Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
25-12-2024 18:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a9be046d5ca4dc176b807c136550a4780136a9549667e7253a5bd6195ffaf679.dll
Resource
win7-20240729-en
windows7-x64
17 signatures
150 seconds
General
-
Target
a9be046d5ca4dc176b807c136550a4780136a9549667e7253a5bd6195ffaf679.dll
-
Size
120KB
-
MD5
5cab94ffd05e725b9d27b31ccf48582f
-
SHA1
76b24b68fbc531386510bb11b8948d22c833cd30
-
SHA256
a9be046d5ca4dc176b807c136550a4780136a9549667e7253a5bd6195ffaf679
-
SHA512
e99363169c15eed4e3e5a1edcc7fc5781a37893420c9ac3d138e05890d4577431c90767ec025667a89dde2b0a67103dc10fe0e3cc7cde5eda7b377332294696f
-
SSDEEP
1536:agm6p1Fy3dxTqlP5zXb2HKBKe2NwN4XGNgaYrPLAjIhcw4hifQ5Bjx6U/6fTI4bd:/LwAdqHoKe2NwSXLP4Ihc52QzF8xNKKF
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f76f779.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f76f586.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f76f586.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f76f586.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f76f779.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f76f779.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76f586.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76f779.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76f779.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76f779.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76f586.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76f586.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76f586.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76f586.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76f779.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76f586.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76f586.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76f779.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76f779.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76f779.exe -
Executes dropped EXE 3 IoCs
pid Process 2916 f76f586.exe 2992 f76f779.exe 1300 f7713ee.exe -
Loads dropped DLL 6 IoCs
pid Process 2772 rundll32.exe 2772 rundll32.exe 2772 rundll32.exe 2772 rundll32.exe 2772 rundll32.exe 2772 rundll32.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76f779.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f76f779.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76f586.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76f586.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76f586.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f76f586.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76f779.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76f586.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76f586.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76f586.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76f779.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76f779.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76f779.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76f779.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76f586.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76f779.exe -
Enumerates connected drives 3 TTPs 15 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\J: f76f586.exe File opened (read-only) \??\K: f76f586.exe File opened (read-only) \??\Q: f76f586.exe File opened (read-only) \??\R: f76f586.exe File opened (read-only) \??\S: f76f586.exe File opened (read-only) \??\N: f76f586.exe File opened (read-only) \??\T: f76f586.exe File opened (read-only) \??\G: f76f586.exe File opened (read-only) \??\L: f76f586.exe File opened (read-only) \??\M: f76f586.exe File opened (read-only) \??\O: f76f586.exe File opened (read-only) \??\P: f76f586.exe File opened (read-only) \??\E: f76f586.exe File opened (read-only) \??\H: f76f586.exe File opened (read-only) \??\I: f76f586.exe -
resource yara_rule behavioral1/memory/2916-19-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2916-16-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2916-25-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2916-23-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2916-21-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2916-20-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2916-18-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2916-17-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2916-24-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2916-22-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2916-59-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2916-60-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2916-63-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2916-64-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2916-65-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2916-67-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2916-68-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2916-69-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2916-70-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2916-86-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2916-87-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2916-89-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2916-158-0x00000000006C0000-0x000000000177A000-memory.dmp upx -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI f76f586.exe File created C:\Windows\f7746e0 f76f779.exe File created C:\Windows\f76f612 f76f586.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f76f586.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f76f779.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2916 f76f586.exe 2916 f76f586.exe 2992 f76f779.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeDebugPrivilege 2916 f76f586.exe Token: SeDebugPrivilege 2916 f76f586.exe Token: SeDebugPrivilege 2916 f76f586.exe Token: SeDebugPrivilege 2916 f76f586.exe Token: SeDebugPrivilege 2916 f76f586.exe Token: SeDebugPrivilege 2916 f76f586.exe Token: SeDebugPrivilege 2916 f76f586.exe Token: SeDebugPrivilege 2916 f76f586.exe Token: SeDebugPrivilege 2916 f76f586.exe Token: SeDebugPrivilege 2916 f76f586.exe Token: SeDebugPrivilege 2916 f76f586.exe Token: SeDebugPrivilege 2916 f76f586.exe Token: SeDebugPrivilege 2916 f76f586.exe Token: SeDebugPrivilege 2916 f76f586.exe Token: SeDebugPrivilege 2916 f76f586.exe Token: SeDebugPrivilege 2916 f76f586.exe Token: SeDebugPrivilege 2916 f76f586.exe Token: SeDebugPrivilege 2916 f76f586.exe Token: SeDebugPrivilege 2916 f76f586.exe Token: SeDebugPrivilege 2916 f76f586.exe Token: SeDebugPrivilege 2916 f76f586.exe Token: SeDebugPrivilege 2916 f76f586.exe Token: SeDebugPrivilege 2916 f76f586.exe Token: SeDebugPrivilege 2916 f76f586.exe Token: SeDebugPrivilege 2992 f76f779.exe Token: SeDebugPrivilege 2992 f76f779.exe Token: SeDebugPrivilege 2992 f76f779.exe Token: SeDebugPrivilege 2992 f76f779.exe Token: SeDebugPrivilege 2992 f76f779.exe Token: SeDebugPrivilege 2992 f76f779.exe Token: SeDebugPrivilege 2992 f76f779.exe Token: SeDebugPrivilege 2992 f76f779.exe Token: SeDebugPrivilege 2992 f76f779.exe Token: SeDebugPrivilege 2992 f76f779.exe Token: SeDebugPrivilege 2992 f76f779.exe Token: SeDebugPrivilege 2992 f76f779.exe Token: SeDebugPrivilege 2992 f76f779.exe Token: SeDebugPrivilege 2992 f76f779.exe Token: SeDebugPrivilege 2992 f76f779.exe Token: SeDebugPrivilege 2992 f76f779.exe Token: SeDebugPrivilege 2992 f76f779.exe Token: SeDebugPrivilege 2992 f76f779.exe Token: SeDebugPrivilege 2992 f76f779.exe Token: SeDebugPrivilege 2992 f76f779.exe Token: SeDebugPrivilege 2992 f76f779.exe Token: SeDebugPrivilege 2992 f76f779.exe -
Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 2652 wrote to memory of 2772 2652 rundll32.exe 31 PID 2652 wrote to memory of 2772 2652 rundll32.exe 31 PID 2652 wrote to memory of 2772 2652 rundll32.exe 31 PID 2652 wrote to memory of 2772 2652 rundll32.exe 31 PID 2652 wrote to memory of 2772 2652 rundll32.exe 31 PID 2652 wrote to memory of 2772 2652 rundll32.exe 31 PID 2652 wrote to memory of 2772 2652 rundll32.exe 31 PID 2772 wrote to memory of 2916 2772 rundll32.exe 32 PID 2772 wrote to memory of 2916 2772 rundll32.exe 32 PID 2772 wrote to memory of 2916 2772 rundll32.exe 32 PID 2772 wrote to memory of 2916 2772 rundll32.exe 32 PID 2916 wrote to memory of 1060 2916 f76f586.exe 18 PID 2916 wrote to memory of 1120 2916 f76f586.exe 19 PID 2916 wrote to memory of 1180 2916 f76f586.exe 21 PID 2916 wrote to memory of 1140 2916 f76f586.exe 23 PID 2916 wrote to memory of 2652 2916 f76f586.exe 30 PID 2916 wrote to memory of 2772 2916 f76f586.exe 31 PID 2916 wrote to memory of 2772 2916 f76f586.exe 31 PID 2772 wrote to memory of 2992 2772 rundll32.exe 33 PID 2772 wrote to memory of 2992 2772 rundll32.exe 33 PID 2772 wrote to memory of 2992 2772 rundll32.exe 33 PID 2772 wrote to memory of 2992 2772 rundll32.exe 33 PID 2772 wrote to memory of 1300 2772 rundll32.exe 34 PID 2772 wrote to memory of 1300 2772 rundll32.exe 34 PID 2772 wrote to memory of 1300 2772 rundll32.exe 34 PID 2772 wrote to memory of 1300 2772 rundll32.exe 34 PID 2916 wrote to memory of 1060 2916 f76f586.exe 18 PID 2916 wrote to memory of 1120 2916 f76f586.exe 19 PID 2916 wrote to memory of 1180 2916 f76f586.exe 21 PID 2916 wrote to memory of 1140 2916 f76f586.exe 23 PID 2916 wrote to memory of 2992 2916 f76f586.exe 33 PID 2916 wrote to memory of 2992 2916 f76f586.exe 33 PID 2916 wrote to memory of 1300 2916 f76f586.exe 34 PID 2916 wrote to memory of 1300 2916 f76f586.exe 34 PID 2992 wrote to memory of 1060 2992 f76f779.exe 18 PID 2992 wrote to memory of 1120 2992 f76f779.exe 19 PID 2992 wrote to memory of 1180 2992 f76f779.exe 21 PID 2992 wrote to memory of 1140 2992 f76f779.exe 23 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76f586.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76f779.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1060
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1120
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1180
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a9be046d5ca4dc176b807c136550a4780136a9549667e7253a5bd6195ffaf679.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a9be046d5ca4dc176b807c136550a4780136a9549667e7253a5bd6195ffaf679.dll,#13⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\f76f586.exeC:\Users\Admin\AppData\Local\Temp\f76f586.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2916
-
-
C:\Users\Admin\AppData\Local\Temp\f76f779.exeC:\Users\Admin\AppData\Local\Temp\f76f779.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2992
-
-
C:\Users\Admin\AppData\Local\Temp\f7713ee.exeC:\Users\Admin\AppData\Local\Temp\f7713ee.exe4⤵
- Executes dropped EXE
PID:1300
-
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1140
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD513105e4759dff5b3f934f5d8c8eea40d
SHA152a6d803a6ca490dd4abee3ffeb94c0d02e9fb98
SHA256977f1455a6bc2ec5a3a99cc2b71449ba336cbd918aabb6429527c442483ea97c
SHA512331df7118bff4e270ff953c8532eb2ab253e319ba85debb6aca7a6fe025c3b93fbdd1ec744a177aeb544dff308b5cc840fc8bf4cbba38f1b7b821724b153b797
-
Filesize
257B
MD5a8217a03068fb5e1900ff6c46dbbdd43
SHA10c1b25d31cfa0f91738031a3b8c64146f69a0f01
SHA2564f1793cfac184c8449719de972b16d997c1e84a14972230562ea818ce8e22f1d
SHA512b22189770c8725d4fd892964008273d3360fc251cc2703a26b3a5c1107b1db935e8647cba5e6dd0ce6886386857538b721fd22f0e5093ffb7a2fe023e9a3ea0d