Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
32s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
25/12/2024, 18:48
Static task
static1
Behavioral task
behavioral1
Sample
ad858942ae4ddb040f083ff818898721b8a1554fe6784496805a24b8ad9e3e5eN.dll
Resource
win7-20241010-en
General
-
Target
ad858942ae4ddb040f083ff818898721b8a1554fe6784496805a24b8ad9e3e5eN.dll
-
Size
120KB
-
MD5
0cb0e929f8e0bc6261012f0dfa3dab50
-
SHA1
31fa6331cebd979e1f5ceb42792d067905f1ea03
-
SHA256
ad858942ae4ddb040f083ff818898721b8a1554fe6784496805a24b8ad9e3e5e
-
SHA512
a561aa145bfb76be760bdc46c0c3c6454abd701606ff672cd05fb91a8f6a04b579ad695edfe98c3587107e8fe350f306868768b0780521116382054966d02cff
-
SSDEEP
1536:lCAjrNEEy0/c2pD0+2ZeZvuvN+nU0p0+zKsJW8bUoH0pKbq7pntbr692XSXu99:8AjrNEXQ0+SuGvcnpvlzUEYtbr692XX
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f78589b.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f78589b.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f78589b.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f78589b.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f78589b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f78589b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f78589b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f78589b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f78589b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f78589b.exe -
Executes dropped EXE 3 IoCs
pid Process 3036 f78589b.exe 2832 f785cd0.exe 2136 f7877a0.exe -
Loads dropped DLL 6 IoCs
pid Process 1428 rundll32.exe 1428 rundll32.exe 1428 rundll32.exe 1428 rundll32.exe 1428 rundll32.exe 1428 rundll32.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f78589b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f78589b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f78589b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f78589b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f78589b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f78589b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f78589b.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f78589b.exe -
Enumerates connected drives 3 TTPs 5 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: f78589b.exe File opened (read-only) \??\J: f78589b.exe File opened (read-only) \??\E: f78589b.exe File opened (read-only) \??\G: f78589b.exe File opened (read-only) \??\H: f78589b.exe -
resource yara_rule behavioral1/memory/3036-19-0x0000000000630000-0x00000000016EA000-memory.dmp upx behavioral1/memory/3036-13-0x0000000000630000-0x00000000016EA000-memory.dmp upx behavioral1/memory/3036-14-0x0000000000630000-0x00000000016EA000-memory.dmp upx behavioral1/memory/3036-17-0x0000000000630000-0x00000000016EA000-memory.dmp upx behavioral1/memory/3036-20-0x0000000000630000-0x00000000016EA000-memory.dmp upx behavioral1/memory/3036-21-0x0000000000630000-0x00000000016EA000-memory.dmp upx behavioral1/memory/3036-16-0x0000000000630000-0x00000000016EA000-memory.dmp upx behavioral1/memory/3036-18-0x0000000000630000-0x00000000016EA000-memory.dmp upx behavioral1/memory/3036-22-0x0000000000630000-0x00000000016EA000-memory.dmp upx behavioral1/memory/3036-15-0x0000000000630000-0x00000000016EA000-memory.dmp upx behavioral1/memory/3036-61-0x0000000000630000-0x00000000016EA000-memory.dmp upx behavioral1/memory/3036-62-0x0000000000630000-0x00000000016EA000-memory.dmp upx behavioral1/memory/3036-63-0x0000000000630000-0x00000000016EA000-memory.dmp upx behavioral1/memory/3036-65-0x0000000000630000-0x00000000016EA000-memory.dmp upx behavioral1/memory/3036-78-0x0000000000630000-0x00000000016EA000-memory.dmp upx behavioral1/memory/3036-89-0x0000000000630000-0x00000000016EA000-memory.dmp upx behavioral1/memory/3036-98-0x0000000000630000-0x00000000016EA000-memory.dmp upx behavioral1/memory/3036-99-0x0000000000630000-0x00000000016EA000-memory.dmp upx behavioral1/memory/3036-101-0x0000000000630000-0x00000000016EA000-memory.dmp upx behavioral1/memory/3036-104-0x0000000000630000-0x00000000016EA000-memory.dmp upx behavioral1/memory/3036-108-0x0000000000630000-0x00000000016EA000-memory.dmp upx behavioral1/memory/3036-110-0x0000000000630000-0x00000000016EA000-memory.dmp upx behavioral1/memory/2136-137-0x0000000000910000-0x00000000019CA000-memory.dmp upx -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\f785985 f78589b.exe File opened for modification C:\Windows\SYSTEM.INI f78589b.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f78589b.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3036 f78589b.exe 3036 f78589b.exe -
Suspicious use of AdjustPrivilegeToken 21 IoCs
description pid Process Token: SeDebugPrivilege 3036 f78589b.exe Token: SeDebugPrivilege 3036 f78589b.exe Token: SeDebugPrivilege 3036 f78589b.exe Token: SeDebugPrivilege 3036 f78589b.exe Token: SeDebugPrivilege 3036 f78589b.exe Token: SeDebugPrivilege 3036 f78589b.exe Token: SeDebugPrivilege 3036 f78589b.exe Token: SeDebugPrivilege 3036 f78589b.exe Token: SeDebugPrivilege 3036 f78589b.exe Token: SeDebugPrivilege 3036 f78589b.exe Token: SeDebugPrivilege 3036 f78589b.exe Token: SeDebugPrivilege 3036 f78589b.exe Token: SeDebugPrivilege 3036 f78589b.exe Token: SeDebugPrivilege 3036 f78589b.exe Token: SeDebugPrivilege 3036 f78589b.exe Token: SeDebugPrivilege 3036 f78589b.exe Token: SeDebugPrivilege 3036 f78589b.exe Token: SeDebugPrivilege 3036 f78589b.exe Token: SeDebugPrivilege 3036 f78589b.exe Token: SeDebugPrivilege 3036 f78589b.exe Token: SeDebugPrivilege 3036 f78589b.exe -
Suspicious use of WriteProcessMemory 34 IoCs
description pid Process procid_target PID 572 wrote to memory of 1428 572 rundll32.exe 29 PID 572 wrote to memory of 1428 572 rundll32.exe 29 PID 572 wrote to memory of 1428 572 rundll32.exe 29 PID 572 wrote to memory of 1428 572 rundll32.exe 29 PID 572 wrote to memory of 1428 572 rundll32.exe 29 PID 572 wrote to memory of 1428 572 rundll32.exe 29 PID 572 wrote to memory of 1428 572 rundll32.exe 29 PID 1428 wrote to memory of 3036 1428 rundll32.exe 30 PID 1428 wrote to memory of 3036 1428 rundll32.exe 30 PID 1428 wrote to memory of 3036 1428 rundll32.exe 30 PID 1428 wrote to memory of 3036 1428 rundll32.exe 30 PID 3036 wrote to memory of 1128 3036 f78589b.exe 18 PID 3036 wrote to memory of 1180 3036 f78589b.exe 19 PID 3036 wrote to memory of 1244 3036 f78589b.exe 20 PID 3036 wrote to memory of 1556 3036 f78589b.exe 22 PID 3036 wrote to memory of 572 3036 f78589b.exe 28 PID 3036 wrote to memory of 1428 3036 f78589b.exe 29 PID 3036 wrote to memory of 1428 3036 f78589b.exe 29 PID 1428 wrote to memory of 2832 1428 rundll32.exe 31 PID 1428 wrote to memory of 2832 1428 rundll32.exe 31 PID 1428 wrote to memory of 2832 1428 rundll32.exe 31 PID 1428 wrote to memory of 2832 1428 rundll32.exe 31 PID 1428 wrote to memory of 2136 1428 rundll32.exe 32 PID 1428 wrote to memory of 2136 1428 rundll32.exe 32 PID 1428 wrote to memory of 2136 1428 rundll32.exe 32 PID 1428 wrote to memory of 2136 1428 rundll32.exe 32 PID 3036 wrote to memory of 1128 3036 f78589b.exe 18 PID 3036 wrote to memory of 1180 3036 f78589b.exe 19 PID 3036 wrote to memory of 1244 3036 f78589b.exe 20 PID 3036 wrote to memory of 1556 3036 f78589b.exe 22 PID 3036 wrote to memory of 2832 3036 f78589b.exe 31 PID 3036 wrote to memory of 2832 3036 f78589b.exe 31 PID 3036 wrote to memory of 2136 3036 f78589b.exe 32 PID 3036 wrote to memory of 2136 3036 f78589b.exe 32 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f78589b.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1128
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1180
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1244
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ad858942ae4ddb040f083ff818898721b8a1554fe6784496805a24b8ad9e3e5eN.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:572 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ad858942ae4ddb040f083ff818898721b8a1554fe6784496805a24b8ad9e3e5eN.dll,#13⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1428 -
C:\Users\Admin\AppData\Local\Temp\f78589b.exeC:\Users\Admin\AppData\Local\Temp\f78589b.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3036
-
-
C:\Users\Admin\AppData\Local\Temp\f785cd0.exeC:\Users\Admin\AppData\Local\Temp\f785cd0.exe4⤵
- Executes dropped EXE
PID:2832
-
-
C:\Users\Admin\AppData\Local\Temp\f7877a0.exeC:\Users\Admin\AppData\Local\Temp\f7877a0.exe4⤵
- Executes dropped EXE
PID:2136
-
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1556
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD594dc1575845fca2f45e7cfc6ee9afbca
SHA17dd3fadf8cab403a0656922aaaa30bbd9c986a1c
SHA256b47e4e0cb34de306a6280c1a37112d6e2c525b714936d0cedcbe201af41c3596
SHA512d83811a17d0266d2ce0732d08e892ca246ffa1766c6f99cc33f8b12556de4dbaca57ee3beaa9a030910bc759c630b2d98c1cf164c99d59c5a5357f4db29f0dc1