Analysis
-
max time kernel
27s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
01-02-2025 13:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6717725dc4a26b5a822c25a52dcc238dcf8ff2ea84139a365116572b84fb6a4fN.dll
Resource
win7-20240903-en
windows7-x64
17 signatures
120 seconds
General
-
Target
6717725dc4a26b5a822c25a52dcc238dcf8ff2ea84139a365116572b84fb6a4fN.dll
-
Size
120KB
-
MD5
a54829696ae4927232d966f31ce47860
-
SHA1
b152277b24be0e8fba6ac44546071e484cdc0092
-
SHA256
6717725dc4a26b5a822c25a52dcc238dcf8ff2ea84139a365116572b84fb6a4f
-
SHA512
7438aac9fbd158d6421026ecf626d5047578ea8329b0fc4f45bc7ef183be693084c21df633445d3d1d6998a9c3a1a9a4bb28fefdfab4c0b79be083191d11e907
-
SSDEEP
1536:p3svEzuYfaX3/BAd4rXdHd9NOEbM8CB/p4X5DkHJhrAj5HGsXxd1lPxxR4X5jKbH:46inhXlzNOJpyX54HTG5ms1lPxx6It
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f76a4c7.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f76a4c7.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f76a4c7.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f76891d.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f76891d.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f76891d.exe -
Sality family
-
UAC bypass 3 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76891d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76a4c7.exe -
Windows security bypass 2 TTPs 12 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76a4c7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76a4c7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76a4c7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76a4c7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76891d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76891d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76891d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76891d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76891d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76a4c7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76a4c7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76891d.exe -
Executes dropped EXE 3 IoCs
pid Process 1288 f76891d.exe 2692 f768ab3.exe 2516 f76a4c7.exe -
Loads dropped DLL 6 IoCs
pid Process 2080 rundll32.exe 2080 rundll32.exe 2080 rundll32.exe 2080 rundll32.exe 2080 rundll32.exe 2080 rundll32.exe -
Windows security modification 2 TTPs 14 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f76891d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76a4c7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76891d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76891d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76891d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76891d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76a4c7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76a4c7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76a4c7.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f76a4c7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76891d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76891d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76a4c7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76a4c7.exe -
Checks whether UAC is enabled 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76891d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76a4c7.exe -
Enumerates connected drives 3 TTPs 17 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\N: f76891d.exe File opened (read-only) \??\R: f76891d.exe File opened (read-only) \??\E: f76a4c7.exe File opened (read-only) \??\G: f76891d.exe File opened (read-only) \??\J: f76891d.exe File opened (read-only) \??\P: f76891d.exe File opened (read-only) \??\T: f76891d.exe File opened (read-only) \??\H: f76891d.exe File opened (read-only) \??\K: f76891d.exe File opened (read-only) \??\L: f76891d.exe File opened (read-only) \??\M: f76891d.exe File opened (read-only) \??\O: f76891d.exe File opened (read-only) \??\G: f76a4c7.exe File opened (read-only) \??\E: f76891d.exe File opened (read-only) \??\I: f76891d.exe File opened (read-only) \??\Q: f76891d.exe File opened (read-only) \??\S: f76891d.exe -
resource yara_rule behavioral1/memory/1288-16-0x00000000005D0000-0x000000000168A000-memory.dmp upx behavioral1/memory/1288-19-0x00000000005D0000-0x000000000168A000-memory.dmp upx behavioral1/memory/1288-21-0x00000000005D0000-0x000000000168A000-memory.dmp upx behavioral1/memory/1288-18-0x00000000005D0000-0x000000000168A000-memory.dmp upx behavioral1/memory/1288-17-0x00000000005D0000-0x000000000168A000-memory.dmp upx behavioral1/memory/1288-15-0x00000000005D0000-0x000000000168A000-memory.dmp upx behavioral1/memory/1288-23-0x00000000005D0000-0x000000000168A000-memory.dmp upx behavioral1/memory/1288-14-0x00000000005D0000-0x000000000168A000-memory.dmp upx behavioral1/memory/1288-20-0x00000000005D0000-0x000000000168A000-memory.dmp upx behavioral1/memory/1288-22-0x00000000005D0000-0x000000000168A000-memory.dmp upx behavioral1/memory/1288-64-0x00000000005D0000-0x000000000168A000-memory.dmp upx behavioral1/memory/1288-63-0x00000000005D0000-0x000000000168A000-memory.dmp upx behavioral1/memory/1288-65-0x00000000005D0000-0x000000000168A000-memory.dmp upx behavioral1/memory/1288-67-0x00000000005D0000-0x000000000168A000-memory.dmp upx behavioral1/memory/1288-66-0x00000000005D0000-0x000000000168A000-memory.dmp upx behavioral1/memory/1288-69-0x00000000005D0000-0x000000000168A000-memory.dmp upx behavioral1/memory/1288-70-0x00000000005D0000-0x000000000168A000-memory.dmp upx behavioral1/memory/1288-85-0x00000000005D0000-0x000000000168A000-memory.dmp upx behavioral1/memory/1288-88-0x00000000005D0000-0x000000000168A000-memory.dmp upx behavioral1/memory/1288-90-0x00000000005D0000-0x000000000168A000-memory.dmp upx behavioral1/memory/1288-159-0x00000000005D0000-0x000000000168A000-memory.dmp upx behavioral1/memory/2516-174-0x0000000000930000-0x00000000019EA000-memory.dmp upx behavioral1/memory/2516-215-0x0000000000930000-0x00000000019EA000-memory.dmp upx -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\f76896b f76891d.exe File opened for modification C:\Windows\SYSTEM.INI f76891d.exe File created C:\Windows\f76d94f f76a4c7.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f76891d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f76a4c7.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 1288 f76891d.exe 1288 f76891d.exe 2516 f76a4c7.exe -
Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeDebugPrivilege 1288 f76891d.exe Token: SeDebugPrivilege 1288 f76891d.exe Token: SeDebugPrivilege 1288 f76891d.exe Token: SeDebugPrivilege 1288 f76891d.exe Token: SeDebugPrivilege 1288 f76891d.exe Token: SeDebugPrivilege 1288 f76891d.exe Token: SeDebugPrivilege 1288 f76891d.exe Token: SeDebugPrivilege 1288 f76891d.exe Token: SeDebugPrivilege 1288 f76891d.exe Token: SeDebugPrivilege 1288 f76891d.exe Token: SeDebugPrivilege 1288 f76891d.exe Token: SeDebugPrivilege 1288 f76891d.exe Token: SeDebugPrivilege 1288 f76891d.exe Token: SeDebugPrivilege 1288 f76891d.exe Token: SeDebugPrivilege 1288 f76891d.exe Token: SeDebugPrivilege 1288 f76891d.exe Token: SeDebugPrivilege 1288 f76891d.exe Token: SeDebugPrivilege 1288 f76891d.exe Token: SeDebugPrivilege 1288 f76891d.exe Token: SeDebugPrivilege 1288 f76891d.exe Token: SeDebugPrivilege 1288 f76891d.exe Token: SeDebugPrivilege 2516 f76a4c7.exe Token: SeDebugPrivilege 2516 f76a4c7.exe Token: SeDebugPrivilege 2516 f76a4c7.exe Token: SeDebugPrivilege 2516 f76a4c7.exe Token: SeDebugPrivilege 2516 f76a4c7.exe Token: SeDebugPrivilege 2516 f76a4c7.exe Token: SeDebugPrivilege 2516 f76a4c7.exe Token: SeDebugPrivilege 2516 f76a4c7.exe Token: SeDebugPrivilege 2516 f76a4c7.exe Token: SeDebugPrivilege 2516 f76a4c7.exe Token: SeDebugPrivilege 2516 f76a4c7.exe Token: SeDebugPrivilege 2516 f76a4c7.exe Token: SeDebugPrivilege 2516 f76a4c7.exe Token: SeDebugPrivilege 2516 f76a4c7.exe Token: SeDebugPrivilege 2516 f76a4c7.exe Token: SeDebugPrivilege 2516 f76a4c7.exe Token: SeDebugPrivilege 2516 f76a4c7.exe Token: SeDebugPrivilege 2516 f76a4c7.exe Token: SeDebugPrivilege 2516 f76a4c7.exe Token: SeDebugPrivilege 2516 f76a4c7.exe Token: SeDebugPrivilege 2516 f76a4c7.exe Token: SeDebugPrivilege 2516 f76a4c7.exe -
Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 2828 wrote to memory of 2080 2828 rundll32.exe 28 PID 2828 wrote to memory of 2080 2828 rundll32.exe 28 PID 2828 wrote to memory of 2080 2828 rundll32.exe 28 PID 2828 wrote to memory of 2080 2828 rundll32.exe 28 PID 2828 wrote to memory of 2080 2828 rundll32.exe 28 PID 2828 wrote to memory of 2080 2828 rundll32.exe 28 PID 2828 wrote to memory of 2080 2828 rundll32.exe 28 PID 2080 wrote to memory of 1288 2080 rundll32.exe 29 PID 2080 wrote to memory of 1288 2080 rundll32.exe 29 PID 2080 wrote to memory of 1288 2080 rundll32.exe 29 PID 2080 wrote to memory of 1288 2080 rundll32.exe 29 PID 1288 wrote to memory of 1108 1288 f76891d.exe 19 PID 1288 wrote to memory of 1160 1288 f76891d.exe 20 PID 1288 wrote to memory of 1204 1288 f76891d.exe 21 PID 1288 wrote to memory of 1664 1288 f76891d.exe 23 PID 1288 wrote to memory of 2828 1288 f76891d.exe 27 PID 1288 wrote to memory of 2080 1288 f76891d.exe 28 PID 1288 wrote to memory of 2080 1288 f76891d.exe 28 PID 2080 wrote to memory of 2692 2080 rundll32.exe 30 PID 2080 wrote to memory of 2692 2080 rundll32.exe 30 PID 2080 wrote to memory of 2692 2080 rundll32.exe 30 PID 2080 wrote to memory of 2692 2080 rundll32.exe 30 PID 2080 wrote to memory of 2516 2080 rundll32.exe 31 PID 2080 wrote to memory of 2516 2080 rundll32.exe 31 PID 2080 wrote to memory of 2516 2080 rundll32.exe 31 PID 2080 wrote to memory of 2516 2080 rundll32.exe 31 PID 1288 wrote to memory of 1108 1288 f76891d.exe 19 PID 1288 wrote to memory of 1160 1288 f76891d.exe 20 PID 1288 wrote to memory of 1204 1288 f76891d.exe 21 PID 1288 wrote to memory of 1664 1288 f76891d.exe 23 PID 1288 wrote to memory of 2692 1288 f76891d.exe 30 PID 1288 wrote to memory of 2692 1288 f76891d.exe 30 PID 1288 wrote to memory of 2516 1288 f76891d.exe 31 PID 1288 wrote to memory of 2516 1288 f76891d.exe 31 PID 2516 wrote to memory of 1108 2516 f76a4c7.exe 19 PID 2516 wrote to memory of 1160 2516 f76a4c7.exe 20 PID 2516 wrote to memory of 1204 2516 f76a4c7.exe 21 PID 2516 wrote to memory of 1664 2516 f76a4c7.exe 23 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76891d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76a4c7.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1108
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1160
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1204
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6717725dc4a26b5a822c25a52dcc238dcf8ff2ea84139a365116572b84fb6a4fN.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6717725dc4a26b5a822c25a52dcc238dcf8ff2ea84139a365116572b84fb6a4fN.dll,#13⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\f76891d.exeC:\Users\Admin\AppData\Local\Temp\f76891d.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1288
-
-
C:\Users\Admin\AppData\Local\Temp\f768ab3.exeC:\Users\Admin\AppData\Local\Temp\f768ab3.exe4⤵
- Executes dropped EXE
PID:2692
-
-
C:\Users\Admin\AppData\Local\Temp\f76a4c7.exeC:\Users\Admin\AppData\Local\Temp\f76a4c7.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2516
-
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1664
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
257B
MD5a281563dcaad8f30a3e9e8553148847d
SHA1b6648bdb985fe78c24a633d379bb0eacd44db56c
SHA2561fbbc829c15b4b636982471e6d00bcbe0cc1106c449f77172fad50f616782390
SHA51242ca255fb433174381813340700dad6672f100eeda188dd3521e8887d4420acefa67edcd5afdceef63b27fdfc1ef4217403551b14b0fe4c1066e8dafc0c54d94
-
Filesize
97KB
MD5d1acac98f2919508273d47b347b2bf7c
SHA191d525c2a80f12b97e71cf92453e2feec15d1d45
SHA256796ebf1194cdb9f6a683cf9562ebe67b410d598f540b225a8770568bfe2d65d3
SHA512979728128504f1671949dd477de4382d153e312fa1b0deccd33fb24074cf935324e19e543596aa3241332194048460d8dec3612da04d551a2994d4a00e419045