Analysis
-
max time kernel
66s -
max time network
54s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
01-10-2022 20:49
Behavioral task
behavioral1
Sample
f6dcaaa1b3ff919d4bc1491682afb8594258c7d093244303c56adfd3cb0eaf67.exe
Resource
win7-20220812-en
General
-
Target
f6dcaaa1b3ff919d4bc1491682afb8594258c7d093244303c56adfd3cb0eaf67.exe
-
Size
350KB
-
MD5
7587b8b4387c74439feb74f054960a70
-
SHA1
a419f6ddcbfc3a1e7b085d46e39d64a7c901f6fc
-
SHA256
f6dcaaa1b3ff919d4bc1491682afb8594258c7d093244303c56adfd3cb0eaf67
-
SHA512
4adc1fd6fb06198ef109987eba2b4b726dea8fe49a0949763c86a98507c28e1dc90985296bb5f6636bbcaa41bf3b088553989b80a11e5f2f3b846d7c2b00998a
-
SSDEEP
6144:kyXu7IEBSsQ9ElMwm60lmqs7MTRGA3h3GVqdppJXEGhBukJF/KAwxFUOWdEmh:k3BdQLL4BE93NGVYZX9BukJlwxSJdEm
Malware Config
Signatures
-
Drops file in Drivers directory 2 IoCs
Processes:
f6dcaaa1b3ff919d4bc1491682afb8594258c7d093244303c56adfd3cb0eaf67.exedescription ioc process File created C:\Windows\SysWOW64\drivers\51d1337f.sys f6dcaaa1b3ff919d4bc1491682afb8594258c7d093244303c56adfd3cb0eaf67.exe File created C:\Windows\SysWOW64\drivers\2d7a06f9.sys f6dcaaa1b3ff919d4bc1491682afb8594258c7d093244303c56adfd3cb0eaf67.exe -
Possible privilege escalation attempt 2 IoCs
Processes:
takeown.exeicacls.exepid process 1816 takeown.exe 520 icacls.exe -
Sets service image path in registry 2 TTPs 2 IoCs
Processes:
f6dcaaa1b3ff919d4bc1491682afb8594258c7d093244303c56adfd3cb0eaf67.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\51d1337f\ImagePath = "\\??\\C:\\Windows\\SysWOW64\\drivers\\51d1337f.sys" f6dcaaa1b3ff919d4bc1491682afb8594258c7d093244303c56adfd3cb0eaf67.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\2d7a06f9\ImagePath = "\\??\\C:\\Windows\\SysWOW64\\drivers\\2d7a06f9.sys" f6dcaaa1b3ff919d4bc1491682afb8594258c7d093244303c56adfd3cb0eaf67.exe -
Processes:
resource yara_rule behavioral1/memory/1184-55-0x0000000001000000-0x000000000112D000-memory.dmp upx behavioral1/memory/1184-56-0x0000000001000000-0x000000000112D000-memory.dmp upx behavioral1/memory/1184-61-0x0000000001000000-0x000000000112D000-memory.dmp upx -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1640 cmd.exe -
Modifies file permissions 1 TTPs 2 IoCs
Processes:
takeown.exeicacls.exepid process 1816 takeown.exe 520 icacls.exe -
Installs/modifies Browser Helper Object 2 TTPs 4 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
Processes:
f6dcaaa1b3ff919d4bc1491682afb8594258c7d093244303c56adfd3cb0eaf67.exedescription ioc process Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF} f6dcaaa1b3ff919d4bc1491682afb8594258c7d093244303c56adfd3cb0eaf67.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E} f6dcaaa1b3ff919d4bc1491682afb8594258c7d093244303c56adfd3cb0eaf67.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3} f6dcaaa1b3ff919d4bc1491682afb8594258c7d093244303c56adfd3cb0eaf67.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects f6dcaaa1b3ff919d4bc1491682afb8594258c7d093244303c56adfd3cb0eaf67.exe -
Drops file in System32 directory 5 IoCs
Processes:
f6dcaaa1b3ff919d4bc1491682afb8594258c7d093244303c56adfd3cb0eaf67.exedescription ioc process File opened for modification C:\Windows\SysWOW64\goodsb.dll f6dcaaa1b3ff919d4bc1491682afb8594258c7d093244303c56adfd3cb0eaf67.exe File created C:\Windows\SysWOW64\goodsb.dll f6dcaaa1b3ff919d4bc1491682afb8594258c7d093244303c56adfd3cb0eaf67.exe File created C:\Windows\SysWOW64\ws2tcpip.dll f6dcaaa1b3ff919d4bc1491682afb8594258c7d093244303c56adfd3cb0eaf67.exe File opened for modification C:\Windows\SysWOW64\ws2tcpip.dll f6dcaaa1b3ff919d4bc1491682afb8594258c7d093244303c56adfd3cb0eaf67.exe File created C:\Windows\SysWOW64\wshtcpip.dll f6dcaaa1b3ff919d4bc1491682afb8594258c7d093244303c56adfd3cb0eaf67.exe -
Modifies registry class 4 IoCs
Processes:
f6dcaaa1b3ff919d4bc1491682afb8594258c7d093244303c56adfd3cb0eaf67.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\HOOK_ID f6dcaaa1b3ff919d4bc1491682afb8594258c7d093244303c56adfd3cb0eaf67.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\HOOK_ID\name = "f6dcaaa1b3ff919d4bc1491682afb8594258c7d093244303c56adfd3cb0eaf67.exe" f6dcaaa1b3ff919d4bc1491682afb8594258c7d093244303c56adfd3cb0eaf67.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\SYS_DLL f6dcaaa1b3ff919d4bc1491682afb8594258c7d093244303c56adfd3cb0eaf67.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\SYS_DLL\name = "seY.dll" f6dcaaa1b3ff919d4bc1491682afb8594258c7d093244303c56adfd3cb0eaf67.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
f6dcaaa1b3ff919d4bc1491682afb8594258c7d093244303c56adfd3cb0eaf67.exepid process 1184 f6dcaaa1b3ff919d4bc1491682afb8594258c7d093244303c56adfd3cb0eaf67.exe 1184 f6dcaaa1b3ff919d4bc1491682afb8594258c7d093244303c56adfd3cb0eaf67.exe 1184 f6dcaaa1b3ff919d4bc1491682afb8594258c7d093244303c56adfd3cb0eaf67.exe 1184 f6dcaaa1b3ff919d4bc1491682afb8594258c7d093244303c56adfd3cb0eaf67.exe 1184 f6dcaaa1b3ff919d4bc1491682afb8594258c7d093244303c56adfd3cb0eaf67.exe 1184 f6dcaaa1b3ff919d4bc1491682afb8594258c7d093244303c56adfd3cb0eaf67.exe 1184 f6dcaaa1b3ff919d4bc1491682afb8594258c7d093244303c56adfd3cb0eaf67.exe 1184 f6dcaaa1b3ff919d4bc1491682afb8594258c7d093244303c56adfd3cb0eaf67.exe 1184 f6dcaaa1b3ff919d4bc1491682afb8594258c7d093244303c56adfd3cb0eaf67.exe 1184 f6dcaaa1b3ff919d4bc1491682afb8594258c7d093244303c56adfd3cb0eaf67.exe 1184 f6dcaaa1b3ff919d4bc1491682afb8594258c7d093244303c56adfd3cb0eaf67.exe 1184 f6dcaaa1b3ff919d4bc1491682afb8594258c7d093244303c56adfd3cb0eaf67.exe 1184 f6dcaaa1b3ff919d4bc1491682afb8594258c7d093244303c56adfd3cb0eaf67.exe 1184 f6dcaaa1b3ff919d4bc1491682afb8594258c7d093244303c56adfd3cb0eaf67.exe 1184 f6dcaaa1b3ff919d4bc1491682afb8594258c7d093244303c56adfd3cb0eaf67.exe 1184 f6dcaaa1b3ff919d4bc1491682afb8594258c7d093244303c56adfd3cb0eaf67.exe 1184 f6dcaaa1b3ff919d4bc1491682afb8594258c7d093244303c56adfd3cb0eaf67.exe 1184 f6dcaaa1b3ff919d4bc1491682afb8594258c7d093244303c56adfd3cb0eaf67.exe 1184 f6dcaaa1b3ff919d4bc1491682afb8594258c7d093244303c56adfd3cb0eaf67.exe 1184 f6dcaaa1b3ff919d4bc1491682afb8594258c7d093244303c56adfd3cb0eaf67.exe 1184 f6dcaaa1b3ff919d4bc1491682afb8594258c7d093244303c56adfd3cb0eaf67.exe 1184 f6dcaaa1b3ff919d4bc1491682afb8594258c7d093244303c56adfd3cb0eaf67.exe 1184 f6dcaaa1b3ff919d4bc1491682afb8594258c7d093244303c56adfd3cb0eaf67.exe 1184 f6dcaaa1b3ff919d4bc1491682afb8594258c7d093244303c56adfd3cb0eaf67.exe 1184 f6dcaaa1b3ff919d4bc1491682afb8594258c7d093244303c56adfd3cb0eaf67.exe 1184 f6dcaaa1b3ff919d4bc1491682afb8594258c7d093244303c56adfd3cb0eaf67.exe 1184 f6dcaaa1b3ff919d4bc1491682afb8594258c7d093244303c56adfd3cb0eaf67.exe 1184 f6dcaaa1b3ff919d4bc1491682afb8594258c7d093244303c56adfd3cb0eaf67.exe 1184 f6dcaaa1b3ff919d4bc1491682afb8594258c7d093244303c56adfd3cb0eaf67.exe 1184 f6dcaaa1b3ff919d4bc1491682afb8594258c7d093244303c56adfd3cb0eaf67.exe 1184 f6dcaaa1b3ff919d4bc1491682afb8594258c7d093244303c56adfd3cb0eaf67.exe 1184 f6dcaaa1b3ff919d4bc1491682afb8594258c7d093244303c56adfd3cb0eaf67.exe 1184 f6dcaaa1b3ff919d4bc1491682afb8594258c7d093244303c56adfd3cb0eaf67.exe 1184 f6dcaaa1b3ff919d4bc1491682afb8594258c7d093244303c56adfd3cb0eaf67.exe 1184 f6dcaaa1b3ff919d4bc1491682afb8594258c7d093244303c56adfd3cb0eaf67.exe 1184 f6dcaaa1b3ff919d4bc1491682afb8594258c7d093244303c56adfd3cb0eaf67.exe 1184 f6dcaaa1b3ff919d4bc1491682afb8594258c7d093244303c56adfd3cb0eaf67.exe 1184 f6dcaaa1b3ff919d4bc1491682afb8594258c7d093244303c56adfd3cb0eaf67.exe 1184 f6dcaaa1b3ff919d4bc1491682afb8594258c7d093244303c56adfd3cb0eaf67.exe 1184 f6dcaaa1b3ff919d4bc1491682afb8594258c7d093244303c56adfd3cb0eaf67.exe 1184 f6dcaaa1b3ff919d4bc1491682afb8594258c7d093244303c56adfd3cb0eaf67.exe 1184 f6dcaaa1b3ff919d4bc1491682afb8594258c7d093244303c56adfd3cb0eaf67.exe 1184 f6dcaaa1b3ff919d4bc1491682afb8594258c7d093244303c56adfd3cb0eaf67.exe 1184 f6dcaaa1b3ff919d4bc1491682afb8594258c7d093244303c56adfd3cb0eaf67.exe 1184 f6dcaaa1b3ff919d4bc1491682afb8594258c7d093244303c56adfd3cb0eaf67.exe 1184 f6dcaaa1b3ff919d4bc1491682afb8594258c7d093244303c56adfd3cb0eaf67.exe 1184 f6dcaaa1b3ff919d4bc1491682afb8594258c7d093244303c56adfd3cb0eaf67.exe 1184 f6dcaaa1b3ff919d4bc1491682afb8594258c7d093244303c56adfd3cb0eaf67.exe 1184 f6dcaaa1b3ff919d4bc1491682afb8594258c7d093244303c56adfd3cb0eaf67.exe 1184 f6dcaaa1b3ff919d4bc1491682afb8594258c7d093244303c56adfd3cb0eaf67.exe 1184 f6dcaaa1b3ff919d4bc1491682afb8594258c7d093244303c56adfd3cb0eaf67.exe 1184 f6dcaaa1b3ff919d4bc1491682afb8594258c7d093244303c56adfd3cb0eaf67.exe 1184 f6dcaaa1b3ff919d4bc1491682afb8594258c7d093244303c56adfd3cb0eaf67.exe 1184 f6dcaaa1b3ff919d4bc1491682afb8594258c7d093244303c56adfd3cb0eaf67.exe 1184 f6dcaaa1b3ff919d4bc1491682afb8594258c7d093244303c56adfd3cb0eaf67.exe 1184 f6dcaaa1b3ff919d4bc1491682afb8594258c7d093244303c56adfd3cb0eaf67.exe 1184 f6dcaaa1b3ff919d4bc1491682afb8594258c7d093244303c56adfd3cb0eaf67.exe 1184 f6dcaaa1b3ff919d4bc1491682afb8594258c7d093244303c56adfd3cb0eaf67.exe 1184 f6dcaaa1b3ff919d4bc1491682afb8594258c7d093244303c56adfd3cb0eaf67.exe 1184 f6dcaaa1b3ff919d4bc1491682afb8594258c7d093244303c56adfd3cb0eaf67.exe 1184 f6dcaaa1b3ff919d4bc1491682afb8594258c7d093244303c56adfd3cb0eaf67.exe 1184 f6dcaaa1b3ff919d4bc1491682afb8594258c7d093244303c56adfd3cb0eaf67.exe 1184 f6dcaaa1b3ff919d4bc1491682afb8594258c7d093244303c56adfd3cb0eaf67.exe 1184 f6dcaaa1b3ff919d4bc1491682afb8594258c7d093244303c56adfd3cb0eaf67.exe -
Suspicious behavior: LoadsDriver 5 IoCs
Processes:
f6dcaaa1b3ff919d4bc1491682afb8594258c7d093244303c56adfd3cb0eaf67.exepid process 460 1184 f6dcaaa1b3ff919d4bc1491682afb8594258c7d093244303c56adfd3cb0eaf67.exe 460 1184 f6dcaaa1b3ff919d4bc1491682afb8594258c7d093244303c56adfd3cb0eaf67.exe 1184 f6dcaaa1b3ff919d4bc1491682afb8594258c7d093244303c56adfd3cb0eaf67.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
f6dcaaa1b3ff919d4bc1491682afb8594258c7d093244303c56adfd3cb0eaf67.exetakeown.exedescription pid process Token: SeDebugPrivilege 1184 f6dcaaa1b3ff919d4bc1491682afb8594258c7d093244303c56adfd3cb0eaf67.exe Token: SeTakeOwnershipPrivilege 1816 takeown.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
f6dcaaa1b3ff919d4bc1491682afb8594258c7d093244303c56adfd3cb0eaf67.execmd.exedescription pid process target process PID 1184 wrote to memory of 2024 1184 f6dcaaa1b3ff919d4bc1491682afb8594258c7d093244303c56adfd3cb0eaf67.exe cmd.exe PID 1184 wrote to memory of 2024 1184 f6dcaaa1b3ff919d4bc1491682afb8594258c7d093244303c56adfd3cb0eaf67.exe cmd.exe PID 1184 wrote to memory of 2024 1184 f6dcaaa1b3ff919d4bc1491682afb8594258c7d093244303c56adfd3cb0eaf67.exe cmd.exe PID 1184 wrote to memory of 2024 1184 f6dcaaa1b3ff919d4bc1491682afb8594258c7d093244303c56adfd3cb0eaf67.exe cmd.exe PID 2024 wrote to memory of 1816 2024 cmd.exe takeown.exe PID 2024 wrote to memory of 1816 2024 cmd.exe takeown.exe PID 2024 wrote to memory of 1816 2024 cmd.exe takeown.exe PID 2024 wrote to memory of 1816 2024 cmd.exe takeown.exe PID 2024 wrote to memory of 520 2024 cmd.exe icacls.exe PID 2024 wrote to memory of 520 2024 cmd.exe icacls.exe PID 2024 wrote to memory of 520 2024 cmd.exe icacls.exe PID 2024 wrote to memory of 520 2024 cmd.exe icacls.exe PID 1184 wrote to memory of 1640 1184 f6dcaaa1b3ff919d4bc1491682afb8594258c7d093244303c56adfd3cb0eaf67.exe cmd.exe PID 1184 wrote to memory of 1640 1184 f6dcaaa1b3ff919d4bc1491682afb8594258c7d093244303c56adfd3cb0eaf67.exe cmd.exe PID 1184 wrote to memory of 1640 1184 f6dcaaa1b3ff919d4bc1491682afb8594258c7d093244303c56adfd3cb0eaf67.exe cmd.exe PID 1184 wrote to memory of 1640 1184 f6dcaaa1b3ff919d4bc1491682afb8594258c7d093244303c56adfd3cb0eaf67.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f6dcaaa1b3ff919d4bc1491682afb8594258c7d093244303c56adfd3cb0eaf67.exe"C:\Users\Admin\AppData\Local\Temp\f6dcaaa1b3ff919d4bc1491682afb8594258c7d093244303c56adfd3cb0eaf67.exe"1⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /c takeown /f C:\Windows\SysWOW64\wshtcpip.dll && icacls C:\Windows\SysWOW64\wshtcpip.dll /grant administrators:F2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\SysWOW64\wshtcpip.dll3⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\icacls.exeicacls C:\Windows\SysWOW64\wshtcpip.dll /grant administrators:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\ahnmove.bat2⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\ahnmove.batFilesize
181B
MD57cfe8df0595ad292ce3e2445c57c32c9
SHA156ebffebdfce6ae7f5547082102b31051dbc510f
SHA25600743df713dfc2d1f7b2f7f7628d5ed3299f35881b8b0b527c59ed9672817142
SHA51276ca5ad11af449df91af37747dafb3304c10c6ffb1790bdf092a59a83833a92908f83770c8f32cc18b66d976a453e3003cb24be5bcb814c61554a4ecb34e719a
-
memory/520-59-0x0000000000000000-mapping.dmp
-
memory/1184-54-0x0000000074BB1000-0x0000000074BB3000-memory.dmpFilesize
8KB
-
memory/1184-55-0x0000000001000000-0x000000000112D000-memory.dmpFilesize
1.2MB
-
memory/1184-56-0x0000000001000000-0x000000000112D000-memory.dmpFilesize
1.2MB
-
memory/1184-61-0x0000000001000000-0x000000000112D000-memory.dmpFilesize
1.2MB
-
memory/1640-60-0x0000000000000000-mapping.dmp
-
memory/1816-58-0x0000000000000000-mapping.dmp
-
memory/2024-57-0x0000000000000000-mapping.dmp