Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
17/04/2024, 19:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
270d676a6889b21ad00f1c9e6dc3868ef2213f8e2ef4ce50305f13f48629dc0a.dll
Resource
win7-20240221-en
windows7-x64
17 signatures
150 seconds
General
-
Target
270d676a6889b21ad00f1c9e6dc3868ef2213f8e2ef4ce50305f13f48629dc0a.dll
-
Size
120KB
-
MD5
c06b60d5553df1ff4e3a890c76d056bd
-
SHA1
f19f3d3689e7d341ae98605c2d06b727a554dde8
-
SHA256
270d676a6889b21ad00f1c9e6dc3868ef2213f8e2ef4ce50305f13f48629dc0a
-
SHA512
0fbe4a8b30401933435c98835c505646148be113ff3d144fe7b91a15657d226fa486c72c5a49803c406cd6762b2b7b4e4fc94a883f3ee5736be1073f7d745dba
-
SSDEEP
1536:ly03CAKhCcYLBarlNfZjVoHqwDrk7mQYBUkgNU+Egco265:ll9JornfrAgelBgcHs
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 2 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f7621f2.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f7621f2.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f7621f2.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f7621f2.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f7621f2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f7621f2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f7621f2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f7621f2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f7621f2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f7621f2.exe -
Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 29 IoCs
resource yara_rule behavioral1/memory/2864-12-0x00000000005B0000-0x000000000166A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2864-14-0x00000000005B0000-0x000000000166A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2864-15-0x00000000005B0000-0x000000000166A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2864-18-0x00000000005B0000-0x000000000166A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2864-21-0x00000000005B0000-0x000000000166A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2864-24-0x00000000005B0000-0x000000000166A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2864-27-0x00000000005B0000-0x000000000166A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2864-49-0x00000000005B0000-0x000000000166A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2864-37-0x00000000005B0000-0x000000000166A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2864-31-0x00000000005B0000-0x000000000166A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2864-59-0x00000000005B0000-0x000000000166A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2864-60-0x00000000005B0000-0x000000000166A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2864-61-0x00000000005B0000-0x000000000166A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2864-62-0x00000000005B0000-0x000000000166A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2864-63-0x00000000005B0000-0x000000000166A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2864-78-0x00000000005B0000-0x000000000166A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2864-79-0x00000000005B0000-0x000000000166A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2864-80-0x00000000005B0000-0x000000000166A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2864-82-0x00000000005B0000-0x000000000166A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2864-84-0x00000000005B0000-0x000000000166A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2864-86-0x00000000005B0000-0x000000000166A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2864-88-0x00000000005B0000-0x000000000166A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2864-90-0x00000000005B0000-0x000000000166A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2864-93-0x00000000005B0000-0x000000000166A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2864-94-0x00000000005B0000-0x000000000166A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2864-97-0x00000000005B0000-0x000000000166A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2864-98-0x00000000005B0000-0x000000000166A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2864-100-0x00000000005B0000-0x000000000166A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2864-109-0x00000000005B0000-0x000000000166A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine -
UPX dump on OEP (original entry point) 32 IoCs
resource yara_rule behavioral1/memory/2864-11-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral1/memory/2864-12-0x00000000005B0000-0x000000000166A000-memory.dmp UPX behavioral1/memory/2864-14-0x00000000005B0000-0x000000000166A000-memory.dmp UPX behavioral1/memory/2864-15-0x00000000005B0000-0x000000000166A000-memory.dmp UPX behavioral1/memory/2864-18-0x00000000005B0000-0x000000000166A000-memory.dmp UPX behavioral1/memory/2864-21-0x00000000005B0000-0x000000000166A000-memory.dmp UPX behavioral1/memory/2864-24-0x00000000005B0000-0x000000000166A000-memory.dmp UPX behavioral1/memory/2864-27-0x00000000005B0000-0x000000000166A000-memory.dmp UPX behavioral1/memory/2404-51-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral1/memory/2864-49-0x00000000005B0000-0x000000000166A000-memory.dmp UPX behavioral1/memory/2864-37-0x00000000005B0000-0x000000000166A000-memory.dmp UPX behavioral1/memory/2864-31-0x00000000005B0000-0x000000000166A000-memory.dmp UPX behavioral1/memory/2864-59-0x00000000005B0000-0x000000000166A000-memory.dmp UPX behavioral1/memory/2864-60-0x00000000005B0000-0x000000000166A000-memory.dmp UPX behavioral1/memory/2864-61-0x00000000005B0000-0x000000000166A000-memory.dmp UPX behavioral1/memory/2864-62-0x00000000005B0000-0x000000000166A000-memory.dmp UPX behavioral1/memory/2864-63-0x00000000005B0000-0x000000000166A000-memory.dmp UPX behavioral1/memory/2468-76-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral1/memory/2864-78-0x00000000005B0000-0x000000000166A000-memory.dmp UPX behavioral1/memory/2864-79-0x00000000005B0000-0x000000000166A000-memory.dmp UPX behavioral1/memory/2864-80-0x00000000005B0000-0x000000000166A000-memory.dmp UPX behavioral1/memory/2864-82-0x00000000005B0000-0x000000000166A000-memory.dmp UPX behavioral1/memory/2864-84-0x00000000005B0000-0x000000000166A000-memory.dmp UPX behavioral1/memory/2864-86-0x00000000005B0000-0x000000000166A000-memory.dmp UPX behavioral1/memory/2864-88-0x00000000005B0000-0x000000000166A000-memory.dmp UPX behavioral1/memory/2864-90-0x00000000005B0000-0x000000000166A000-memory.dmp UPX behavioral1/memory/2864-93-0x00000000005B0000-0x000000000166A000-memory.dmp UPX behavioral1/memory/2864-94-0x00000000005B0000-0x000000000166A000-memory.dmp UPX behavioral1/memory/2864-97-0x00000000005B0000-0x000000000166A000-memory.dmp UPX behavioral1/memory/2864-98-0x00000000005B0000-0x000000000166A000-memory.dmp UPX behavioral1/memory/2864-100-0x00000000005B0000-0x000000000166A000-memory.dmp UPX behavioral1/memory/2864-109-0x00000000005B0000-0x000000000166A000-memory.dmp UPX -
Executes dropped EXE 3 IoCs
pid Process 2864 f7621f2.exe 2404 f7627bc.exe 2468 f763d9c.exe -
Loads dropped DLL 6 IoCs
pid Process 2208 rundll32.exe 2208 rundll32.exe 2208 rundll32.exe 2208 rundll32.exe 2208 rundll32.exe 2208 rundll32.exe -
resource yara_rule behavioral1/memory/2864-12-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2864-14-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2864-15-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2864-18-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2864-21-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2864-24-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2864-27-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2864-49-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2864-37-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2864-31-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2864-59-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2864-60-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2864-61-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2864-62-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2864-63-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2864-78-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2864-79-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2864-80-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2864-82-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2864-84-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2864-86-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2864-88-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2864-90-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2864-93-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2864-94-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2864-97-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2864-98-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2864-100-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2864-109-0x00000000005B0000-0x000000000166A000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f7621f2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f7621f2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f7621f2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f7621f2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f7621f2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f7621f2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f7621f2.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f7621f2.exe -
Enumerates connected drives 3 TTPs 11 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\N: f7621f2.exe File opened (read-only) \??\O: f7621f2.exe File opened (read-only) \??\E: f7621f2.exe File opened (read-only) \??\H: f7621f2.exe File opened (read-only) \??\I: f7621f2.exe File opened (read-only) \??\K: f7621f2.exe File opened (read-only) \??\L: f7621f2.exe File opened (read-only) \??\M: f7621f2.exe File opened (read-only) \??\P: f7621f2.exe File opened (read-only) \??\G: f7621f2.exe File opened (read-only) \??\J: f7621f2.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\f76229e f7621f2.exe File opened for modification C:\Windows\SYSTEM.INI f7621f2.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2864 f7621f2.exe -
Suspicious use of AdjustPrivilegeToken 20 IoCs
description pid Process Token: SeDebugPrivilege 2864 f7621f2.exe Token: SeDebugPrivilege 2864 f7621f2.exe Token: SeDebugPrivilege 2864 f7621f2.exe Token: SeDebugPrivilege 2864 f7621f2.exe Token: SeDebugPrivilege 2864 f7621f2.exe Token: SeDebugPrivilege 2864 f7621f2.exe Token: SeDebugPrivilege 2864 f7621f2.exe Token: SeDebugPrivilege 2864 f7621f2.exe Token: SeDebugPrivilege 2864 f7621f2.exe Token: SeDebugPrivilege 2864 f7621f2.exe Token: SeDebugPrivilege 2864 f7621f2.exe Token: SeDebugPrivilege 2864 f7621f2.exe Token: SeDebugPrivilege 2864 f7621f2.exe Token: SeDebugPrivilege 2864 f7621f2.exe Token: SeDebugPrivilege 2864 f7621f2.exe Token: SeDebugPrivilege 2864 f7621f2.exe Token: SeDebugPrivilege 2864 f7621f2.exe Token: SeDebugPrivilege 2864 f7621f2.exe Token: SeDebugPrivilege 2864 f7621f2.exe Token: SeDebugPrivilege 2864 f7621f2.exe -
Suspicious use of WriteProcessMemory 26 IoCs
description pid Process procid_target PID 2316 wrote to memory of 2208 2316 rundll32.exe 28 PID 2316 wrote to memory of 2208 2316 rundll32.exe 28 PID 2316 wrote to memory of 2208 2316 rundll32.exe 28 PID 2316 wrote to memory of 2208 2316 rundll32.exe 28 PID 2316 wrote to memory of 2208 2316 rundll32.exe 28 PID 2316 wrote to memory of 2208 2316 rundll32.exe 28 PID 2316 wrote to memory of 2208 2316 rundll32.exe 28 PID 2208 wrote to memory of 2864 2208 rundll32.exe 29 PID 2208 wrote to memory of 2864 2208 rundll32.exe 29 PID 2208 wrote to memory of 2864 2208 rundll32.exe 29 PID 2208 wrote to memory of 2864 2208 rundll32.exe 29 PID 2864 wrote to memory of 1108 2864 f7621f2.exe 19 PID 2864 wrote to memory of 1160 2864 f7621f2.exe 20 PID 2864 wrote to memory of 1256 2864 f7621f2.exe 21 PID 2864 wrote to memory of 1600 2864 f7621f2.exe 23 PID 2864 wrote to memory of 2316 2864 f7621f2.exe 27 PID 2864 wrote to memory of 2208 2864 f7621f2.exe 28 PID 2864 wrote to memory of 2208 2864 f7621f2.exe 28 PID 2208 wrote to memory of 2404 2208 rundll32.exe 30 PID 2208 wrote to memory of 2404 2208 rundll32.exe 30 PID 2208 wrote to memory of 2404 2208 rundll32.exe 30 PID 2208 wrote to memory of 2404 2208 rundll32.exe 30 PID 2208 wrote to memory of 2468 2208 rundll32.exe 31 PID 2208 wrote to memory of 2468 2208 rundll32.exe 31 PID 2208 wrote to memory of 2468 2208 rundll32.exe 31 PID 2208 wrote to memory of 2468 2208 rundll32.exe 31 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f7621f2.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1108
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1160
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1256
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\270d676a6889b21ad00f1c9e6dc3868ef2213f8e2ef4ce50305f13f48629dc0a.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\270d676a6889b21ad00f1c9e6dc3868ef2213f8e2ef4ce50305f13f48629dc0a.dll,#13⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\f7621f2.exeC:\Users\Admin\AppData\Local\Temp\f7621f2.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2864
-
-
C:\Users\Admin\AppData\Local\Temp\f7627bc.exeC:\Users\Admin\AppData\Local\Temp\f7627bc.exe4⤵
- Executes dropped EXE
PID:2404
-
-
C:\Users\Admin\AppData\Local\Temp\f763d9c.exeC:\Users\Admin\AppData\Local\Temp\f763d9c.exe4⤵
- Executes dropped EXE
PID:2468
-
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1600
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD5cfb063f3e093f0f36a41c7237f7039b6
SHA1bd45cc5f60754afe7f1e883687f86cd6bd129999
SHA256fb6cbbf9a70fb10cf8667c98f3467a540cd20348a9153701d63b7a8d350cd258
SHA512437656893ed0c9939089b8cb2a80ca95834d90bf76331f2933381239ce99741bb8caf350df978ca9d4b3ff3849b558b57b41d1bcb876980ffa8ef78bd559fb81