Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
30-06-2024 18:22
Static task
static1
Behavioral task
behavioral1
Sample
491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe
Resource
win7-20240508-en
General
-
Target
491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe
-
Size
689KB
-
MD5
52a0860155906d97838ac445fb91d303
-
SHA1
b6a2317d54c964e270fb63508b12e0c390f9b06a
-
SHA256
491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7
-
SHA512
0b2c3da7b07e7ab5ee926aca352fe6fc76007aa0b006efaa23b55db4cae2b362c091839d181a5004f62c1601b966809dd511c638b7448defeba9de1aad030a09
-
SSDEEP
12288:5tpyxhomlpOKPjAavqoBWOmNsaBoPvnTEHeK5d:VyxhoUTv5Wtsa0vA+K5
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 3 IoCs
Processes:
491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe -
Processes:
491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe -
Processes:
491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe -
Processes:
resource yara_rule behavioral1/memory/2884-5-0x0000000001EC0000-0x0000000002F7A000-memory.dmp upx behavioral1/memory/2884-9-0x0000000001EC0000-0x0000000002F7A000-memory.dmp upx behavioral1/memory/2884-13-0x0000000001EC0000-0x0000000002F7A000-memory.dmp upx behavioral1/memory/2884-12-0x0000000001EC0000-0x0000000002F7A000-memory.dmp upx behavioral1/memory/2884-11-0x0000000001EC0000-0x0000000002F7A000-memory.dmp upx behavioral1/memory/2884-1-0x0000000001EC0000-0x0000000002F7A000-memory.dmp upx behavioral1/memory/2884-10-0x0000000001EC0000-0x0000000002F7A000-memory.dmp upx behavioral1/memory/2884-6-0x0000000001EC0000-0x0000000002F7A000-memory.dmp upx behavioral1/memory/2884-8-0x0000000001EC0000-0x0000000002F7A000-memory.dmp upx behavioral1/memory/2884-7-0x0000000001EC0000-0x0000000002F7A000-memory.dmp upx behavioral1/memory/2884-37-0x0000000001EC0000-0x0000000002F7A000-memory.dmp upx behavioral1/memory/2884-36-0x0000000001EC0000-0x0000000002F7A000-memory.dmp upx behavioral1/memory/2884-38-0x0000000001EC0000-0x0000000002F7A000-memory.dmp upx behavioral1/memory/2884-40-0x0000000001EC0000-0x0000000002F7A000-memory.dmp upx behavioral1/memory/2884-39-0x0000000001EC0000-0x0000000002F7A000-memory.dmp upx behavioral1/memory/2884-42-0x0000000001EC0000-0x0000000002F7A000-memory.dmp upx behavioral1/memory/2884-43-0x0000000001EC0000-0x0000000002F7A000-memory.dmp upx behavioral1/memory/2884-63-0x0000000001EC0000-0x0000000002F7A000-memory.dmp upx -
Processes:
491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe -
Processes:
491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe -
Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exedescription ioc process File opened (read-only) \??\E: 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe File opened (read-only) \??\G: 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe -
Drops file in Windows directory 2 IoCs
Processes:
491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exedescription ioc process File created C:\Windows\f7610d2 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe File opened for modification C:\Windows\SYSTEM.INI 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe -
Modifies registry class 3 IoCs
Processes:
491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exedescription ioc process Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1A893393-71A8-4a50-95A1-2B89DE87B24C} 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1A893393-71A8-4a50-95A1-2B89DE87B24C} 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1A893393-71A8-4a50-95A1-2B89DE87B24C}\ = "0" 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exepid process 2884 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe 2884 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe -
Suspicious use of AdjustPrivilegeToken 20 IoCs
Processes:
491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exedescription pid process Token: SeDebugPrivilege 2884 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe Token: SeDebugPrivilege 2884 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe Token: SeDebugPrivilege 2884 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe Token: SeDebugPrivilege 2884 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe Token: SeDebugPrivilege 2884 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe Token: SeDebugPrivilege 2884 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe Token: SeDebugPrivilege 2884 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe Token: SeDebugPrivilege 2884 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe Token: SeDebugPrivilege 2884 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe Token: SeDebugPrivilege 2884 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe Token: SeDebugPrivilege 2884 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe Token: SeDebugPrivilege 2884 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe Token: SeDebugPrivilege 2884 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe Token: SeDebugPrivilege 2884 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe Token: SeDebugPrivilege 2884 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe Token: SeDebugPrivilege 2884 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe Token: SeDebugPrivilege 2884 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe Token: SeDebugPrivilege 2884 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe Token: SeDebugPrivilege 2884 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe Token: SeDebugPrivilege 2884 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exedescription pid process target process PID 2884 wrote to memory of 1100 2884 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe taskhost.exe PID 2884 wrote to memory of 1164 2884 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe Dwm.exe PID 2884 wrote to memory of 1200 2884 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe Explorer.EXE PID 2884 wrote to memory of 664 2884 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe DllHost.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe"C:\Users\Admin\AppData\Local\Temp\491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Create or Modify System Process
1Windows Service
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Modify Registry
5Impair Defenses
4Disable or Modify Tools
3Disable or Modify System Firewall
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1100-19-0x00000000001A0000-0x00000000001A2000-memory.dmpFilesize
8KB
-
memory/2884-1-0x0000000001EC0000-0x0000000002F7A000-memory.dmpFilesize
16.7MB
-
memory/2884-62-0x0000000000400000-0x00000000004B1000-memory.dmpFilesize
708KB
-
memory/2884-11-0x0000000001EC0000-0x0000000002F7A000-memory.dmpFilesize
16.7MB
-
memory/2884-33-0x0000000000540000-0x0000000000541000-memory.dmpFilesize
4KB
-
memory/2884-30-0x0000000000540000-0x0000000000541000-memory.dmpFilesize
4KB
-
memory/2884-34-0x00000000003F0000-0x00000000003F2000-memory.dmpFilesize
8KB
-
memory/2884-29-0x00000000003F0000-0x00000000003F2000-memory.dmpFilesize
8KB
-
memory/2884-9-0x0000000001EC0000-0x0000000002F7A000-memory.dmpFilesize
16.7MB
-
memory/2884-35-0x00000000003F0000-0x00000000003F2000-memory.dmpFilesize
8KB
-
memory/2884-3-0x00000000777F0000-0x0000000077800000-memory.dmpFilesize
64KB
-
memory/2884-13-0x0000000001EC0000-0x0000000002F7A000-memory.dmpFilesize
16.7MB
-
memory/2884-12-0x0000000001EC0000-0x0000000002F7A000-memory.dmpFilesize
16.7MB
-
memory/2884-5-0x0000000001EC0000-0x0000000002F7A000-memory.dmpFilesize
16.7MB
-
memory/2884-2-0x00000000777F0000-0x0000000077800000-memory.dmpFilesize
64KB
-
memory/2884-40-0x0000000001EC0000-0x0000000002F7A000-memory.dmpFilesize
16.7MB
-
memory/2884-6-0x0000000001EC0000-0x0000000002F7A000-memory.dmpFilesize
16.7MB
-
memory/2884-8-0x0000000001EC0000-0x0000000002F7A000-memory.dmpFilesize
16.7MB
-
memory/2884-7-0x0000000001EC0000-0x0000000002F7A000-memory.dmpFilesize
16.7MB
-
memory/2884-37-0x0000000001EC0000-0x0000000002F7A000-memory.dmpFilesize
16.7MB
-
memory/2884-36-0x0000000001EC0000-0x0000000002F7A000-memory.dmpFilesize
16.7MB
-
memory/2884-38-0x0000000001EC0000-0x0000000002F7A000-memory.dmpFilesize
16.7MB
-
memory/2884-10-0x0000000001EC0000-0x0000000002F7A000-memory.dmpFilesize
16.7MB
-
memory/2884-39-0x0000000001EC0000-0x0000000002F7A000-memory.dmpFilesize
16.7MB
-
memory/2884-42-0x0000000001EC0000-0x0000000002F7A000-memory.dmpFilesize
16.7MB
-
memory/2884-43-0x0000000001EC0000-0x0000000002F7A000-memory.dmpFilesize
16.7MB
-
memory/2884-63-0x0000000001EC0000-0x0000000002F7A000-memory.dmpFilesize
16.7MB
-
memory/2884-0-0x0000000000400000-0x00000000004B1000-memory.dmpFilesize
708KB