Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20241023-en
  • resource tags

    arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
  • submitted
    20/12/2024, 06:51

General

  • Target

    820d1d930392dec6d546698dcca55db605543060890a5df1e06d0ecd33656dceN.dll

  • Size

    120KB

  • MD5

    92aaeddefab51b143267deb12f199670

  • SHA1

    446011004b03eb2ae62fff7ecd82dbc9018c481d

  • SHA256

    820d1d930392dec6d546698dcca55db605543060890a5df1e06d0ecd33656dce

  • SHA512

    e48577c0c6fb9fe2792a8a9358211a20826d7a31c76910f62e4d4ee5f1e210875dfe2d84f1b116e03308eeff114111f6524b4c61ce91581ad1aca2185e3823be

  • SSDEEP

    1536:uzHJPRuSsAqru47cIwvIZhIZlLb2zCOP55LBD4dgL3WKMhoHE9s5+:ub+rA+97cIwvIZhIfLb2zCw5BBIo/5

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Signatures

  • Modifies firewall policy service 3 TTPs 6 IoCs
  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

  • Sality family
  • UAC bypass 3 TTPs 2 IoCs
  • Windows security bypass 2 TTPs 12 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 6 IoCs
  • Windows security modification 2 TTPs 14 IoCs
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
  • Enumerates connected drives 3 TTPs 16 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file 25 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Windows directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 45 IoCs
  • Suspicious use of WriteProcessMemory 38 IoCs
  • System policy modification 1 TTPs 2 IoCs

Processes

  • C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    1⤵
      PID:1108
    • C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      1⤵
        PID:1156
      • C:\Windows\Explorer.EXE
        C:\Windows\Explorer.EXE
        1⤵
          PID:1196
          • C:\Windows\system32\rundll32.exe
            rundll32.exe C:\Users\Admin\AppData\Local\Temp\820d1d930392dec6d546698dcca55db605543060890a5df1e06d0ecd33656dceN.dll,#1
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:1800
            • C:\Windows\SysWOW64\rundll32.exe
              rundll32.exe C:\Users\Admin\AppData\Local\Temp\820d1d930392dec6d546698dcca55db605543060890a5df1e06d0ecd33656dceN.dll,#1
              3⤵
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2504
              • C:\Users\Admin\AppData\Local\Temp\f7672b0.exe
                C:\Users\Admin\AppData\Local\Temp\f7672b0.exe
                4⤵
                • Modifies firewall policy service
                • UAC bypass
                • Windows security bypass
                • Executes dropped EXE
                • Windows security modification
                • Checks whether UAC is enabled
                • Enumerates connected drives
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                • System policy modification
                PID:2104
              • C:\Users\Admin\AppData\Local\Temp\f767742.exe
                C:\Users\Admin\AppData\Local\Temp\f767742.exe
                4⤵
                • Executes dropped EXE
                PID:2756
              • C:\Users\Admin\AppData\Local\Temp\f769157.exe
                C:\Users\Admin\AppData\Local\Temp\f769157.exe
                4⤵
                • Modifies firewall policy service
                • UAC bypass
                • Windows security bypass
                • Executes dropped EXE
                • Windows security modification
                • Checks whether UAC is enabled
                • Enumerates connected drives
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                • System policy modification
                PID:2248
        • C:\Windows\system32\DllHost.exe
          C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
          1⤵
            PID:1676

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Windows\SYSTEM.INI

            Filesize

            257B

            MD5

            c7e93aca2b5d874d8073b767faa2da43

            SHA1

            a5c776a59d3d646ad71b5cdb4a2399cbfe0e2f16

            SHA256

            bd94f630809c7dafc576ca29f320ce6da9512efb3cdef862117bba7d37cf4d33

            SHA512

            e85c3d835bb87dfc10a4ced2a7d8a304bcd1cbd9f66a33896c6c30a358314a0713a36dc3c4893d94b268f51a898672cd2b0b73b75703ff569cfe848e62aa73bb

          • \Users\Admin\AppData\Local\Temp\f7672b0.exe

            Filesize

            97KB

            MD5

            df9f6bcbd7ed150064791bf0efe0df00

            SHA1

            10979cc3f9eca44561061f8fd5a74e5b040b851d

            SHA256

            48f7d19261f843e833721a15ec222da55029551ac6dba7bff463750c8dc918cb

            SHA512

            5921e7881f082b253058687ba4f46e50e2cbc7e521f153e078b894163cbb6d70a6c7e4b17c64d2b0039c5cedcd1fd403e6661ecb91bb9b28331fa92eb571eb84

          • memory/1108-32-0x00000000004F0000-0x00000000004F2000-memory.dmp

            Filesize

            8KB

          • memory/2104-92-0x0000000000590000-0x000000000164A000-memory.dmp

            Filesize

            16.7MB

          • memory/2104-52-0x00000000002E0000-0x00000000002E1000-memory.dmp

            Filesize

            4KB

          • memory/2104-14-0x0000000000400000-0x0000000000412000-memory.dmp

            Filesize

            72KB

          • memory/2104-159-0x0000000000590000-0x000000000164A000-memory.dmp

            Filesize

            16.7MB

          • memory/2104-66-0x0000000000590000-0x000000000164A000-memory.dmp

            Filesize

            16.7MB

          • memory/2104-20-0x0000000000590000-0x000000000164A000-memory.dmp

            Filesize

            16.7MB

          • memory/2104-23-0x0000000000590000-0x000000000164A000-memory.dmp

            Filesize

            16.7MB

          • memory/2104-22-0x0000000000590000-0x000000000164A000-memory.dmp

            Filesize

            16.7MB

          • memory/2104-26-0x0000000000590000-0x000000000164A000-memory.dmp

            Filesize

            16.7MB

          • memory/2104-19-0x0000000000590000-0x000000000164A000-memory.dmp

            Filesize

            16.7MB

          • memory/2104-25-0x0000000000590000-0x000000000164A000-memory.dmp

            Filesize

            16.7MB

          • memory/2104-17-0x0000000000590000-0x000000000164A000-memory.dmp

            Filesize

            16.7MB

          • memory/2104-24-0x0000000000590000-0x000000000164A000-memory.dmp

            Filesize

            16.7MB

          • memory/2104-21-0x0000000000590000-0x000000000164A000-memory.dmp

            Filesize

            16.7MB

          • memory/2104-18-0x0000000000590000-0x000000000164A000-memory.dmp

            Filesize

            16.7MB

          • memory/2104-55-0x00000000002D0000-0x00000000002D2000-memory.dmp

            Filesize

            8KB

          • memory/2104-93-0x0000000000590000-0x000000000164A000-memory.dmp

            Filesize

            16.7MB

          • memory/2104-90-0x0000000000590000-0x000000000164A000-memory.dmp

            Filesize

            16.7MB

          • memory/2104-75-0x0000000000590000-0x000000000164A000-memory.dmp

            Filesize

            16.7MB

          • memory/2104-73-0x0000000000590000-0x000000000164A000-memory.dmp

            Filesize

            16.7MB

          • memory/2104-53-0x00000000002D0000-0x00000000002D2000-memory.dmp

            Filesize

            8KB

          • memory/2104-68-0x0000000000590000-0x000000000164A000-memory.dmp

            Filesize

            16.7MB

          • memory/2104-72-0x0000000000590000-0x000000000164A000-memory.dmp

            Filesize

            16.7MB

          • memory/2104-69-0x0000000000590000-0x000000000164A000-memory.dmp

            Filesize

            16.7MB

          • memory/2104-70-0x0000000000590000-0x000000000164A000-memory.dmp

            Filesize

            16.7MB

          • memory/2104-67-0x0000000000590000-0x000000000164A000-memory.dmp

            Filesize

            16.7MB

          • memory/2104-158-0x0000000000400000-0x0000000000412000-memory.dmp

            Filesize

            72KB

          • memory/2248-167-0x0000000000900000-0x00000000019BA000-memory.dmp

            Filesize

            16.7MB

          • memory/2248-212-0x0000000000900000-0x00000000019BA000-memory.dmp

            Filesize

            16.7MB

          • memory/2248-213-0x0000000000400000-0x0000000000412000-memory.dmp

            Filesize

            72KB

          • memory/2248-109-0x00000000003F0000-0x00000000003F1000-memory.dmp

            Filesize

            4KB

          • memory/2248-110-0x0000000000220000-0x0000000000222000-memory.dmp

            Filesize

            8KB

          • memory/2248-112-0x0000000000220000-0x0000000000222000-memory.dmp

            Filesize

            8KB

          • memory/2248-89-0x0000000000400000-0x0000000000412000-memory.dmp

            Filesize

            72KB

          • memory/2504-54-0x00000000001F0000-0x00000000001F2000-memory.dmp

            Filesize

            8KB

          • memory/2504-43-0x0000000000220000-0x0000000000221000-memory.dmp

            Filesize

            4KB

          • memory/2504-88-0x0000000000180000-0x0000000000182000-memory.dmp

            Filesize

            8KB

          • memory/2504-1-0x0000000010000000-0x0000000010020000-memory.dmp

            Filesize

            128KB

          • memory/2504-0-0x0000000010000000-0x0000000010020000-memory.dmp

            Filesize

            128KB

          • memory/2504-74-0x00000000001F0000-0x00000000001F2000-memory.dmp

            Filesize

            8KB

          • memory/2504-64-0x0000000000230000-0x0000000000242000-memory.dmp

            Filesize

            72KB

          • memory/2504-41-0x00000000001F0000-0x00000000001F2000-memory.dmp

            Filesize

            8KB

          • memory/2504-45-0x0000000000220000-0x0000000000221000-memory.dmp

            Filesize

            4KB

          • memory/2504-63-0x0000000000230000-0x0000000000242000-memory.dmp

            Filesize

            72KB

          • memory/2504-42-0x00000000001F0000-0x00000000001F2000-memory.dmp

            Filesize

            8KB

          • memory/2504-3-0x0000000010000000-0x0000000010020000-memory.dmp

            Filesize

            128KB

          • memory/2504-2-0x0000000010000000-0x0000000010020000-memory.dmp

            Filesize

            128KB

          • memory/2504-12-0x0000000000180000-0x0000000000192000-memory.dmp

            Filesize

            72KB

          • memory/2504-13-0x0000000000180000-0x0000000000192000-memory.dmp

            Filesize

            72KB

          • memory/2756-139-0x0000000000260000-0x0000000000262000-memory.dmp

            Filesize

            8KB

          • memory/2756-104-0x00000000003F0000-0x00000000003F1000-memory.dmp

            Filesize

            4KB

          • memory/2756-113-0x0000000000260000-0x0000000000262000-memory.dmp

            Filesize

            8KB

          • memory/2756-65-0x0000000000400000-0x0000000000412000-memory.dmp

            Filesize

            72KB