Analysis
-
max time kernel
120s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
28-01-2025 01:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
968aa938caae2c160f3dcb4ace9c423eb0fd4ef1c7973b1911d7cac53a45a616.dll
Resource
win7-20241010-en
windows7-x64
17 signatures
150 seconds
General
-
Target
968aa938caae2c160f3dcb4ace9c423eb0fd4ef1c7973b1911d7cac53a45a616.dll
-
Size
120KB
-
MD5
f5381b0f3419ef0c1e7cd9c84045a44b
-
SHA1
0ee3e51b728576a21c15890e9b585c5d1bbfe743
-
SHA256
968aa938caae2c160f3dcb4ace9c423eb0fd4ef1c7973b1911d7cac53a45a616
-
SHA512
bc6d46cea4751f9172d1faf3a3795146931eeee70b8939757bbd52d7c859891b47a0571d056aa12a0aea92bc7ef78b7c38f0de4e1bdaaeaa12d28328ec03e273
-
SSDEEP
3072:6Uv3LRjO4b2QMJKRMhEKhCV5H8LM9SKiA7:6qA4SdK4xhQ5H8LA
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f766d34.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f7688fe.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f7688fe.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f7688fe.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f766d34.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f766d34.exe -
Sality family
-
UAC bypass 3 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f766d34.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f7688fe.exe -
Windows security bypass 2 TTPs 12 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f766d34.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f766d34.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f766d34.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f7688fe.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f766d34.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f766d34.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f766d34.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f7688fe.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f7688fe.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f7688fe.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f7688fe.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f7688fe.exe -
Executes dropped EXE 3 IoCs
pid Process 2980 f766d34.exe 2736 f76706f.exe 2600 f7688fe.exe -
Loads dropped DLL 6 IoCs
pid Process 2848 rundll32.exe 2848 rundll32.exe 2848 rundll32.exe 2848 rundll32.exe 2848 rundll32.exe 2848 rundll32.exe -
Windows security modification 2 TTPs 14 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f7688fe.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f7688fe.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f766d34.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f7688fe.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f766d34.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f766d34.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f766d34.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f7688fe.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f7688fe.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f7688fe.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f766d34.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f766d34.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f766d34.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f7688fe.exe -
Checks whether UAC is enabled 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f7688fe.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f766d34.exe -
Enumerates connected drives 3 TTPs 15 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: f766d34.exe File opened (read-only) \??\S: f766d34.exe File opened (read-only) \??\E: f7688fe.exe File opened (read-only) \??\I: f766d34.exe File opened (read-only) \??\L: f766d34.exe File opened (read-only) \??\O: f766d34.exe File opened (read-only) \??\P: f766d34.exe File opened (read-only) \??\J: f766d34.exe File opened (read-only) \??\K: f766d34.exe File opened (read-only) \??\N: f766d34.exe File opened (read-only) \??\Q: f766d34.exe File opened (read-only) \??\E: f766d34.exe File opened (read-only) \??\H: f766d34.exe File opened (read-only) \??\M: f766d34.exe File opened (read-only) \??\R: f766d34.exe -
resource yara_rule behavioral1/memory/2980-13-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2980-15-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2980-19-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2980-20-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2980-14-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2980-22-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2980-21-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2980-18-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2980-17-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2980-16-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2980-57-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2980-58-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2980-59-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2980-60-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2980-61-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2980-64-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2980-65-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2980-78-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2980-81-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2980-84-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2980-85-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2980-86-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2980-152-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2600-169-0x00000000009C0000-0x0000000001A7A000-memory.dmp upx behavioral1/memory/2600-208-0x00000000009C0000-0x0000000001A7A000-memory.dmp upx -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\f766da1 f766d34.exe File opened for modification C:\Windows\SYSTEM.INI f766d34.exe File created C:\Windows\f76c0ef f7688fe.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f766d34.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f7688fe.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2980 f766d34.exe 2980 f766d34.exe 2600 f7688fe.exe -
Suspicious use of AdjustPrivilegeToken 45 IoCs
description pid Process Token: SeDebugPrivilege 2980 f766d34.exe Token: SeDebugPrivilege 2980 f766d34.exe Token: SeDebugPrivilege 2980 f766d34.exe Token: SeDebugPrivilege 2980 f766d34.exe Token: SeDebugPrivilege 2980 f766d34.exe Token: SeDebugPrivilege 2980 f766d34.exe Token: SeDebugPrivilege 2980 f766d34.exe Token: SeDebugPrivilege 2980 f766d34.exe Token: SeDebugPrivilege 2980 f766d34.exe Token: SeDebugPrivilege 2980 f766d34.exe Token: SeDebugPrivilege 2980 f766d34.exe Token: SeDebugPrivilege 2980 f766d34.exe Token: SeDebugPrivilege 2980 f766d34.exe Token: SeDebugPrivilege 2980 f766d34.exe Token: SeDebugPrivilege 2980 f766d34.exe Token: SeDebugPrivilege 2980 f766d34.exe Token: SeDebugPrivilege 2980 f766d34.exe Token: SeDebugPrivilege 2980 f766d34.exe Token: SeDebugPrivilege 2980 f766d34.exe Token: SeDebugPrivilege 2980 f766d34.exe Token: SeDebugPrivilege 2980 f766d34.exe Token: SeDebugPrivilege 2980 f766d34.exe Token: SeDebugPrivilege 2980 f766d34.exe Token: SeDebugPrivilege 2600 f7688fe.exe Token: SeDebugPrivilege 2600 f7688fe.exe Token: SeDebugPrivilege 2600 f7688fe.exe Token: SeDebugPrivilege 2600 f7688fe.exe Token: SeDebugPrivilege 2600 f7688fe.exe Token: SeDebugPrivilege 2600 f7688fe.exe Token: SeDebugPrivilege 2600 f7688fe.exe Token: SeDebugPrivilege 2600 f7688fe.exe Token: SeDebugPrivilege 2600 f7688fe.exe Token: SeDebugPrivilege 2600 f7688fe.exe Token: SeDebugPrivilege 2600 f7688fe.exe Token: SeDebugPrivilege 2600 f7688fe.exe Token: SeDebugPrivilege 2600 f7688fe.exe Token: SeDebugPrivilege 2600 f7688fe.exe Token: SeDebugPrivilege 2600 f7688fe.exe Token: SeDebugPrivilege 2600 f7688fe.exe Token: SeDebugPrivilege 2600 f7688fe.exe Token: SeDebugPrivilege 2600 f7688fe.exe Token: SeDebugPrivilege 2600 f7688fe.exe Token: SeDebugPrivilege 2600 f7688fe.exe Token: SeDebugPrivilege 2600 f7688fe.exe Token: SeDebugPrivilege 2600 f7688fe.exe -
Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 2340 wrote to memory of 2848 2340 rundll32.exe 30 PID 2340 wrote to memory of 2848 2340 rundll32.exe 30 PID 2340 wrote to memory of 2848 2340 rundll32.exe 30 PID 2340 wrote to memory of 2848 2340 rundll32.exe 30 PID 2340 wrote to memory of 2848 2340 rundll32.exe 30 PID 2340 wrote to memory of 2848 2340 rundll32.exe 30 PID 2340 wrote to memory of 2848 2340 rundll32.exe 30 PID 2848 wrote to memory of 2980 2848 rundll32.exe 31 PID 2848 wrote to memory of 2980 2848 rundll32.exe 31 PID 2848 wrote to memory of 2980 2848 rundll32.exe 31 PID 2848 wrote to memory of 2980 2848 rundll32.exe 31 PID 2980 wrote to memory of 1112 2980 f766d34.exe 19 PID 2980 wrote to memory of 1160 2980 f766d34.exe 20 PID 2980 wrote to memory of 1196 2980 f766d34.exe 21 PID 2980 wrote to memory of 276 2980 f766d34.exe 25 PID 2980 wrote to memory of 2340 2980 f766d34.exe 29 PID 2980 wrote to memory of 2848 2980 f766d34.exe 30 PID 2980 wrote to memory of 2848 2980 f766d34.exe 30 PID 2848 wrote to memory of 2736 2848 rundll32.exe 32 PID 2848 wrote to memory of 2736 2848 rundll32.exe 32 PID 2848 wrote to memory of 2736 2848 rundll32.exe 32 PID 2848 wrote to memory of 2736 2848 rundll32.exe 32 PID 2848 wrote to memory of 2600 2848 rundll32.exe 33 PID 2848 wrote to memory of 2600 2848 rundll32.exe 33 PID 2848 wrote to memory of 2600 2848 rundll32.exe 33 PID 2848 wrote to memory of 2600 2848 rundll32.exe 33 PID 2980 wrote to memory of 1112 2980 f766d34.exe 19 PID 2980 wrote to memory of 1160 2980 f766d34.exe 20 PID 2980 wrote to memory of 1196 2980 f766d34.exe 21 PID 2980 wrote to memory of 276 2980 f766d34.exe 25 PID 2980 wrote to memory of 2736 2980 f766d34.exe 32 PID 2980 wrote to memory of 2736 2980 f766d34.exe 32 PID 2980 wrote to memory of 2600 2980 f766d34.exe 33 PID 2980 wrote to memory of 2600 2980 f766d34.exe 33 PID 2600 wrote to memory of 1112 2600 f7688fe.exe 19 PID 2600 wrote to memory of 1160 2600 f7688fe.exe 20 PID 2600 wrote to memory of 1196 2600 f7688fe.exe 21 PID 2600 wrote to memory of 276 2600 f7688fe.exe 25 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f766d34.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f7688fe.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1112
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1160
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1196
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\968aa938caae2c160f3dcb4ace9c423eb0fd4ef1c7973b1911d7cac53a45a616.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\968aa938caae2c160f3dcb4ace9c423eb0fd4ef1c7973b1911d7cac53a45a616.dll,#13⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\f766d34.exeC:\Users\Admin\AppData\Local\Temp\f766d34.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2980
-
-
C:\Users\Admin\AppData\Local\Temp\f76706f.exeC:\Users\Admin\AppData\Local\Temp\f76706f.exe4⤵
- Executes dropped EXE
PID:2736
-
-
C:\Users\Admin\AppData\Local\Temp\f7688fe.exeC:\Users\Admin\AppData\Local\Temp\f7688fe.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2600
-
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:276
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
257B
MD544bf41582bc5e0438ea2ca013b7aac5f
SHA11e78c6af75099bfd8326b79b51b3c05d41032ce5
SHA2569151b3e30df644f5ccde5fff2135d4fe9c3d322684f4e717e603bffe71284e6f
SHA5126ad737a2f698ab9cd1670d86945938b02fa41341647a4880c983c3b7cad16598900c7489833a4da693755b74a5eef41ae474a3d9f054a238e2e4cd4dc3845894
-
Filesize
97KB
MD5e9a5c6cbbb59807c56321cb6b6a3115b
SHA1397e6a0e7d137bd59f5a94808d2a2830f2fd9737
SHA256f12f37f3b61c2cd784237c6d95e2f225f5357efd2f45d9746127ecda72f086f5
SHA51273b611c10695038724519b6c6bb4298e899e9469103d01911af0d79e64815b3350042c7eb2d157fc803ddaac1716d760205f115e6a44b339e769ea755b30245a