Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    95s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/12/2024, 02:10 UTC

General

  • Target

    260abc2435e2cb17f40b827f26a3481ef598456bab81c6160b4aebb7b12b9271N.exe

  • Size

    97KB

  • MD5

    9bddf6ec69a9081b94365b9cee904b10

  • SHA1

    74427f9b609f67ac096587aa4ebbfcccad7f4ef8

  • SHA256

    260abc2435e2cb17f40b827f26a3481ef598456bab81c6160b4aebb7b12b9271

  • SHA512

    e0e810722d0196c0a3aa576a1adaf1411541876259996951c7da33a6f38852e5b477d2c0a6bd0ed80d6acb83cbc73cd7ed0841e9c2d79a0ce2295818a4368439

  • SSDEEP

    3072:xSUti6Rj6Yxq2hb/uxehD8EEjsYHjxQd:xN0YQeuxCDrYDG

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Signatures

  • Modifies firewall policy service 3 TTPs 3 IoCs
  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

  • Sality family
  • UAC bypass 3 TTPs 1 IoCs
  • Windows security bypass 2 TTPs 6 IoCs
  • Windows security modification 2 TTPs 7 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file 1 TTPs 2 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • UPX packed file 42 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 11 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 24 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 1 IoCs

Processes

  • C:\Windows\system32\fontdrvhost.exe
    "fontdrvhost.exe"
    1⤵
      PID:760
    • C:\Windows\system32\fontdrvhost.exe
      "fontdrvhost.exe"
      1⤵
        PID:764
      • C:\Windows\system32\dwm.exe
        "dwm.exe"
        1⤵
          PID:64
        • C:\Windows\system32\sihost.exe
          sihost.exe
          1⤵
            PID:3048
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
            1⤵
              PID:2624
            • C:\Windows\system32\taskhostw.exe
              taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
              1⤵
                PID:3100
              • C:\Windows\Explorer.EXE
                C:\Windows\Explorer.EXE
                1⤵
                  PID:3472
                  • C:\Users\Admin\AppData\Local\Temp\260abc2435e2cb17f40b827f26a3481ef598456bab81c6160b4aebb7b12b9271N.exe
                    "C:\Users\Admin\AppData\Local\Temp\260abc2435e2cb17f40b827f26a3481ef598456bab81c6160b4aebb7b12b9271N.exe"
                    2⤵
                    • Modifies firewall policy service
                    • UAC bypass
                    • Windows security bypass
                    • Windows security modification
                    • Checks whether UAC is enabled
                    • Enumerates connected drives
                    • Drops autorun.inf file
                    • Drops file in Program Files directory
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    • Modifies registry class
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of WriteProcessMemory
                    • System policy modification
                    PID:3136
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
                  1⤵
                    PID:3588
                  • C:\Windows\system32\DllHost.exe
                    C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                    1⤵
                      PID:3792
                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                      1⤵
                        PID:3884
                      • C:\Windows\System32\RuntimeBroker.exe
                        C:\Windows\System32\RuntimeBroker.exe -Embedding
                        1⤵
                          PID:3956
                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                          1⤵
                            PID:4052
                          • C:\Windows\System32\RuntimeBroker.exe
                            C:\Windows\System32\RuntimeBroker.exe -Embedding
                            1⤵
                              PID:4212
                            • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
                              "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
                              1⤵
                                PID:4732
                              • C:\Windows\System32\RuntimeBroker.exe
                                C:\Windows\System32\RuntimeBroker.exe -Embedding
                                1⤵
                                  PID:3744
                                • C:\Windows\system32\backgroundTaskHost.exe
                                  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
                                  1⤵
                                    PID:3808

                                  Network

                                  • flag-us
                                    DNS
                                    104.219.191.52.in-addr.arpa
                                    Remote address:
                                    8.8.8.8:53
                                    Request
                                    104.219.191.52.in-addr.arpa
                                    IN PTR
                                    Response
                                  • flag-us
                                    DNS
                                    172.214.232.199.in-addr.arpa
                                    Remote address:
                                    8.8.8.8:53
                                    Request
                                    172.214.232.199.in-addr.arpa
                                    IN PTR
                                    Response
                                  • flag-us
                                    DNS
                                    22.160.190.20.in-addr.arpa
                                    Remote address:
                                    8.8.8.8:53
                                    Request
                                    22.160.190.20.in-addr.arpa
                                    IN PTR
                                    Response
                                  • flag-us
                                    DNS
                                    95.221.229.192.in-addr.arpa
                                    Remote address:
                                    8.8.8.8:53
                                    Request
                                    95.221.229.192.in-addr.arpa
                                    IN PTR
                                    Response
                                  • flag-us
                                    DNS
                                    154.239.44.20.in-addr.arpa
                                    Remote address:
                                    8.8.8.8:53
                                    Request
                                    154.239.44.20.in-addr.arpa
                                    IN PTR
                                    Response
                                  • flag-us
                                    DNS
                                    50.23.12.20.in-addr.arpa
                                    Remote address:
                                    8.8.8.8:53
                                    Request
                                    50.23.12.20.in-addr.arpa
                                    IN PTR
                                    Response
                                  • flag-us
                                    DNS
                                    198.187.3.20.in-addr.arpa
                                    Remote address:
                                    8.8.8.8:53
                                    Request
                                    198.187.3.20.in-addr.arpa
                                    IN PTR
                                    Response
                                  • flag-us
                                    DNS
                                    19.229.111.52.in-addr.arpa
                                    Remote address:
                                    8.8.8.8:53
                                    Request
                                    19.229.111.52.in-addr.arpa
                                    IN PTR
                                    Response
                                  No results found
                                  • 8.8.8.8:53
                                    104.219.191.52.in-addr.arpa
                                    dns
                                    73 B
                                    147 B
                                    1
                                    1

                                    DNS Request

                                    104.219.191.52.in-addr.arpa

                                  • 8.8.8.8:53
                                    172.214.232.199.in-addr.arpa
                                    dns
                                    74 B
                                    128 B
                                    1
                                    1

                                    DNS Request

                                    172.214.232.199.in-addr.arpa

                                  • 8.8.8.8:53
                                    22.160.190.20.in-addr.arpa
                                    dns
                                    72 B
                                    158 B
                                    1
                                    1

                                    DNS Request

                                    22.160.190.20.in-addr.arpa

                                  • 8.8.8.8:53
                                    95.221.229.192.in-addr.arpa
                                    dns
                                    73 B
                                    144 B
                                    1
                                    1

                                    DNS Request

                                    95.221.229.192.in-addr.arpa

                                  • 8.8.8.8:53
                                    154.239.44.20.in-addr.arpa
                                    dns
                                    72 B
                                    158 B
                                    1
                                    1

                                    DNS Request

                                    154.239.44.20.in-addr.arpa

                                  • 8.8.8.8:53
                                    50.23.12.20.in-addr.arpa
                                    dns
                                    70 B
                                    156 B
                                    1
                                    1

                                    DNS Request

                                    50.23.12.20.in-addr.arpa

                                  • 8.8.8.8:53
                                    198.187.3.20.in-addr.arpa
                                    dns
                                    71 B
                                    157 B
                                    1
                                    1

                                    DNS Request

                                    198.187.3.20.in-addr.arpa

                                  • 8.8.8.8:53
                                    19.229.111.52.in-addr.arpa
                                    dns
                                    72 B
                                    158 B
                                    1
                                    1

                                    DNS Request

                                    19.229.111.52.in-addr.arpa

                                  MITRE ATT&CK Enterprise v15

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads

                                  • F:\rxfx.exe

                                    Filesize

                                    97KB

                                    MD5

                                    e8a978c510606e105f7fd4eb37144781

                                    SHA1

                                    8f23bdbfbd5502c1e07534dcab8559f1dff64f4c

                                    SHA256

                                    f722198422f6a16c565fdfb5b6d88fe697a7ba00205c1e60d0c708c21fe3e26d

                                    SHA512

                                    3f701602b9038e1621f6dff5824a5a8cd4d61570cd3f2fda4c578478639d4edcc72f828352496cdb708a2ef0dadb51c3854a20bcbb5cb3ec584cc45831f444e1

                                  • memory/3136-0-0x0000000000400000-0x0000000000412000-memory.dmp

                                    Filesize

                                    72KB

                                  • memory/3136-3-0x00000000007F0000-0x00000000018AA000-memory.dmp

                                    Filesize

                                    16.7MB

                                  • memory/3136-5-0x00000000007F0000-0x00000000018AA000-memory.dmp

                                    Filesize

                                    16.7MB

                                  • memory/3136-1-0x00000000007F0000-0x00000000018AA000-memory.dmp

                                    Filesize

                                    16.7MB

                                  • memory/3136-4-0x00000000007F0000-0x00000000018AA000-memory.dmp

                                    Filesize

                                    16.7MB

                                  • memory/3136-15-0x00000000007F0000-0x00000000018AA000-memory.dmp

                                    Filesize

                                    16.7MB

                                  • memory/3136-18-0x0000000004770000-0x0000000004771000-memory.dmp

                                    Filesize

                                    4KB

                                  • memory/3136-16-0x00000000007F0000-0x00000000018AA000-memory.dmp

                                    Filesize

                                    16.7MB

                                  • memory/3136-21-0x0000000004620000-0x0000000004622000-memory.dmp

                                    Filesize

                                    8KB

                                  • memory/3136-20-0x0000000004620000-0x0000000004622000-memory.dmp

                                    Filesize

                                    8KB

                                  • memory/3136-17-0x0000000004620000-0x0000000004622000-memory.dmp

                                    Filesize

                                    8KB

                                  • memory/3136-7-0x00000000007F0000-0x00000000018AA000-memory.dmp

                                    Filesize

                                    16.7MB

                                  • memory/3136-19-0x00000000007F0000-0x00000000018AA000-memory.dmp

                                    Filesize

                                    16.7MB

                                  • memory/3136-13-0x00000000007F0000-0x00000000018AA000-memory.dmp

                                    Filesize

                                    16.7MB

                                  • memory/3136-6-0x00000000007F0000-0x00000000018AA000-memory.dmp

                                    Filesize

                                    16.7MB

                                  • memory/3136-14-0x00000000007F0000-0x00000000018AA000-memory.dmp

                                    Filesize

                                    16.7MB

                                  • memory/3136-22-0x00000000007F0000-0x00000000018AA000-memory.dmp

                                    Filesize

                                    16.7MB

                                  • memory/3136-23-0x00000000007F0000-0x00000000018AA000-memory.dmp

                                    Filesize

                                    16.7MB

                                  • memory/3136-24-0x00000000007F0000-0x00000000018AA000-memory.dmp

                                    Filesize

                                    16.7MB

                                  • memory/3136-25-0x00000000007F0000-0x00000000018AA000-memory.dmp

                                    Filesize

                                    16.7MB

                                  • memory/3136-26-0x00000000007F0000-0x00000000018AA000-memory.dmp

                                    Filesize

                                    16.7MB

                                  • memory/3136-28-0x00000000007F0000-0x00000000018AA000-memory.dmp

                                    Filesize

                                    16.7MB

                                  • memory/3136-29-0x00000000007F0000-0x00000000018AA000-memory.dmp

                                    Filesize

                                    16.7MB

                                  • memory/3136-30-0x00000000007F0000-0x00000000018AA000-memory.dmp

                                    Filesize

                                    16.7MB

                                  • memory/3136-33-0x00000000007F0000-0x00000000018AA000-memory.dmp

                                    Filesize

                                    16.7MB

                                  • memory/3136-36-0x0000000004620000-0x0000000004622000-memory.dmp

                                    Filesize

                                    8KB

                                  • memory/3136-34-0x00000000007F0000-0x00000000018AA000-memory.dmp

                                    Filesize

                                    16.7MB

                                  • memory/3136-37-0x00000000007F0000-0x00000000018AA000-memory.dmp

                                    Filesize

                                    16.7MB

                                  • memory/3136-38-0x00000000007F0000-0x00000000018AA000-memory.dmp

                                    Filesize

                                    16.7MB

                                  • memory/3136-41-0x00000000007F0000-0x00000000018AA000-memory.dmp

                                    Filesize

                                    16.7MB

                                  • memory/3136-45-0x00000000007F0000-0x00000000018AA000-memory.dmp

                                    Filesize

                                    16.7MB

                                  • memory/3136-47-0x00000000007F0000-0x00000000018AA000-memory.dmp

                                    Filesize

                                    16.7MB

                                  • memory/3136-48-0x00000000007F0000-0x00000000018AA000-memory.dmp

                                    Filesize

                                    16.7MB

                                  • memory/3136-50-0x00000000007F0000-0x00000000018AA000-memory.dmp

                                    Filesize

                                    16.7MB

                                  • memory/3136-51-0x00000000007F0000-0x00000000018AA000-memory.dmp

                                    Filesize

                                    16.7MB

                                  • memory/3136-52-0x00000000007F0000-0x00000000018AA000-memory.dmp

                                    Filesize

                                    16.7MB

                                  • memory/3136-53-0x00000000007F0000-0x00000000018AA000-memory.dmp

                                    Filesize

                                    16.7MB

                                  • memory/3136-55-0x00000000007F0000-0x00000000018AA000-memory.dmp

                                    Filesize

                                    16.7MB

                                  • memory/3136-62-0x00000000007F0000-0x00000000018AA000-memory.dmp

                                    Filesize

                                    16.7MB

                                  • memory/3136-63-0x00000000007F0000-0x00000000018AA000-memory.dmp

                                    Filesize

                                    16.7MB

                                  • memory/3136-65-0x00000000007F0000-0x00000000018AA000-memory.dmp

                                    Filesize

                                    16.7MB

                                  • memory/3136-67-0x00000000007F0000-0x00000000018AA000-memory.dmp

                                    Filesize

                                    16.7MB

                                  • memory/3136-68-0x00000000007F0000-0x00000000018AA000-memory.dmp

                                    Filesize

                                    16.7MB

                                  • memory/3136-69-0x00000000007F0000-0x00000000018AA000-memory.dmp

                                    Filesize

                                    16.7MB

                                  • memory/3136-70-0x00000000007F0000-0x00000000018AA000-memory.dmp

                                    Filesize

                                    16.7MB

                                  • memory/3136-72-0x00000000007F0000-0x00000000018AA000-memory.dmp

                                    Filesize

                                    16.7MB

                                  • memory/3136-74-0x00000000007F0000-0x00000000018AA000-memory.dmp

                                    Filesize

                                    16.7MB

                                  • memory/3136-79-0x00000000007F0000-0x00000000018AA000-memory.dmp

                                    Filesize

                                    16.7MB

                                  • memory/3136-88-0x0000000000400000-0x0000000000412000-memory.dmp

                                    Filesize

                                    72KB

                                  We care about your privacy.

                                  This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.