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f769ccc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76bd75.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f769ccc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76bd75.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76bd75.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76bd75.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76bd75.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f769ccc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f769ccc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f769ccc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f769ccc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f769ccc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76bd75.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76bd75.exe -
Executes dropped EXE 3 IoCs
pid Process 2416 f769ccc.exe 2904 f769e81.exe 3040 f76bd75.exe -
Loads dropped DLL 6 IoCs
pid Process 2288 rundll32.exe 2288 rundll32.exe 2288 rundll32.exe 2288 rundll32.exe 2288 rundll32.exe 2288 rundll32.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76bd75.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f769ccc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f769ccc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f769ccc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f769ccc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76bd75.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76bd75.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76bd75.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76bd75.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f769ccc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f769ccc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f769ccc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76bd75.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f76bd75.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f769ccc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76bd75.exe -
Enumerates connected drives 3 TTPs 18 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: f769ccc.exe File opened (read-only) \??\L: f769ccc.exe File opened (read-only) \??\N: f769ccc.exe File opened (read-only) \??\P: f769ccc.exe File opened (read-only) \??\R: f769ccc.exe File opened (read-only) \??\G: f769ccc.exe File opened (read-only) \??\H: f769ccc.exe File opened (read-only) \??\J: f769ccc.exe File opened (read-only) \??\M: f769ccc.exe File opened (read-only) \??\Q: f769ccc.exe File opened (read-only) \??\S: f769ccc.exe File opened (read-only) \??\E: f76bd75.exe File opened (read-only) \??\I: f769ccc.exe File opened (read-only) \??\K: f769ccc.exe File opened (read-only) \??\O: f769ccc.exe File opened (read-only) \??\T: f769ccc.exe File opened (read-only) \??\G: f76bd75.exe File opened (read-only) \??\H: f76bd75.exe -
resource yara_rule behavioral1/memory/2416-19-0x00000000005F0000-0x00000000016AA000-memory.dmp upx behavioral1/memory/2416-16-0x00000000005F0000-0x00000000016AA000-memory.dmp upx behavioral1/memory/2416-21-0x00000000005F0000-0x00000000016AA000-memory.dmp upx behavioral1/memory/2416-23-0x00000000005F0000-0x00000000016AA000-memory.dmp upx behavioral1/memory/2416-22-0x00000000005F0000-0x00000000016AA000-memory.dmp upx behavioral1/memory/2416-20-0x00000000005F0000-0x00000000016AA000-memory.dmp upx behavioral1/memory/2416-18-0x00000000005F0000-0x00000000016AA000-memory.dmp upx behavioral1/memory/2416-25-0x00000000005F0000-0x00000000016AA000-memory.dmp upx behavioral1/memory/2416-17-0x00000000005F0000-0x00000000016AA000-memory.dmp upx behavioral1/memory/2416-24-0x00000000005F0000-0x00000000016AA000-memory.dmp upx behavioral1/memory/2416-63-0x00000000005F0000-0x00000000016AA000-memory.dmp upx behavioral1/memory/2416-64-0x00000000005F0000-0x00000000016AA000-memory.dmp upx behavioral1/memory/2416-65-0x00000000005F0000-0x00000000016AA000-memory.dmp upx behavioral1/memory/2416-67-0x00000000005F0000-0x00000000016AA000-memory.dmp upx behavioral1/memory/2416-66-0x00000000005F0000-0x00000000016AA000-memory.dmp upx behavioral1/memory/2416-69-0x00000000005F0000-0x00000000016AA000-memory.dmp upx behavioral1/memory/2416-70-0x00000000005F0000-0x00000000016AA000-memory.dmp upx behavioral1/memory/2416-71-0x00000000005F0000-0x00000000016AA000-memory.dmp upx behavioral1/memory/2416-72-0x00000000005F0000-0x00000000016AA000-memory.dmp upx behavioral1/memory/2416-88-0x00000000005F0000-0x00000000016AA000-memory.dmp upx behavioral1/memory/2416-89-0x00000000005F0000-0x00000000016AA000-memory.dmp upx behavioral1/memory/2416-158-0x00000000005F0000-0x00000000016AA000-memory.dmp upx behavioral1/memory/3040-179-0x0000000000900000-0x00000000019BA000-memory.dmp upx behavioral1/memory/3040-212-0x0000000000900000-0x00000000019BA000-memory.dmp upx -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\f769d29 f769ccc.exe File opened for modification C:\Windows\SYSTEM.INI f769ccc.exe File created C:\Windows\f76ed3c f76bd75.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f769ccc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f76bd75.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2416 f769ccc.exe 2416 f769ccc.exe 3040 f76bd75.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeDebugPrivilege 2416 f769ccc.exe Token: SeDebugPrivilege 2416 f769ccc.exe Token: SeDebugPrivilege 2416 f769ccc.exe Token: SeDebugPrivilege 2416 f769ccc.exe Token: SeDebugPrivilege 2416 f769ccc.exe Token: SeDebugPrivilege 2416 f769ccc.exe Token: SeDebugPrivilege 2416 f769ccc.exe Token: SeDebugPrivilege 2416 f769ccc.exe Token: SeDebugPrivilege 2416 f769ccc.exe Token: SeDebugPrivilege 2416 f769ccc.exe Token: SeDebugPrivilege 2416 f769ccc.exe Token: SeDebugPrivilege 2416 f769ccc.exe Token: SeDebugPrivilege 2416 f769ccc.exe Token: SeDebugPrivilege 2416 f769ccc.exe Token: SeDebugPrivilege 2416 f769ccc.exe Token: SeDebugPrivilege 2416 f769ccc.exe Token: SeDebugPrivilege 2416 f769ccc.exe Token: SeDebugPrivilege 2416 f769ccc.exe Token: SeDebugPrivilege 2416 f769ccc.exe Token: SeDebugPrivilege 2416 f769ccc.exe Token: SeDebugPrivilege 2416 f769ccc.exe Token: SeDebugPrivilege 2416 f769ccc.exe Token: SeDebugPrivilege 2416 f769ccc.exe Token: SeDebugPrivilege 3040 f76bd75.exe Token: SeDebugPrivilege 3040 f76bd75.exe Token: SeDebugPrivilege 3040 f76bd75.exe Token: SeDebugPrivilege 3040 f76bd75.exe Token: SeDebugPrivilege 3040 f76bd75.exe Token: SeDebugPrivilege 3040 f76bd75.exe Token: SeDebugPrivilege 3040 f76bd75.exe Token: SeDebugPrivilege 3040 f76bd75.exe Token: SeDebugPrivilege 3040 f76bd75.exe Token: SeDebugPrivilege 3040 f76bd75.exe Token: SeDebugPrivilege 3040 f76bd75.exe Token: SeDebugPrivilege 3040 f76bd75.exe Token: SeDebugPrivilege 3040 f76bd75.exe Token: SeDebugPrivilege 3040 f76bd75.exe Token: SeDebugPrivilege 3040 f76bd75.exe Token: SeDebugPrivilege 3040 f76bd75.exe Token: SeDebugPrivilege 3040 f76bd75.exe Token: SeDebugPrivilege 3040 f76bd75.exe Token: SeDebugPrivilege 3040 f76bd75.exe Token: SeDebugPrivilege 3040 f76bd75.exe Token: SeDebugPrivilege 3040 f76bd75.exe Token: SeDebugPrivilege 3040 f76bd75.exe Token: SeDebugPrivilege 3040 f76bd75.exe -
Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 2692 wrote to memory of 2288 2692 rundll32.exe 30 PID 2692 wrote to memory of 2288 2692 rundll32.exe 30 PID 2692 wrote to memory of 2288 2692 rundll32.exe 30 PID 2692 wrote to memory of 2288 2692 rundll32.exe 30 PID 2692 wrote to memory of 2288 2692 rundll32.exe 30 PID 2692 wrote to memory of 2288 2692 rundll32.exe 30 PID 2692 wrote to memory of 2288 2692 rundll32.exe 30 PID 2288 wrote to memory of 2416 2288 rundll32.exe 31 PID 2288 wrote to memory of 2416 2288 rundll32.exe 31 PID 2288 wrote to memory of 2416 2288 rundll32.exe 31 PID 2288 wrote to memory of 2416 2288 rundll32.exe 31 PID 2416 wrote to memory of 1032 2416 f769ccc.exe 17 PID 2416 wrote to memory of 1048 2416 f769ccc.exe 18 PID 2416 wrote to memory of 1112 2416 f769ccc.exe 20 PID 2416 wrote to memory of 1420 2416 f769ccc.exe 25 PID 2416 wrote to memory of 2692 2416 f769ccc.exe 29 PID 2416 wrote to memory of 2288 2416 f769ccc.exe 30 PID 2416 wrote to memory of 2288 2416 f769ccc.exe 30 PID 2288 wrote to memory of 2904 2288 rundll32.exe 32 PID 2288 wrote to memory of 2904 2288 rundll32.exe 32 PID 2288 wrote to memory of 2904 2288 rundll32.exe 32 PID 2288 wrote to memory of 2904 2288 rundll32.exe 32 PID 2288 wrote to memory of 3040 2288 rundll32.exe 33 PID 2288 wrote to memory of 3040 2288 rundll32.exe 33 PID 2288 wrote to memory of 3040 2288 rundll32.exe 33 PID 2288 wrote to memory of 3040 2288 rundll32.exe 33 PID 2416 wrote to memory of 1032 2416 f769ccc.exe 17 PID 2416 wrote to memory of 1048 2416 f769ccc.exe 18 PID 2416 wrote to memory of 1112 2416 f769ccc.exe 20 PID 2416 wrote to memory of 1420 2416 f769ccc.exe 25 PID 2416 wrote to memory of 2904 2416 f769ccc.exe 32 PID 2416 wrote to memory of 2904 2416 f769ccc.exe 32 PID 2416 wrote to memory of 3040 2416 f769ccc.exe 33 PID 2416 wrote to memory of 3040 2416 f769ccc.exe 33 PID 3040 wrote to memory of 1032 3040 f76bd75.exe 17 PID 3040 wrote to memory of 1048 3040 f76bd75.exe 18 PID 3040 wrote to memory of 1112 3040 f76bd75.exe 20 PID 3040 wrote to memory of 1420 3040 f76bd75.exe 25 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f769ccc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76bd75.exe
Processes
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1032
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1048
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1112
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4818d5262276f87833c87ab29ef1a6da1eab4b2a2fa7f62c2a6bfa4192390ec8N.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4818d5262276f87833c87ab29ef1a6da1eab4b2a2fa7f62c2a6bfa4192390ec8N.dll,#13⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\f769ccc.exeC:\Users\Admin\AppData\Local\Temp\f769ccc.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2416
-
-
C:\Users\Admin\AppData\Local\Temp\f769e81.exeC:\Users\Admin\AppData\Local\Temp\f769e81.exe4⤵
- Executes dropped EXE
PID:2904
-
-
C:\Users\Admin\AppData\Local\Temp\f76bd75.exeC:\Users\Admin\AppData\Local\Temp\f76bd75.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3040
-
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1420
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
257B
MD50dc7f317f4995577235b6b662ea9cbe2
SHA16986e850371ad317f7ebd321c5b5f3791f98a154
SHA25628dd3052faa27e3dfd2040c8b911fb2b8bef8606d88444e885b1c0ed50eb2bcd
SHA512a80fb0a0f6ef2d2613f38d9a007cff8abfb4a16af0dcc2616b220a1cd0eee9336431487df6cd05771a03e349b104f6dc44b3bb14c249d803cedd715e6695fc4c
-
Filesize
97KB
MD5621fc5a76e61f3e38850369d43a9a4c2
SHA112ba92440489053fec6dcf0b381255400c752a2e
SHA25621f08a607c8025e26fd35381b316cba9e1e829b9e4251665ab4a7b423605a235
SHA512cdac6ac897a069293b1981b814dae66ef87d9cf0b68a8ebbe1b86a01b9e931e4d0cb72a820e9634b32517f456dd88deea59d85bdc5e6c87c3b17a9174b2cb9ec