Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
30-12-2024 00:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
812f93921569c7180f67f5c95687ee9c78ff336b6fcc9c62a5589cc08d7b2d51.dll
Resource
win7-20241023-en
windows7-x64
17 signatures
150 seconds
General
-
Target
812f93921569c7180f67f5c95687ee9c78ff336b6fcc9c62a5589cc08d7b2d51.dll
-
Size
120KB
-
MD5
2297cb27693852f31f95a1fe6c65c02e
-
SHA1
1c3063b830cbb7f4cd99bf08222782d3c41165f9
-
SHA256
812f93921569c7180f67f5c95687ee9c78ff336b6fcc9c62a5589cc08d7b2d51
-
SHA512
e1aa29ceda8a02bc0a72c88919889688804aa30f31386c7815362b589be32727b29084920e7878e406bf6541e00d6d2c718672c0ceb98c4399924832cc961dc0
-
SSDEEP
1536:NZFvAVW7gulsX2+uU9tmeNqAQZBEAnLvVoyU1PPY7Kdabk6EbiDE:XFYlulQfuStLNqrXEADhU1P3dabUW
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f769a4c.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f769a4c.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f769a4c.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f76b5f7.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f76b5f7.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f76b5f7.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f769a4c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76b5f7.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f769a4c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f769a4c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76b5f7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76b5f7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f769a4c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f769a4c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f769a4c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f769a4c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76b5f7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76b5f7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76b5f7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76b5f7.exe -
Executes dropped EXE 3 IoCs
pid Process 2100 f769a4c.exe 3020 f769be2.exe 2676 f76b5f7.exe -
Loads dropped DLL 6 IoCs
pid Process 2344 rundll32.exe 2344 rundll32.exe 2344 rundll32.exe 2344 rundll32.exe 2344 rundll32.exe 2344 rundll32.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f769a4c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f769a4c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f769a4c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76b5f7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76b5f7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76b5f7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f769a4c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76b5f7.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f76b5f7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f769a4c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f769a4c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f769a4c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76b5f7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76b5f7.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f769a4c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76b5f7.exe -
Enumerates connected drives 3 TTPs 16 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: f769a4c.exe File opened (read-only) \??\K: f769a4c.exe File opened (read-only) \??\L: f769a4c.exe File opened (read-only) \??\O: f769a4c.exe File opened (read-only) \??\P: f769a4c.exe File opened (read-only) \??\R: f769a4c.exe File opened (read-only) \??\E: f76b5f7.exe File opened (read-only) \??\E: f769a4c.exe File opened (read-only) \??\G: f769a4c.exe File opened (read-only) \??\J: f769a4c.exe File opened (read-only) \??\N: f769a4c.exe File opened (read-only) \??\Q: f769a4c.exe File opened (read-only) \??\H: f769a4c.exe File opened (read-only) \??\M: f769a4c.exe File opened (read-only) \??\S: f769a4c.exe File opened (read-only) \??\G: f76b5f7.exe -
resource yara_rule behavioral1/memory/2100-22-0x0000000000670000-0x000000000172A000-memory.dmp upx behavioral1/memory/2100-23-0x0000000000670000-0x000000000172A000-memory.dmp upx behavioral1/memory/2100-20-0x0000000000670000-0x000000000172A000-memory.dmp upx behavioral1/memory/2100-19-0x0000000000670000-0x000000000172A000-memory.dmp upx behavioral1/memory/2100-16-0x0000000000670000-0x000000000172A000-memory.dmp upx behavioral1/memory/2100-14-0x0000000000670000-0x000000000172A000-memory.dmp upx behavioral1/memory/2100-24-0x0000000000670000-0x000000000172A000-memory.dmp upx behavioral1/memory/2100-21-0x0000000000670000-0x000000000172A000-memory.dmp upx behavioral1/memory/2100-18-0x0000000000670000-0x000000000172A000-memory.dmp upx behavioral1/memory/2100-17-0x0000000000670000-0x000000000172A000-memory.dmp upx behavioral1/memory/2100-62-0x0000000000670000-0x000000000172A000-memory.dmp upx behavioral1/memory/2100-61-0x0000000000670000-0x000000000172A000-memory.dmp upx behavioral1/memory/2100-63-0x0000000000670000-0x000000000172A000-memory.dmp upx behavioral1/memory/2100-64-0x0000000000670000-0x000000000172A000-memory.dmp upx behavioral1/memory/2100-65-0x0000000000670000-0x000000000172A000-memory.dmp upx behavioral1/memory/2100-67-0x0000000000670000-0x000000000172A000-memory.dmp upx behavioral1/memory/2100-68-0x0000000000670000-0x000000000172A000-memory.dmp upx behavioral1/memory/2100-82-0x0000000000670000-0x000000000172A000-memory.dmp upx behavioral1/memory/2100-84-0x0000000000670000-0x000000000172A000-memory.dmp upx behavioral1/memory/2100-86-0x0000000000670000-0x000000000172A000-memory.dmp upx behavioral1/memory/2100-105-0x0000000000670000-0x000000000172A000-memory.dmp upx behavioral1/memory/2100-106-0x0000000000670000-0x000000000172A000-memory.dmp upx behavioral1/memory/2100-108-0x0000000000670000-0x000000000172A000-memory.dmp upx behavioral1/memory/2676-163-0x0000000000A80000-0x0000000001B3A000-memory.dmp upx behavioral1/memory/2100-151-0x0000000000670000-0x000000000172A000-memory.dmp upx behavioral1/memory/2676-203-0x0000000000A80000-0x0000000001B3A000-memory.dmp upx -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\f769a9a f769a4c.exe File opened for modification C:\Windows\SYSTEM.INI f769a4c.exe File created C:\Windows\f76ea30 f76b5f7.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f769a4c.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f76b5f7.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2100 f769a4c.exe 2100 f769a4c.exe 2676 f76b5f7.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeDebugPrivilege 2100 f769a4c.exe Token: SeDebugPrivilege 2100 f769a4c.exe Token: SeDebugPrivilege 2100 f769a4c.exe Token: SeDebugPrivilege 2100 f769a4c.exe Token: SeDebugPrivilege 2100 f769a4c.exe Token: SeDebugPrivilege 2100 f769a4c.exe Token: SeDebugPrivilege 2100 f769a4c.exe Token: SeDebugPrivilege 2100 f769a4c.exe Token: SeDebugPrivilege 2100 f769a4c.exe Token: SeDebugPrivilege 2100 f769a4c.exe Token: SeDebugPrivilege 2100 f769a4c.exe Token: SeDebugPrivilege 2100 f769a4c.exe Token: SeDebugPrivilege 2100 f769a4c.exe Token: SeDebugPrivilege 2100 f769a4c.exe Token: SeDebugPrivilege 2100 f769a4c.exe Token: SeDebugPrivilege 2100 f769a4c.exe Token: SeDebugPrivilege 2100 f769a4c.exe Token: SeDebugPrivilege 2100 f769a4c.exe Token: SeDebugPrivilege 2100 f769a4c.exe Token: SeDebugPrivilege 2100 f769a4c.exe Token: SeDebugPrivilege 2100 f769a4c.exe Token: SeDebugPrivilege 2100 f769a4c.exe Token: SeDebugPrivilege 2100 f769a4c.exe Token: SeDebugPrivilege 2676 f76b5f7.exe Token: SeDebugPrivilege 2676 f76b5f7.exe Token: SeDebugPrivilege 2676 f76b5f7.exe Token: SeDebugPrivilege 2676 f76b5f7.exe Token: SeDebugPrivilege 2676 f76b5f7.exe Token: SeDebugPrivilege 2676 f76b5f7.exe Token: SeDebugPrivilege 2676 f76b5f7.exe Token: SeDebugPrivilege 2676 f76b5f7.exe Token: SeDebugPrivilege 2676 f76b5f7.exe Token: SeDebugPrivilege 2676 f76b5f7.exe Token: SeDebugPrivilege 2676 f76b5f7.exe Token: SeDebugPrivilege 2676 f76b5f7.exe Token: SeDebugPrivilege 2676 f76b5f7.exe Token: SeDebugPrivilege 2676 f76b5f7.exe Token: SeDebugPrivilege 2676 f76b5f7.exe Token: SeDebugPrivilege 2676 f76b5f7.exe Token: SeDebugPrivilege 2676 f76b5f7.exe Token: SeDebugPrivilege 2676 f76b5f7.exe Token: SeDebugPrivilege 2676 f76b5f7.exe Token: SeDebugPrivilege 2676 f76b5f7.exe Token: SeDebugPrivilege 2676 f76b5f7.exe Token: SeDebugPrivilege 2676 f76b5f7.exe Token: SeDebugPrivilege 2676 f76b5f7.exe -
Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 3008 wrote to memory of 2344 3008 rundll32.exe 30 PID 3008 wrote to memory of 2344 3008 rundll32.exe 30 PID 3008 wrote to memory of 2344 3008 rundll32.exe 30 PID 3008 wrote to memory of 2344 3008 rundll32.exe 30 PID 3008 wrote to memory of 2344 3008 rundll32.exe 30 PID 3008 wrote to memory of 2344 3008 rundll32.exe 30 PID 3008 wrote to memory of 2344 3008 rundll32.exe 30 PID 2344 wrote to memory of 2100 2344 rundll32.exe 31 PID 2344 wrote to memory of 2100 2344 rundll32.exe 31 PID 2344 wrote to memory of 2100 2344 rundll32.exe 31 PID 2344 wrote to memory of 2100 2344 rundll32.exe 31 PID 2100 wrote to memory of 1040 2100 f769a4c.exe 17 PID 2100 wrote to memory of 1096 2100 f769a4c.exe 19 PID 2100 wrote to memory of 1176 2100 f769a4c.exe 21 PID 2100 wrote to memory of 1796 2100 f769a4c.exe 25 PID 2100 wrote to memory of 3008 2100 f769a4c.exe 29 PID 2100 wrote to memory of 2344 2100 f769a4c.exe 30 PID 2100 wrote to memory of 2344 2100 f769a4c.exe 30 PID 2344 wrote to memory of 3020 2344 rundll32.exe 32 PID 2344 wrote to memory of 3020 2344 rundll32.exe 32 PID 2344 wrote to memory of 3020 2344 rundll32.exe 32 PID 2344 wrote to memory of 3020 2344 rundll32.exe 32 PID 2344 wrote to memory of 2676 2344 rundll32.exe 33 PID 2344 wrote to memory of 2676 2344 rundll32.exe 33 PID 2344 wrote to memory of 2676 2344 rundll32.exe 33 PID 2344 wrote to memory of 2676 2344 rundll32.exe 33 PID 2100 wrote to memory of 1040 2100 f769a4c.exe 17 PID 2100 wrote to memory of 1096 2100 f769a4c.exe 19 PID 2100 wrote to memory of 1176 2100 f769a4c.exe 21 PID 2100 wrote to memory of 1796 2100 f769a4c.exe 25 PID 2100 wrote to memory of 3020 2100 f769a4c.exe 32 PID 2100 wrote to memory of 3020 2100 f769a4c.exe 32 PID 2100 wrote to memory of 2676 2100 f769a4c.exe 33 PID 2100 wrote to memory of 2676 2100 f769a4c.exe 33 PID 2676 wrote to memory of 1040 2676 f76b5f7.exe 17 PID 2676 wrote to memory of 1096 2676 f76b5f7.exe 19 PID 2676 wrote to memory of 1176 2676 f76b5f7.exe 21 PID 2676 wrote to memory of 1796 2676 f76b5f7.exe 25 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76b5f7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f769a4c.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1040
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1096
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1176
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\812f93921569c7180f67f5c95687ee9c78ff336b6fcc9c62a5589cc08d7b2d51.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\812f93921569c7180f67f5c95687ee9c78ff336b6fcc9c62a5589cc08d7b2d51.dll,#13⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\f769a4c.exeC:\Users\Admin\AppData\Local\Temp\f769a4c.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2100
-
-
C:\Users\Admin\AppData\Local\Temp\f769be2.exeC:\Users\Admin\AppData\Local\Temp\f769be2.exe4⤵
- Executes dropped EXE
PID:3020
-
-
C:\Users\Admin\AppData\Local\Temp\f76b5f7.exeC:\Users\Admin\AppData\Local\Temp\f76b5f7.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2676
-
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1796
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD5ca44e185c384877562feea5f34662be6
SHA18f71a8d71a039c83024ee5d7c50654df51e3233b
SHA25668b002a34e95d6c2891f9a4cdd8859ec57d3ff1addd515845eac48def1d8d78f
SHA512edffd612d143ac8239ba3e4f686e5263b078b5c963d5866f5db373c0e1c42c1cf832057ed9d83e9d7ec7fb3827bba349fe6d223eb678342468082320124bc2da
-
Filesize
257B
MD534efd89f1723306c9c72ed95c52f3313
SHA1187fffe357a7027848dc8b66e57345f48751e294
SHA25694750d717d53c5039273b0701fda58ba4d8fbff17ba085f9824b95e32348b5aa
SHA51221f213f060d90f228ffee777914871c62cf6c1528376044efff88def065730a626c59b029c7dbd4fec51bdcd1818d405a1a70b795289467943222123a2ff3180