Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
28s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
30/12/2024, 22:09
Static task
static1
Behavioral task
behavioral1
Sample
e5c97b9472cb8f1a013cb8e69adbed27889ae38cf7708e3974ab6483719977e6N.dll
Resource
win7-20240903-en
General
-
Target
e5c97b9472cb8f1a013cb8e69adbed27889ae38cf7708e3974ab6483719977e6N.dll
-
Size
120KB
-
MD5
2f05024bd97fd20f03bb95a5f5343210
-
SHA1
145d6f28f19ffc623a776475d717fa9718b360ac
-
SHA256
e5c97b9472cb8f1a013cb8e69adbed27889ae38cf7708e3974ab6483719977e6
-
SHA512
40b2e8a9dd4c68df4b84411c3329bd62c6307db12815ac88a298903fd66738300f66ac6e3515d8d9caa1e1babbcf985c259e36c22a5553b04f3cfb5d73ca2546
-
SSDEEP
1536:BlO+6YXHf3lXPCUcg3u3ZDBaEM9FDhFOW2G8kutBUlF8QD7Zint9Q5ndQGD/Vh:BZZHFC9gnEoF9J8kYUBDKAqGL
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f769f4b.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f769f4b.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f768288.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f768288.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f768288.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f769f4b.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f768288.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f769f4b.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f768288.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f768288.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f768288.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f768288.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f769f4b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f768288.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f768288.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f769f4b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f769f4b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f769f4b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f769f4b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f769f4b.exe -
Executes dropped EXE 3 IoCs
pid Process 2660 f768288.exe 2992 f76841e.exe 1500 f769f4b.exe -
Loads dropped DLL 6 IoCs
pid Process 2128 rundll32.exe 2128 rundll32.exe 2128 rundll32.exe 2128 rundll32.exe 2128 rundll32.exe 2128 rundll32.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f768288.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f768288.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f769f4b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f769f4b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f769f4b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f768288.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f768288.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f768288.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f769f4b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f768288.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f769f4b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f768288.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f769f4b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f769f4b.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f768288.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f769f4b.exe -
Enumerates connected drives 3 TTPs 13 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: f769f4b.exe File opened (read-only) \??\E: f768288.exe File opened (read-only) \??\H: f768288.exe File opened (read-only) \??\M: f768288.exe File opened (read-only) \??\N: f768288.exe File opened (read-only) \??\P: f768288.exe File opened (read-only) \??\E: f769f4b.exe File opened (read-only) \??\G: f768288.exe File opened (read-only) \??\I: f768288.exe File opened (read-only) \??\J: f768288.exe File opened (read-only) \??\K: f768288.exe File opened (read-only) \??\L: f768288.exe File opened (read-only) \??\O: f768288.exe -
resource yara_rule behavioral1/memory/2660-14-0x0000000000700000-0x00000000017BA000-memory.dmp upx behavioral1/memory/2660-18-0x0000000000700000-0x00000000017BA000-memory.dmp upx behavioral1/memory/2660-16-0x0000000000700000-0x00000000017BA000-memory.dmp upx behavioral1/memory/2660-19-0x0000000000700000-0x00000000017BA000-memory.dmp upx behavioral1/memory/2660-22-0x0000000000700000-0x00000000017BA000-memory.dmp upx behavioral1/memory/2660-23-0x0000000000700000-0x00000000017BA000-memory.dmp upx behavioral1/memory/2660-20-0x0000000000700000-0x00000000017BA000-memory.dmp upx behavioral1/memory/2660-24-0x0000000000700000-0x00000000017BA000-memory.dmp upx behavioral1/memory/2660-21-0x0000000000700000-0x00000000017BA000-memory.dmp upx behavioral1/memory/2660-17-0x0000000000700000-0x00000000017BA000-memory.dmp upx behavioral1/memory/2660-63-0x0000000000700000-0x00000000017BA000-memory.dmp upx behavioral1/memory/2660-64-0x0000000000700000-0x00000000017BA000-memory.dmp upx behavioral1/memory/2660-65-0x0000000000700000-0x00000000017BA000-memory.dmp upx behavioral1/memory/2660-66-0x0000000000700000-0x00000000017BA000-memory.dmp upx behavioral1/memory/2660-68-0x0000000000700000-0x00000000017BA000-memory.dmp upx behavioral1/memory/2660-67-0x0000000000700000-0x00000000017BA000-memory.dmp upx behavioral1/memory/2660-84-0x0000000000700000-0x00000000017BA000-memory.dmp upx behavioral1/memory/2660-85-0x0000000000700000-0x00000000017BA000-memory.dmp upx behavioral1/memory/2660-107-0x0000000000700000-0x00000000017BA000-memory.dmp upx behavioral1/memory/2660-109-0x0000000000700000-0x00000000017BA000-memory.dmp upx behavioral1/memory/2660-111-0x0000000000700000-0x00000000017BA000-memory.dmp upx behavioral1/memory/2660-149-0x0000000000700000-0x00000000017BA000-memory.dmp upx behavioral1/memory/1500-167-0x0000000000910000-0x00000000019CA000-memory.dmp upx behavioral1/memory/1500-207-0x0000000000910000-0x00000000019CA000-memory.dmp upx -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\f7682f5 f768288.exe File opened for modification C:\Windows\SYSTEM.INI f768288.exe File created C:\Windows\f76d337 f769f4b.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f768288.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f769f4b.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2660 f768288.exe 2660 f768288.exe 1500 f769f4b.exe -
Suspicious use of AdjustPrivilegeToken 45 IoCs
description pid Process Token: SeDebugPrivilege 2660 f768288.exe Token: SeDebugPrivilege 2660 f768288.exe Token: SeDebugPrivilege 2660 f768288.exe Token: SeDebugPrivilege 2660 f768288.exe Token: SeDebugPrivilege 2660 f768288.exe Token: SeDebugPrivilege 2660 f768288.exe Token: SeDebugPrivilege 2660 f768288.exe Token: SeDebugPrivilege 2660 f768288.exe Token: SeDebugPrivilege 2660 f768288.exe Token: SeDebugPrivilege 2660 f768288.exe Token: SeDebugPrivilege 2660 f768288.exe Token: SeDebugPrivilege 2660 f768288.exe Token: SeDebugPrivilege 2660 f768288.exe Token: SeDebugPrivilege 2660 f768288.exe Token: SeDebugPrivilege 2660 f768288.exe Token: SeDebugPrivilege 2660 f768288.exe Token: SeDebugPrivilege 2660 f768288.exe Token: SeDebugPrivilege 2660 f768288.exe Token: SeDebugPrivilege 2660 f768288.exe Token: SeDebugPrivilege 2660 f768288.exe Token: SeDebugPrivilege 2660 f768288.exe Token: SeDebugPrivilege 2660 f768288.exe Token: SeDebugPrivilege 2660 f768288.exe Token: SeDebugPrivilege 1500 f769f4b.exe Token: SeDebugPrivilege 1500 f769f4b.exe Token: SeDebugPrivilege 1500 f769f4b.exe Token: SeDebugPrivilege 1500 f769f4b.exe Token: SeDebugPrivilege 1500 f769f4b.exe Token: SeDebugPrivilege 1500 f769f4b.exe Token: SeDebugPrivilege 1500 f769f4b.exe Token: SeDebugPrivilege 1500 f769f4b.exe Token: SeDebugPrivilege 1500 f769f4b.exe Token: SeDebugPrivilege 1500 f769f4b.exe Token: SeDebugPrivilege 1500 f769f4b.exe Token: SeDebugPrivilege 1500 f769f4b.exe Token: SeDebugPrivilege 1500 f769f4b.exe Token: SeDebugPrivilege 1500 f769f4b.exe Token: SeDebugPrivilege 1500 f769f4b.exe Token: SeDebugPrivilege 1500 f769f4b.exe Token: SeDebugPrivilege 1500 f769f4b.exe Token: SeDebugPrivilege 1500 f769f4b.exe Token: SeDebugPrivilege 1500 f769f4b.exe Token: SeDebugPrivilege 1500 f769f4b.exe Token: SeDebugPrivilege 1500 f769f4b.exe Token: SeDebugPrivilege 1500 f769f4b.exe -
Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 2216 wrote to memory of 2128 2216 rundll32.exe 30 PID 2216 wrote to memory of 2128 2216 rundll32.exe 30 PID 2216 wrote to memory of 2128 2216 rundll32.exe 30 PID 2216 wrote to memory of 2128 2216 rundll32.exe 30 PID 2216 wrote to memory of 2128 2216 rundll32.exe 30 PID 2216 wrote to memory of 2128 2216 rundll32.exe 30 PID 2216 wrote to memory of 2128 2216 rundll32.exe 30 PID 2128 wrote to memory of 2660 2128 rundll32.exe 31 PID 2128 wrote to memory of 2660 2128 rundll32.exe 31 PID 2128 wrote to memory of 2660 2128 rundll32.exe 31 PID 2128 wrote to memory of 2660 2128 rundll32.exe 31 PID 2660 wrote to memory of 1104 2660 f768288.exe 19 PID 2660 wrote to memory of 1152 2660 f768288.exe 20 PID 2660 wrote to memory of 1188 2660 f768288.exe 21 PID 2660 wrote to memory of 1376 2660 f768288.exe 23 PID 2660 wrote to memory of 2216 2660 f768288.exe 29 PID 2660 wrote to memory of 2128 2660 f768288.exe 30 PID 2660 wrote to memory of 2128 2660 f768288.exe 30 PID 2128 wrote to memory of 2992 2128 rundll32.exe 32 PID 2128 wrote to memory of 2992 2128 rundll32.exe 32 PID 2128 wrote to memory of 2992 2128 rundll32.exe 32 PID 2128 wrote to memory of 2992 2128 rundll32.exe 32 PID 2128 wrote to memory of 1500 2128 rundll32.exe 33 PID 2128 wrote to memory of 1500 2128 rundll32.exe 33 PID 2128 wrote to memory of 1500 2128 rundll32.exe 33 PID 2128 wrote to memory of 1500 2128 rundll32.exe 33 PID 2660 wrote to memory of 1104 2660 f768288.exe 19 PID 2660 wrote to memory of 1152 2660 f768288.exe 20 PID 2660 wrote to memory of 1188 2660 f768288.exe 21 PID 2660 wrote to memory of 1376 2660 f768288.exe 23 PID 2660 wrote to memory of 2992 2660 f768288.exe 32 PID 2660 wrote to memory of 2992 2660 f768288.exe 32 PID 2660 wrote to memory of 1500 2660 f768288.exe 33 PID 2660 wrote to memory of 1500 2660 f768288.exe 33 PID 1500 wrote to memory of 1104 1500 f769f4b.exe 19 PID 1500 wrote to memory of 1152 1500 f769f4b.exe 20 PID 1500 wrote to memory of 1188 1500 f769f4b.exe 21 PID 1500 wrote to memory of 1376 1500 f769f4b.exe 23 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f768288.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f769f4b.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1104
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1152
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1188
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e5c97b9472cb8f1a013cb8e69adbed27889ae38cf7708e3974ab6483719977e6N.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e5c97b9472cb8f1a013cb8e69adbed27889ae38cf7708e3974ab6483719977e6N.dll,#13⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\f768288.exeC:\Users\Admin\AppData\Local\Temp\f768288.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2660
-
-
C:\Users\Admin\AppData\Local\Temp\f76841e.exeC:\Users\Admin\AppData\Local\Temp\f76841e.exe4⤵
- Executes dropped EXE
PID:2992
-
-
C:\Users\Admin\AppData\Local\Temp\f769f4b.exeC:\Users\Admin\AppData\Local\Temp\f769f4b.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1500
-
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1376
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
256B
MD51ff0047fec7dc47db5bc397e377e4853
SHA1403d3b0e1d4868da791c2e3b9f331e2f602ecf8d
SHA25626bee921605b6fd5443bb1c15d35a0f0329afc4ea922e0bca4f62b9742dc3573
SHA5124c7018140c98aca6ffd3801b5cae756b9eba7f456ce7173b3e2e8e245931e38b1c7c6edcd9691f91c22a5d5d285bc8b3da37fa1dd83f00e75027a6058db8a580
-
Filesize
97KB
MD5c961515ad078fd7bf66e7aa030289959
SHA170a37672dbd8b0cd7132a1769c0080bbfd8e1c2c
SHA256b31bf0e3dd22240e2105c9a4f4cbb970f9ebc3e74484fcc5c8c159c5e48f05b3
SHA512d38d4daa372bde76a4d8515acc9854e7bb1b663157122dc71d3f5744e95c2a4076d907a0f6037494ca005f1221727ddb1c63587b8d6b61335fad7cd700dc1c52