Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20/12/2024, 07:24
Static task
static1
Behavioral task
behavioral1
Sample
e01009df04878cde68a9ff6f0923e60eef4d0fd3a7bd3fbcad368ea81697af9e.exe
Resource
win7-20240903-en
General
-
Target
e01009df04878cde68a9ff6f0923e60eef4d0fd3a7bd3fbcad368ea81697af9e.exe
-
Size
2.6MB
-
MD5
39127a5c36fbf6bfc192853b6c51e41d
-
SHA1
73750052bc14c1f0017e87e06107c519606b6da0
-
SHA256
e01009df04878cde68a9ff6f0923e60eef4d0fd3a7bd3fbcad368ea81697af9e
-
SHA512
3e2887d87f271447d0d3705d3138e1ccf639b50ecc1e0bcffdf7d388830284fe23b81893a5c5826bb981003ab09c5d6647a24ab83441c6b48837018682f00ac0
-
SSDEEP
49152:VELOpKnXu2dN8L+RXvKaTM+MTHUPDJG4CZqDs4hP7CpIC/:VELOpKXu2dZvKaTs2JGBq44u
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e01009df04878cde68a9ff6f0923e60eef4d0fd3a7bd3fbcad368ea81697af9e.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e01009df04878cde68a9ff6f0923e60eef4d0fd3a7bd3fbcad368ea81697af9e.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e01009df04878cde68a9ff6f0923e60eef4d0fd3a7bd3fbcad368ea81697af9e.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e01009df04878cde68a9ff6f0923e60eef4d0fd3a7bd3fbcad368ea81697af9e.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e01009df04878cde68a9ff6f0923e60eef4d0fd3a7bd3fbcad368ea81697af9e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" e01009df04878cde68a9ff6f0923e60eef4d0fd3a7bd3fbcad368ea81697af9e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e01009df04878cde68a9ff6f0923e60eef4d0fd3a7bd3fbcad368ea81697af9e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" e01009df04878cde68a9ff6f0923e60eef4d0fd3a7bd3fbcad368ea81697af9e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e01009df04878cde68a9ff6f0923e60eef4d0fd3a7bd3fbcad368ea81697af9e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e01009df04878cde68a9ff6f0923e60eef4d0fd3a7bd3fbcad368ea81697af9e.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e01009df04878cde68a9ff6f0923e60eef4d0fd3a7bd3fbcad368ea81697af9e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" e01009df04878cde68a9ff6f0923e60eef4d0fd3a7bd3fbcad368ea81697af9e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc e01009df04878cde68a9ff6f0923e60eef4d0fd3a7bd3fbcad368ea81697af9e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e01009df04878cde68a9ff6f0923e60eef4d0fd3a7bd3fbcad368ea81697af9e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e01009df04878cde68a9ff6f0923e60eef4d0fd3a7bd3fbcad368ea81697af9e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e01009df04878cde68a9ff6f0923e60eef4d0fd3a7bd3fbcad368ea81697af9e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" e01009df04878cde68a9ff6f0923e60eef4d0fd3a7bd3fbcad368ea81697af9e.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e01009df04878cde68a9ff6f0923e60eef4d0fd3a7bd3fbcad368ea81697af9e.exe -
resource yara_rule behavioral1/memory/2828-5-0x0000000002260000-0x000000000331A000-memory.dmp upx behavioral1/memory/2828-3-0x0000000002260000-0x000000000331A000-memory.dmp upx behavioral1/memory/2828-6-0x0000000002260000-0x000000000331A000-memory.dmp upx behavioral1/memory/2828-8-0x0000000002260000-0x000000000331A000-memory.dmp upx behavioral1/memory/2828-10-0x0000000002260000-0x000000000331A000-memory.dmp upx behavioral1/memory/2828-7-0x0000000002260000-0x000000000331A000-memory.dmp upx behavioral1/memory/2828-4-0x0000000002260000-0x000000000331A000-memory.dmp upx -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\f76f22c e01009df04878cde68a9ff6f0923e60eef4d0fd3a7bd3fbcad368ea81697af9e.exe File opened for modification C:\Windows\SYSTEM.INI e01009df04878cde68a9ff6f0923e60eef4d0fd3a7bd3fbcad368ea81697af9e.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e01009df04878cde68a9ff6f0923e60eef4d0fd3a7bd3fbcad368ea81697af9e.exe -
Suspicious behavior: EnumeratesProcesses 11 IoCs
pid Process 2828 e01009df04878cde68a9ff6f0923e60eef4d0fd3a7bd3fbcad368ea81697af9e.exe 2828 e01009df04878cde68a9ff6f0923e60eef4d0fd3a7bd3fbcad368ea81697af9e.exe 2828 e01009df04878cde68a9ff6f0923e60eef4d0fd3a7bd3fbcad368ea81697af9e.exe 2828 e01009df04878cde68a9ff6f0923e60eef4d0fd3a7bd3fbcad368ea81697af9e.exe 2828 e01009df04878cde68a9ff6f0923e60eef4d0fd3a7bd3fbcad368ea81697af9e.exe 2828 e01009df04878cde68a9ff6f0923e60eef4d0fd3a7bd3fbcad368ea81697af9e.exe 2828 e01009df04878cde68a9ff6f0923e60eef4d0fd3a7bd3fbcad368ea81697af9e.exe 2828 e01009df04878cde68a9ff6f0923e60eef4d0fd3a7bd3fbcad368ea81697af9e.exe 2828 e01009df04878cde68a9ff6f0923e60eef4d0fd3a7bd3fbcad368ea81697af9e.exe 2828 e01009df04878cde68a9ff6f0923e60eef4d0fd3a7bd3fbcad368ea81697af9e.exe 2828 e01009df04878cde68a9ff6f0923e60eef4d0fd3a7bd3fbcad368ea81697af9e.exe -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e01009df04878cde68a9ff6f0923e60eef4d0fd3a7bd3fbcad368ea81697af9e.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e01009df04878cde68a9ff6f0923e60eef4d0fd3a7bd3fbcad368ea81697af9e.exe"C:\Users\Admin\AppData\Local\Temp\e01009df04878cde68a9ff6f0923e60eef4d0fd3a7bd3fbcad368ea81697af9e.exe"1⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- System policy modification
PID:2828
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5