Analysis
-
max time kernel
65s -
max time network
51s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
01-10-2022 22:48
Static task
static1
Behavioral task
behavioral1
Sample
48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe
Resource
win7-20220901-en
General
-
Target
48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe
-
Size
653KB
-
MD5
62d25732203130462a86de8e7f85c180
-
SHA1
1cd039aaff2e3e3655ecec1dd386775878cc1a5e
-
SHA256
48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0
-
SHA512
3dcc681e7f1adf9efcec61bda9dbfb0263efa32f4445f89bc7c4c61200721a409c79b0ef12015454fb41fd51d995736314c30e309ea17a0bb300f18e8ccff88f
-
SSDEEP
12288:ZMW5QPmJGc3EDzPvEBprO/rlmyjt9XrCcmHaxo+Q7CPV1DjcOOuFQi0O:ZMW5/GIEvPIrO/rlPDmcRGkD7Ouh0O
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
Processes:
48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exedescription ioc process File created C:\Windows\SysWOW64\drivers\2da83a86.sys 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe -
Possible privilege escalation attempt 4 IoCs
Processes:
icacls.exetakeown.exeicacls.exetakeown.exepid process 532 icacls.exe 2040 takeown.exe 1964 icacls.exe 612 takeown.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1392 cmd.exe -
Loads dropped DLL 2 IoCs
Processes:
48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exepid process 1340 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe 1340 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe -
Modifies file permissions 1 TTPs 4 IoCs
Processes:
takeown.exeicacls.exetakeown.exeicacls.exepid process 2040 takeown.exe 1964 icacls.exe 612 takeown.exe 532 icacls.exe -
Installs/modifies Browser Helper Object 2 TTPs 4 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
Processes:
48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exedescription ioc process Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3} 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF} 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E} 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe -
Maps connected drives based on registry 3 TTPs 3 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe Key value enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe -
Drops file in System32 directory 5 IoCs
Processes:
48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exedescription ioc process File created C:\Windows\SysWOW64\midimap.dll 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe File created C:\Windows\SysWOW64\rDYfJaTw.dll 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe File created C:\Windows\SysWOW64\frehF88s.dll 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe File created C:\Windows\SysWOW64\wshtcpip.dll 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe File opened for modification C:\Windows\SysWOW64\wshtcpip.dll 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe -
Modifies registry class 4 IoCs
Processes:
48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\SYS_DLL\name = "tsf.dll" 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\HOOK_ID 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\HOOK_ID\name = "48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe" 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\SYS_DLL 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exepid process 1340 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe 1340 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe 1340 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe 1340 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe 1340 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe 1340 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe 1340 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe 1340 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe 1340 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe 1340 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe 1340 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe 1340 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe 1340 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe 1340 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe 1340 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe 1340 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe 1340 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe 1340 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe 1340 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe 1340 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe 1340 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe 1340 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe 1340 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe 1340 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe 1340 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe 1340 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe 1340 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe 1340 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe 1340 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe 1340 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe 1340 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe 1340 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe 1340 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe 1340 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe 1340 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe 1340 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe 1340 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe 1340 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe 1340 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe 1340 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe 1340 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe 1340 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe 1340 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe 1340 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe 1340 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe 1340 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe 1340 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe 1340 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe 1340 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe 1340 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe 1340 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe 1340 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe 1340 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe 1340 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe 1340 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe 1340 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe 1340 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe 1340 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe 1340 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe 1340 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe 1340 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe 1340 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe 1340 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe 1340 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
takeown.exetakeown.exe48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exedescription pid process Token: SeTakeOwnershipPrivilege 2040 takeown.exe Token: SeTakeOwnershipPrivilege 612 takeown.exe Token: SeDebugPrivilege 1340 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.execmd.execmd.exedescription pid process target process PID 1340 wrote to memory of 1768 1340 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe cmd.exe PID 1340 wrote to memory of 1768 1340 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe cmd.exe PID 1340 wrote to memory of 1768 1340 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe cmd.exe PID 1340 wrote to memory of 1768 1340 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe cmd.exe PID 1768 wrote to memory of 2040 1768 cmd.exe takeown.exe PID 1768 wrote to memory of 2040 1768 cmd.exe takeown.exe PID 1768 wrote to memory of 2040 1768 cmd.exe takeown.exe PID 1768 wrote to memory of 2040 1768 cmd.exe takeown.exe PID 1768 wrote to memory of 1964 1768 cmd.exe icacls.exe PID 1768 wrote to memory of 1964 1768 cmd.exe icacls.exe PID 1768 wrote to memory of 1964 1768 cmd.exe icacls.exe PID 1768 wrote to memory of 1964 1768 cmd.exe icacls.exe PID 1340 wrote to memory of 1536 1340 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe cmd.exe PID 1340 wrote to memory of 1536 1340 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe cmd.exe PID 1340 wrote to memory of 1536 1340 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe cmd.exe PID 1340 wrote to memory of 1536 1340 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe cmd.exe PID 1536 wrote to memory of 612 1536 cmd.exe takeown.exe PID 1536 wrote to memory of 612 1536 cmd.exe takeown.exe PID 1536 wrote to memory of 612 1536 cmd.exe takeown.exe PID 1536 wrote to memory of 612 1536 cmd.exe takeown.exe PID 1536 wrote to memory of 532 1536 cmd.exe icacls.exe PID 1536 wrote to memory of 532 1536 cmd.exe icacls.exe PID 1536 wrote to memory of 532 1536 cmd.exe icacls.exe PID 1536 wrote to memory of 532 1536 cmd.exe icacls.exe PID 1340 wrote to memory of 1392 1340 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe cmd.exe PID 1340 wrote to memory of 1392 1340 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe cmd.exe PID 1340 wrote to memory of 1392 1340 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe cmd.exe PID 1340 wrote to memory of 1392 1340 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe"C:\Users\Admin\AppData\Local\Temp\48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe"1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /c takeown /f C:\Windows\SysWOW64\wshtcpip.dll && icacls C:\Windows\SysWOW64\wshtcpip.dll /grant administrators:F2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\SysWOW64\wshtcpip.dll3⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\icacls.exeicacls C:\Windows\SysWOW64\wshtcpip.dll /grant administrators:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.execmd.exe /c takeown /f C:\Windows\SysWOW64\midimap.dll && icacls C:\Windows\SysWOW64\midimap.dll /grant administrators:F2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\SysWOW64\midimap.dll3⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\icacls.exeicacls C:\Windows\SysWOW64\midimap.dll /grant administrators:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\ahnmove.bat2⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\ahnmove.batFilesize
181B
MD5041f6e97167ce9068a5fca01ec52763e
SHA19d485272198387d4d7476ff5a32c2b00ad0a3426
SHA25631896dd082286dce1b09e8987f2928ea6d3afc4cc9a9ebefc98e7b8e8336abe9
SHA512f01983f9a72772680698a78c8785223dbbada9ed74315f00c58c5510d9b85ccb6f9f01d45a1125e251a5dc048c725b50c105bc2da0dc30b9d49f19f33e2f3544
-
\Users\Admin\AppData\Local\Temp\rDYfJaTw.dllFilesize
9.8MB
MD524590d282b964ea060499ec88030f76f
SHA17edc083bdcbc26714c9d530d6735ee4e8e124cf7
SHA2561b0bddcf39fe3b9aaa5e0ba69566d137eec81565ff14ec7b8271c1d0fafcc882
SHA51217906c66a5e19f6e27608f144cb103ee7cb54bd8f8887b8f098b8edecf9ef83aa12bfbcfd6761bd61b8ddbe222f916050476713dca4e9f4a85fe32799cf085d9
-
\Windows\SysWOW64\wshtcpip.dllFilesize
19KB
MD54d789846e8dfb150d15f5020d1741dfd
SHA1fcf7fdfb355054d7774005cac505ff694a4cb7ed
SHA2569ab6f20122b8595979b1b0bcea86a38fd11a21e8ad798f8dd2cc1c43f4cf3682
SHA51216ac2a5778bff6f65dea73d2b9c03a342402f569f57ae7a047c5736e4649e06c00b2af749f458ee471e632fa6b6faa6d782035bea75f9f52d8fd8534dad83a08
-
memory/532-62-0x0000000000000000-mapping.dmp
-
memory/612-61-0x0000000000000000-mapping.dmp
-
memory/1340-58-0x0000000001000000-0x0000000001B4D000-memory.dmpFilesize
11.3MB
-
memory/1340-59-0x0000000000220000-0x0000000000240000-memory.dmpFilesize
128KB
-
memory/1340-54-0x0000000074DE1000-0x0000000074DE3000-memory.dmpFilesize
8KB
-
memory/1340-64-0x00000000719C1000-0x00000000719C5000-memory.dmpFilesize
16KB
-
memory/1340-65-0x0000000001000000-0x0000000001B4D000-memory.dmpFilesize
11.3MB
-
memory/1340-66-0x0000000000220000-0x0000000000240000-memory.dmpFilesize
128KB
-
memory/1340-69-0x0000000001000000-0x0000000001B4D000-memory.dmpFilesize
11.3MB
-
memory/1340-71-0x0000000010000000-0x00000000109DF000-memory.dmpFilesize
9.9MB
-
memory/1392-67-0x0000000000000000-mapping.dmp
-
memory/1536-60-0x0000000000000000-mapping.dmp
-
memory/1768-55-0x0000000000000000-mapping.dmp
-
memory/1964-57-0x0000000000000000-mapping.dmp
-
memory/2040-56-0x0000000000000000-mapping.dmp