Analysis
-
max time kernel
27s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
31-12-2024 03:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2ee0ab6fc50b00936e7cb2c7ae1abcf4aa152fc304b32e33010d98389c4814af.dll
Resource
win7-20240903-en
windows7-x64
17 signatures
120 seconds
General
-
Target
2ee0ab6fc50b00936e7cb2c7ae1abcf4aa152fc304b32e33010d98389c4814af.dll
-
Size
120KB
-
MD5
0f858d4df8ad775f22fdb22d7e8cecca
-
SHA1
7b5f3bb9c4809d0e14cede221d87a3a2a2cda685
-
SHA256
2ee0ab6fc50b00936e7cb2c7ae1abcf4aa152fc304b32e33010d98389c4814af
-
SHA512
d4ba91061695230f901abafdb886003a2555158bcec9304c1c02dcae361c75ed259c48f5398f17d43f9667faf5f96bdfc58a2391143eb2ac31f5389220c933c6
-
SSDEEP
1536:R1/ZY5nu2RTjfIQNbx6orpDmzL51pokxu9h7aTCFUv2rQ4str3c5E5bYLcpik6e1:5wuq8Qn54HXuWuA2rDstIilp+W
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f768095.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f768095.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f7664cb.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f7664cb.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f7664cb.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f768095.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f7664cb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f768095.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f7664cb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f768095.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f768095.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f768095.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f768095.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f7664cb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f7664cb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f7664cb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f768095.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f7664cb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f7664cb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f768095.exe -
Executes dropped EXE 3 IoCs
pid Process 3068 f7664cb.exe 2892 f766642.exe 1860 f768095.exe -
Loads dropped DLL 6 IoCs
pid Process 2888 rundll32.exe 2888 rundll32.exe 2888 rundll32.exe 2888 rundll32.exe 2888 rundll32.exe 2888 rundll32.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f7664cb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f7664cb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f7664cb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f7664cb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f768095.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f768095.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f768095.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f7664cb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f7664cb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f768095.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f768095.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f7664cb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f768095.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f768095.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f7664cb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f768095.exe -
Enumerates connected drives 3 TTPs 17 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: f768095.exe File opened (read-only) \??\H: f7664cb.exe File opened (read-only) \??\K: f7664cb.exe File opened (read-only) \??\L: f7664cb.exe File opened (read-only) \??\M: f7664cb.exe File opened (read-only) \??\N: f7664cb.exe File opened (read-only) \??\O: f7664cb.exe File opened (read-only) \??\G: f7664cb.exe File opened (read-only) \??\I: f7664cb.exe File opened (read-only) \??\P: f7664cb.exe File opened (read-only) \??\Q: f7664cb.exe File opened (read-only) \??\T: f7664cb.exe File opened (read-only) \??\J: f7664cb.exe File opened (read-only) \??\E: f7664cb.exe File opened (read-only) \??\R: f7664cb.exe File opened (read-only) \??\S: f7664cb.exe File opened (read-only) \??\E: f768095.exe -
resource yara_rule behavioral1/memory/3068-14-0x00000000005F0000-0x00000000016AA000-memory.dmp upx behavioral1/memory/3068-13-0x00000000005F0000-0x00000000016AA000-memory.dmp upx behavioral1/memory/3068-19-0x00000000005F0000-0x00000000016AA000-memory.dmp upx behavioral1/memory/3068-18-0x00000000005F0000-0x00000000016AA000-memory.dmp upx behavioral1/memory/3068-21-0x00000000005F0000-0x00000000016AA000-memory.dmp upx behavioral1/memory/3068-17-0x00000000005F0000-0x00000000016AA000-memory.dmp upx behavioral1/memory/3068-15-0x00000000005F0000-0x00000000016AA000-memory.dmp upx behavioral1/memory/3068-22-0x00000000005F0000-0x00000000016AA000-memory.dmp upx behavioral1/memory/3068-20-0x00000000005F0000-0x00000000016AA000-memory.dmp upx behavioral1/memory/3068-16-0x00000000005F0000-0x00000000016AA000-memory.dmp upx behavioral1/memory/3068-62-0x00000000005F0000-0x00000000016AA000-memory.dmp upx behavioral1/memory/3068-61-0x00000000005F0000-0x00000000016AA000-memory.dmp upx behavioral1/memory/3068-63-0x00000000005F0000-0x00000000016AA000-memory.dmp upx behavioral1/memory/3068-65-0x00000000005F0000-0x00000000016AA000-memory.dmp upx behavioral1/memory/3068-64-0x00000000005F0000-0x00000000016AA000-memory.dmp upx behavioral1/memory/3068-67-0x00000000005F0000-0x00000000016AA000-memory.dmp upx behavioral1/memory/3068-68-0x00000000005F0000-0x00000000016AA000-memory.dmp upx behavioral1/memory/3068-81-0x00000000005F0000-0x00000000016AA000-memory.dmp upx behavioral1/memory/3068-85-0x00000000005F0000-0x00000000016AA000-memory.dmp upx behavioral1/memory/3068-87-0x00000000005F0000-0x00000000016AA000-memory.dmp upx behavioral1/memory/3068-153-0x00000000005F0000-0x00000000016AA000-memory.dmp upx behavioral1/memory/1860-163-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral1/memory/1860-211-0x0000000000980000-0x0000000001A3A000-memory.dmp upx -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\f766519 f7664cb.exe File opened for modification C:\Windows\SYSTEM.INI f7664cb.exe File created C:\Windows\f76b4ed f768095.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f7664cb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f768095.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 3068 f7664cb.exe 3068 f7664cb.exe 1860 f768095.exe -
Suspicious use of AdjustPrivilegeToken 45 IoCs
description pid Process Token: SeDebugPrivilege 3068 f7664cb.exe Token: SeDebugPrivilege 3068 f7664cb.exe Token: SeDebugPrivilege 3068 f7664cb.exe Token: SeDebugPrivilege 3068 f7664cb.exe Token: SeDebugPrivilege 3068 f7664cb.exe Token: SeDebugPrivilege 3068 f7664cb.exe Token: SeDebugPrivilege 3068 f7664cb.exe Token: SeDebugPrivilege 3068 f7664cb.exe Token: SeDebugPrivilege 3068 f7664cb.exe Token: SeDebugPrivilege 3068 f7664cb.exe Token: SeDebugPrivilege 3068 f7664cb.exe Token: SeDebugPrivilege 3068 f7664cb.exe Token: SeDebugPrivilege 3068 f7664cb.exe Token: SeDebugPrivilege 3068 f7664cb.exe Token: SeDebugPrivilege 3068 f7664cb.exe Token: SeDebugPrivilege 3068 f7664cb.exe Token: SeDebugPrivilege 3068 f7664cb.exe Token: SeDebugPrivilege 3068 f7664cb.exe Token: SeDebugPrivilege 3068 f7664cb.exe Token: SeDebugPrivilege 3068 f7664cb.exe Token: SeDebugPrivilege 3068 f7664cb.exe Token: SeDebugPrivilege 3068 f7664cb.exe Token: SeDebugPrivilege 3068 f7664cb.exe Token: SeDebugPrivilege 1860 f768095.exe Token: SeDebugPrivilege 1860 f768095.exe Token: SeDebugPrivilege 1860 f768095.exe Token: SeDebugPrivilege 1860 f768095.exe Token: SeDebugPrivilege 1860 f768095.exe Token: SeDebugPrivilege 1860 f768095.exe Token: SeDebugPrivilege 1860 f768095.exe Token: SeDebugPrivilege 1860 f768095.exe Token: SeDebugPrivilege 1860 f768095.exe Token: SeDebugPrivilege 1860 f768095.exe Token: SeDebugPrivilege 1860 f768095.exe Token: SeDebugPrivilege 1860 f768095.exe Token: SeDebugPrivilege 1860 f768095.exe Token: SeDebugPrivilege 1860 f768095.exe Token: SeDebugPrivilege 1860 f768095.exe Token: SeDebugPrivilege 1860 f768095.exe Token: SeDebugPrivilege 1860 f768095.exe Token: SeDebugPrivilege 1860 f768095.exe Token: SeDebugPrivilege 1860 f768095.exe Token: SeDebugPrivilege 1860 f768095.exe Token: SeDebugPrivilege 1860 f768095.exe Token: SeDebugPrivilege 1860 f768095.exe -
Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 2884 wrote to memory of 2888 2884 rundll32.exe 30 PID 2884 wrote to memory of 2888 2884 rundll32.exe 30 PID 2884 wrote to memory of 2888 2884 rundll32.exe 30 PID 2884 wrote to memory of 2888 2884 rundll32.exe 30 PID 2884 wrote to memory of 2888 2884 rundll32.exe 30 PID 2884 wrote to memory of 2888 2884 rundll32.exe 30 PID 2884 wrote to memory of 2888 2884 rundll32.exe 30 PID 2888 wrote to memory of 3068 2888 rundll32.exe 31 PID 2888 wrote to memory of 3068 2888 rundll32.exe 31 PID 2888 wrote to memory of 3068 2888 rundll32.exe 31 PID 2888 wrote to memory of 3068 2888 rundll32.exe 31 PID 3068 wrote to memory of 1116 3068 f7664cb.exe 19 PID 3068 wrote to memory of 1168 3068 f7664cb.exe 20 PID 3068 wrote to memory of 1212 3068 f7664cb.exe 21 PID 3068 wrote to memory of 848 3068 f7664cb.exe 25 PID 3068 wrote to memory of 2884 3068 f7664cb.exe 29 PID 3068 wrote to memory of 2888 3068 f7664cb.exe 30 PID 3068 wrote to memory of 2888 3068 f7664cb.exe 30 PID 2888 wrote to memory of 2892 2888 rundll32.exe 32 PID 2888 wrote to memory of 2892 2888 rundll32.exe 32 PID 2888 wrote to memory of 2892 2888 rundll32.exe 32 PID 2888 wrote to memory of 2892 2888 rundll32.exe 32 PID 2888 wrote to memory of 1860 2888 rundll32.exe 33 PID 2888 wrote to memory of 1860 2888 rundll32.exe 33 PID 2888 wrote to memory of 1860 2888 rundll32.exe 33 PID 2888 wrote to memory of 1860 2888 rundll32.exe 33 PID 3068 wrote to memory of 1116 3068 f7664cb.exe 19 PID 3068 wrote to memory of 1168 3068 f7664cb.exe 20 PID 3068 wrote to memory of 1212 3068 f7664cb.exe 21 PID 3068 wrote to memory of 848 3068 f7664cb.exe 25 PID 3068 wrote to memory of 2892 3068 f7664cb.exe 32 PID 3068 wrote to memory of 2892 3068 f7664cb.exe 32 PID 3068 wrote to memory of 1860 3068 f7664cb.exe 33 PID 3068 wrote to memory of 1860 3068 f7664cb.exe 33 PID 1860 wrote to memory of 1116 1860 f768095.exe 19 PID 1860 wrote to memory of 1168 1860 f768095.exe 20 PID 1860 wrote to memory of 1212 1860 f768095.exe 21 PID 1860 wrote to memory of 848 1860 f768095.exe 25 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f7664cb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f768095.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1116
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1168
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1212
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2ee0ab6fc50b00936e7cb2c7ae1abcf4aa152fc304b32e33010d98389c4814af.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2ee0ab6fc50b00936e7cb2c7ae1abcf4aa152fc304b32e33010d98389c4814af.dll,#13⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\f7664cb.exeC:\Users\Admin\AppData\Local\Temp\f7664cb.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3068
-
-
C:\Users\Admin\AppData\Local\Temp\f766642.exeC:\Users\Admin\AppData\Local\Temp\f766642.exe4⤵
- Executes dropped EXE
PID:2892
-
-
C:\Users\Admin\AppData\Local\Temp\f768095.exeC:\Users\Admin\AppData\Local\Temp\f768095.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1860
-
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:848
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
257B
MD540916a0d9cd1ea656e5d46b865cedff4
SHA1a217cbec89ee5fb845eecbb2a18ec3fefade6056
SHA2568055d3a07c98dddd2dab7c2175f043cb6cfd837eecd0d4bd770df4360bfd3d26
SHA5125be720cb5d8c21ccf20f7d87b9886d9e243b1707cfb09ceb28c5089c56bf9086d6fe0d381cecb4356b60398485f9bc0f0581e266686054bf9825975cd21f630a
-
Filesize
97KB
MD57f5c6c03acbec5931d31c3e3ab96bc86
SHA1eda55703abd3fe2d073183b20fa40f414a6a4eea
SHA2563d126f19cb14bd4f7e561b95e03516abea4cb74596a8d926f58346d56805478b
SHA5125d8d73684fcf7ac2f9b45b041a8c822fa9508d632c97812c84aab17adcb24f3d4e7cbdaf1e302d62a9fa5bf6031bd88479e21c226c94158b0d3f78bb45ead7c9