Analysis
-
max time kernel
83s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
01-10-2022 22:48
Static task
static1
Behavioral task
behavioral1
Sample
48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe
Resource
win7-20220901-en
General
-
Target
48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe
-
Size
653KB
-
MD5
62d25732203130462a86de8e7f85c180
-
SHA1
1cd039aaff2e3e3655ecec1dd386775878cc1a5e
-
SHA256
48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0
-
SHA512
3dcc681e7f1adf9efcec61bda9dbfb0263efa32f4445f89bc7c4c61200721a409c79b0ef12015454fb41fd51d995736314c30e309ea17a0bb300f18e8ccff88f
-
SSDEEP
12288:ZMW5QPmJGc3EDzPvEBprO/rlmyjt9XrCcmHaxo+Q7CPV1DjcOOuFQi0O:ZMW5/GIEvPIrO/rlPDmcRGkD7Ouh0O
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
Processes:
48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exedescription ioc process File created C:\Windows\SysWOW64\drivers\2a44dd2a.sys 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe -
Possible privilege escalation attempt 4 IoCs
Processes:
icacls.exetakeown.exeicacls.exetakeown.exepid process 4296 icacls.exe 2296 takeown.exe 4612 icacls.exe 2860 takeown.exe -
Modifies file permissions 1 TTPs 4 IoCs
Processes:
takeown.exeicacls.exetakeown.exeicacls.exepid process 2860 takeown.exe 4296 icacls.exe 2296 takeown.exe 4612 icacls.exe -
Installs/modifies Browser Helper Object 2 TTPs 3 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
Processes:
48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exedescription ioc process Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA} 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C} 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe -
Maps connected drives based on registry 3 TTPs 3 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe Key value enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe -
Drops file in System32 directory 5 IoCs
Processes:
48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exedescription ioc process File opened for modification C:\Windows\SysWOW64\wshtcpip.dll 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe File created C:\Windows\SysWOW64\midimap.dll 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe File created C:\Windows\SysWOW64\uuiu2yYh.dll 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe File created C:\Windows\SysWOW64\Hwieq8UY.dll 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe File created C:\Windows\SysWOW64\wshtcpip.dll 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe -
Modifies registry class 4 IoCs
Processes:
48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\HOOK_ID 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\HOOK_ID\name = "48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe" 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\SYS_DLL 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\SYS_DLL\name = "ffhH7eeVt.dll" 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exepid process 3064 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe 3064 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe 3064 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe 3064 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe 3064 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe 3064 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe 3064 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe 3064 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe 3064 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe 3064 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe 3064 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe 3064 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe 3064 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe 3064 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe 3064 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe 3064 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe 3064 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe 3064 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe 3064 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe 3064 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe 3064 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe 3064 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe 3064 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe 3064 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe 3064 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe 3064 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe 3064 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe 3064 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe 3064 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe 3064 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe 3064 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe 3064 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe 3064 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe 3064 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe 3064 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe 3064 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe 3064 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe 3064 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe 3064 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe 3064 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe 3064 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe 3064 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe 3064 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe 3064 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe 3064 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe 3064 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe 3064 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe 3064 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe 3064 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe 3064 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe 3064 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe 3064 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe 3064 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe 3064 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe 3064 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe 3064 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe 3064 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe 3064 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe 3064 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe 3064 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe 3064 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe 3064 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe 3064 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe 3064 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
takeown.exetakeown.exe48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exedescription pid process Token: SeTakeOwnershipPrivilege 2860 takeown.exe Token: SeTakeOwnershipPrivilege 2296 takeown.exe Token: SeDebugPrivilege 3064 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.execmd.execmd.exedescription pid process target process PID 3064 wrote to memory of 4644 3064 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe cmd.exe PID 3064 wrote to memory of 4644 3064 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe cmd.exe PID 3064 wrote to memory of 4644 3064 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe cmd.exe PID 4644 wrote to memory of 2860 4644 cmd.exe takeown.exe PID 4644 wrote to memory of 2860 4644 cmd.exe takeown.exe PID 4644 wrote to memory of 2860 4644 cmd.exe takeown.exe PID 4644 wrote to memory of 4296 4644 cmd.exe icacls.exe PID 4644 wrote to memory of 4296 4644 cmd.exe icacls.exe PID 4644 wrote to memory of 4296 4644 cmd.exe icacls.exe PID 3064 wrote to memory of 884 3064 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe cmd.exe PID 3064 wrote to memory of 884 3064 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe cmd.exe PID 3064 wrote to memory of 884 3064 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe cmd.exe PID 884 wrote to memory of 2296 884 cmd.exe takeown.exe PID 884 wrote to memory of 2296 884 cmd.exe takeown.exe PID 884 wrote to memory of 2296 884 cmd.exe takeown.exe PID 884 wrote to memory of 4612 884 cmd.exe icacls.exe PID 884 wrote to memory of 4612 884 cmd.exe icacls.exe PID 884 wrote to memory of 4612 884 cmd.exe icacls.exe PID 3064 wrote to memory of 1604 3064 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe cmd.exe PID 3064 wrote to memory of 1604 3064 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe cmd.exe PID 3064 wrote to memory of 1604 3064 48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe"C:\Users\Admin\AppData\Local\Temp\48987402a460201fb657dec8929afe378b98c86cfc95377b82269f95be2d78c0.exe"1⤵
- Drops file in Drivers directory
- Installs/modifies Browser Helper Object
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /c takeown /f C:\Windows\SysWOW64\wshtcpip.dll && icacls C:\Windows\SysWOW64\wshtcpip.dll /grant administrators:F2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\SysWOW64\wshtcpip.dll3⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\icacls.exeicacls C:\Windows\SysWOW64\wshtcpip.dll /grant administrators:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.execmd.exe /c takeown /f C:\Windows\SysWOW64\midimap.dll && icacls C:\Windows\SysWOW64\midimap.dll /grant administrators:F2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\SysWOW64\midimap.dll3⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\icacls.exeicacls C:\Windows\SysWOW64\midimap.dll /grant administrators:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ahnmove.bat2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\ahnmove.batFilesize
181B
MD5041f6e97167ce9068a5fca01ec52763e
SHA19d485272198387d4d7476ff5a32c2b00ad0a3426
SHA25631896dd082286dce1b09e8987f2928ea6d3afc4cc9a9ebefc98e7b8e8336abe9
SHA512f01983f9a72772680698a78c8785223dbbada9ed74315f00c58c5510d9b85ccb6f9f01d45a1125e251a5dc048c725b50c105bc2da0dc30b9d49f19f33e2f3544
-
memory/884-137-0x0000000000000000-mapping.dmp
-
memory/1604-141-0x0000000000000000-mapping.dmp
-
memory/2296-138-0x0000000000000000-mapping.dmp
-
memory/2860-135-0x0000000000000000-mapping.dmp
-
memory/3064-132-0x0000000001000000-0x0000000001B4D000-memory.dmpFilesize
11.3MB
-
memory/3064-133-0x0000000000550000-0x0000000000570000-memory.dmpFilesize
128KB
-
memory/3064-140-0x0000000001000000-0x0000000001B4D000-memory.dmpFilesize
11.3MB
-
memory/3064-143-0x0000000001000000-0x0000000001B4D000-memory.dmpFilesize
11.3MB
-
memory/4296-136-0x0000000000000000-mapping.dmp
-
memory/4612-139-0x0000000000000000-mapping.dmp
-
memory/4644-134-0x0000000000000000-mapping.dmp