Analysis
-
max time kernel
57s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
02-10-2022 23:09
Behavioral task
behavioral1
Sample
f33ba83b791e93de63f6bcd2a96366e66c1ff9a4ae9d90eef8dc06307ad46972.exe
Resource
win7-20220901-en
General
-
Target
f33ba83b791e93de63f6bcd2a96366e66c1ff9a4ae9d90eef8dc06307ad46972.exe
-
Size
350KB
-
MD5
6e6cab08847326da2b45c05f92a7d150
-
SHA1
316b316351910d02a3a1faacc561d4bab600bac0
-
SHA256
f33ba83b791e93de63f6bcd2a96366e66c1ff9a4ae9d90eef8dc06307ad46972
-
SHA512
8c8388e9bed8cacf8a672b38b856f9e1e24061b0a20b6e293915ea9952ebd676ea97c452b5fde90a42e50d3954914a4ec61c00d47bde4fa3bbdb03326cdeff00
-
SSDEEP
6144:oyXu7IEBSsQ9ElMwm60lmqs7MTRGA3h3GVqdppJXEGhBukJF/KAwxFUOWdEmh:o3BdQLL4BE93NGVYZX9BukJlwxSJdEm
Malware Config
Signatures
-
Drops file in Drivers directory 2 IoCs
Processes:
f33ba83b791e93de63f6bcd2a96366e66c1ff9a4ae9d90eef8dc06307ad46972.exedescription ioc process File created C:\Windows\SysWOW64\drivers\31fd7dcd.sys f33ba83b791e93de63f6bcd2a96366e66c1ff9a4ae9d90eef8dc06307ad46972.exe File created C:\Windows\SysWOW64\drivers\4d56484b.sys f33ba83b791e93de63f6bcd2a96366e66c1ff9a4ae9d90eef8dc06307ad46972.exe -
Possible privilege escalation attempt 2 IoCs
Processes:
takeown.exeicacls.exepid process 740 takeown.exe 2028 icacls.exe -
Sets service image path in registry 2 TTPs 2 IoCs
Processes:
f33ba83b791e93de63f6bcd2a96366e66c1ff9a4ae9d90eef8dc06307ad46972.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\31fd7dcd\ImagePath = "\\??\\C:\\Windows\\SysWOW64\\drivers\\31fd7dcd.sys" f33ba83b791e93de63f6bcd2a96366e66c1ff9a4ae9d90eef8dc06307ad46972.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\4d56484b\ImagePath = "\\??\\C:\\Windows\\SysWOW64\\drivers\\4d56484b.sys" f33ba83b791e93de63f6bcd2a96366e66c1ff9a4ae9d90eef8dc06307ad46972.exe -
Processes:
resource yara_rule behavioral1/memory/1600-55-0x0000000001000000-0x000000000112D000-memory.dmp upx behavioral1/memory/1600-60-0x0000000001000000-0x000000000112D000-memory.dmp upx -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1096 cmd.exe -
Modifies file permissions 1 TTPs 2 IoCs
Processes:
takeown.exeicacls.exepid process 740 takeown.exe 2028 icacls.exe -
Installs/modifies Browser Helper Object 2 TTPs 4 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
Processes:
f33ba83b791e93de63f6bcd2a96366e66c1ff9a4ae9d90eef8dc06307ad46972.exedescription ioc process Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF} f33ba83b791e93de63f6bcd2a96366e66c1ff9a4ae9d90eef8dc06307ad46972.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E} f33ba83b791e93de63f6bcd2a96366e66c1ff9a4ae9d90eef8dc06307ad46972.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3} f33ba83b791e93de63f6bcd2a96366e66c1ff9a4ae9d90eef8dc06307ad46972.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects f33ba83b791e93de63f6bcd2a96366e66c1ff9a4ae9d90eef8dc06307ad46972.exe -
Drops file in System32 directory 5 IoCs
Processes:
f33ba83b791e93de63f6bcd2a96366e66c1ff9a4ae9d90eef8dc06307ad46972.exedescription ioc process File created C:\Windows\SysWOW64\goodsb.dll f33ba83b791e93de63f6bcd2a96366e66c1ff9a4ae9d90eef8dc06307ad46972.exe File created C:\Windows\SysWOW64\ws2tcpip.dll f33ba83b791e93de63f6bcd2a96366e66c1ff9a4ae9d90eef8dc06307ad46972.exe File opened for modification C:\Windows\SysWOW64\ws2tcpip.dll f33ba83b791e93de63f6bcd2a96366e66c1ff9a4ae9d90eef8dc06307ad46972.exe File created C:\Windows\SysWOW64\wshtcpip.dll f33ba83b791e93de63f6bcd2a96366e66c1ff9a4ae9d90eef8dc06307ad46972.exe File opened for modification C:\Windows\SysWOW64\goodsb.dll f33ba83b791e93de63f6bcd2a96366e66c1ff9a4ae9d90eef8dc06307ad46972.exe -
Modifies registry class 4 IoCs
Processes:
f33ba83b791e93de63f6bcd2a96366e66c1ff9a4ae9d90eef8dc06307ad46972.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\SYS_DLL\name = "EGsJwp.dll" f33ba83b791e93de63f6bcd2a96366e66c1ff9a4ae9d90eef8dc06307ad46972.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\HOOK_ID f33ba83b791e93de63f6bcd2a96366e66c1ff9a4ae9d90eef8dc06307ad46972.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\HOOK_ID\name = "f33ba83b791e93de63f6bcd2a96366e66c1ff9a4ae9d90eef8dc06307ad46972.exe" f33ba83b791e93de63f6bcd2a96366e66c1ff9a4ae9d90eef8dc06307ad46972.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\SYS_DLL f33ba83b791e93de63f6bcd2a96366e66c1ff9a4ae9d90eef8dc06307ad46972.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
f33ba83b791e93de63f6bcd2a96366e66c1ff9a4ae9d90eef8dc06307ad46972.exepid process 1600 f33ba83b791e93de63f6bcd2a96366e66c1ff9a4ae9d90eef8dc06307ad46972.exe 1600 f33ba83b791e93de63f6bcd2a96366e66c1ff9a4ae9d90eef8dc06307ad46972.exe 1600 f33ba83b791e93de63f6bcd2a96366e66c1ff9a4ae9d90eef8dc06307ad46972.exe 1600 f33ba83b791e93de63f6bcd2a96366e66c1ff9a4ae9d90eef8dc06307ad46972.exe 1600 f33ba83b791e93de63f6bcd2a96366e66c1ff9a4ae9d90eef8dc06307ad46972.exe 1600 f33ba83b791e93de63f6bcd2a96366e66c1ff9a4ae9d90eef8dc06307ad46972.exe 1600 f33ba83b791e93de63f6bcd2a96366e66c1ff9a4ae9d90eef8dc06307ad46972.exe 1600 f33ba83b791e93de63f6bcd2a96366e66c1ff9a4ae9d90eef8dc06307ad46972.exe 1600 f33ba83b791e93de63f6bcd2a96366e66c1ff9a4ae9d90eef8dc06307ad46972.exe 1600 f33ba83b791e93de63f6bcd2a96366e66c1ff9a4ae9d90eef8dc06307ad46972.exe 1600 f33ba83b791e93de63f6bcd2a96366e66c1ff9a4ae9d90eef8dc06307ad46972.exe 1600 f33ba83b791e93de63f6bcd2a96366e66c1ff9a4ae9d90eef8dc06307ad46972.exe 1600 f33ba83b791e93de63f6bcd2a96366e66c1ff9a4ae9d90eef8dc06307ad46972.exe 1600 f33ba83b791e93de63f6bcd2a96366e66c1ff9a4ae9d90eef8dc06307ad46972.exe 1600 f33ba83b791e93de63f6bcd2a96366e66c1ff9a4ae9d90eef8dc06307ad46972.exe 1600 f33ba83b791e93de63f6bcd2a96366e66c1ff9a4ae9d90eef8dc06307ad46972.exe 1600 f33ba83b791e93de63f6bcd2a96366e66c1ff9a4ae9d90eef8dc06307ad46972.exe 1600 f33ba83b791e93de63f6bcd2a96366e66c1ff9a4ae9d90eef8dc06307ad46972.exe 1600 f33ba83b791e93de63f6bcd2a96366e66c1ff9a4ae9d90eef8dc06307ad46972.exe 1600 f33ba83b791e93de63f6bcd2a96366e66c1ff9a4ae9d90eef8dc06307ad46972.exe 1600 f33ba83b791e93de63f6bcd2a96366e66c1ff9a4ae9d90eef8dc06307ad46972.exe 1600 f33ba83b791e93de63f6bcd2a96366e66c1ff9a4ae9d90eef8dc06307ad46972.exe 1600 f33ba83b791e93de63f6bcd2a96366e66c1ff9a4ae9d90eef8dc06307ad46972.exe 1600 f33ba83b791e93de63f6bcd2a96366e66c1ff9a4ae9d90eef8dc06307ad46972.exe 1600 f33ba83b791e93de63f6bcd2a96366e66c1ff9a4ae9d90eef8dc06307ad46972.exe 1600 f33ba83b791e93de63f6bcd2a96366e66c1ff9a4ae9d90eef8dc06307ad46972.exe 1600 f33ba83b791e93de63f6bcd2a96366e66c1ff9a4ae9d90eef8dc06307ad46972.exe 1600 f33ba83b791e93de63f6bcd2a96366e66c1ff9a4ae9d90eef8dc06307ad46972.exe 1600 f33ba83b791e93de63f6bcd2a96366e66c1ff9a4ae9d90eef8dc06307ad46972.exe 1600 f33ba83b791e93de63f6bcd2a96366e66c1ff9a4ae9d90eef8dc06307ad46972.exe 1600 f33ba83b791e93de63f6bcd2a96366e66c1ff9a4ae9d90eef8dc06307ad46972.exe 1600 f33ba83b791e93de63f6bcd2a96366e66c1ff9a4ae9d90eef8dc06307ad46972.exe 1600 f33ba83b791e93de63f6bcd2a96366e66c1ff9a4ae9d90eef8dc06307ad46972.exe 1600 f33ba83b791e93de63f6bcd2a96366e66c1ff9a4ae9d90eef8dc06307ad46972.exe 1600 f33ba83b791e93de63f6bcd2a96366e66c1ff9a4ae9d90eef8dc06307ad46972.exe 1600 f33ba83b791e93de63f6bcd2a96366e66c1ff9a4ae9d90eef8dc06307ad46972.exe 1600 f33ba83b791e93de63f6bcd2a96366e66c1ff9a4ae9d90eef8dc06307ad46972.exe 1600 f33ba83b791e93de63f6bcd2a96366e66c1ff9a4ae9d90eef8dc06307ad46972.exe 1600 f33ba83b791e93de63f6bcd2a96366e66c1ff9a4ae9d90eef8dc06307ad46972.exe 1600 f33ba83b791e93de63f6bcd2a96366e66c1ff9a4ae9d90eef8dc06307ad46972.exe 1600 f33ba83b791e93de63f6bcd2a96366e66c1ff9a4ae9d90eef8dc06307ad46972.exe 1600 f33ba83b791e93de63f6bcd2a96366e66c1ff9a4ae9d90eef8dc06307ad46972.exe 1600 f33ba83b791e93de63f6bcd2a96366e66c1ff9a4ae9d90eef8dc06307ad46972.exe 1600 f33ba83b791e93de63f6bcd2a96366e66c1ff9a4ae9d90eef8dc06307ad46972.exe 1600 f33ba83b791e93de63f6bcd2a96366e66c1ff9a4ae9d90eef8dc06307ad46972.exe 1600 f33ba83b791e93de63f6bcd2a96366e66c1ff9a4ae9d90eef8dc06307ad46972.exe 1600 f33ba83b791e93de63f6bcd2a96366e66c1ff9a4ae9d90eef8dc06307ad46972.exe 1600 f33ba83b791e93de63f6bcd2a96366e66c1ff9a4ae9d90eef8dc06307ad46972.exe 1600 f33ba83b791e93de63f6bcd2a96366e66c1ff9a4ae9d90eef8dc06307ad46972.exe 1600 f33ba83b791e93de63f6bcd2a96366e66c1ff9a4ae9d90eef8dc06307ad46972.exe 1600 f33ba83b791e93de63f6bcd2a96366e66c1ff9a4ae9d90eef8dc06307ad46972.exe 1600 f33ba83b791e93de63f6bcd2a96366e66c1ff9a4ae9d90eef8dc06307ad46972.exe 1600 f33ba83b791e93de63f6bcd2a96366e66c1ff9a4ae9d90eef8dc06307ad46972.exe 1600 f33ba83b791e93de63f6bcd2a96366e66c1ff9a4ae9d90eef8dc06307ad46972.exe 1600 f33ba83b791e93de63f6bcd2a96366e66c1ff9a4ae9d90eef8dc06307ad46972.exe 1600 f33ba83b791e93de63f6bcd2a96366e66c1ff9a4ae9d90eef8dc06307ad46972.exe 1600 f33ba83b791e93de63f6bcd2a96366e66c1ff9a4ae9d90eef8dc06307ad46972.exe 1600 f33ba83b791e93de63f6bcd2a96366e66c1ff9a4ae9d90eef8dc06307ad46972.exe 1600 f33ba83b791e93de63f6bcd2a96366e66c1ff9a4ae9d90eef8dc06307ad46972.exe 1600 f33ba83b791e93de63f6bcd2a96366e66c1ff9a4ae9d90eef8dc06307ad46972.exe 1600 f33ba83b791e93de63f6bcd2a96366e66c1ff9a4ae9d90eef8dc06307ad46972.exe 1600 f33ba83b791e93de63f6bcd2a96366e66c1ff9a4ae9d90eef8dc06307ad46972.exe 1600 f33ba83b791e93de63f6bcd2a96366e66c1ff9a4ae9d90eef8dc06307ad46972.exe 1600 f33ba83b791e93de63f6bcd2a96366e66c1ff9a4ae9d90eef8dc06307ad46972.exe -
Suspicious behavior: LoadsDriver 5 IoCs
Processes:
f33ba83b791e93de63f6bcd2a96366e66c1ff9a4ae9d90eef8dc06307ad46972.exepid process 468 1600 f33ba83b791e93de63f6bcd2a96366e66c1ff9a4ae9d90eef8dc06307ad46972.exe 468 1600 f33ba83b791e93de63f6bcd2a96366e66c1ff9a4ae9d90eef8dc06307ad46972.exe 1600 f33ba83b791e93de63f6bcd2a96366e66c1ff9a4ae9d90eef8dc06307ad46972.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
f33ba83b791e93de63f6bcd2a96366e66c1ff9a4ae9d90eef8dc06307ad46972.exetakeown.exedescription pid process Token: SeDebugPrivilege 1600 f33ba83b791e93de63f6bcd2a96366e66c1ff9a4ae9d90eef8dc06307ad46972.exe Token: SeTakeOwnershipPrivilege 740 takeown.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
f33ba83b791e93de63f6bcd2a96366e66c1ff9a4ae9d90eef8dc06307ad46972.execmd.exedescription pid process target process PID 1600 wrote to memory of 304 1600 f33ba83b791e93de63f6bcd2a96366e66c1ff9a4ae9d90eef8dc06307ad46972.exe cmd.exe PID 1600 wrote to memory of 304 1600 f33ba83b791e93de63f6bcd2a96366e66c1ff9a4ae9d90eef8dc06307ad46972.exe cmd.exe PID 1600 wrote to memory of 304 1600 f33ba83b791e93de63f6bcd2a96366e66c1ff9a4ae9d90eef8dc06307ad46972.exe cmd.exe PID 1600 wrote to memory of 304 1600 f33ba83b791e93de63f6bcd2a96366e66c1ff9a4ae9d90eef8dc06307ad46972.exe cmd.exe PID 304 wrote to memory of 740 304 cmd.exe takeown.exe PID 304 wrote to memory of 740 304 cmd.exe takeown.exe PID 304 wrote to memory of 740 304 cmd.exe takeown.exe PID 304 wrote to memory of 740 304 cmd.exe takeown.exe PID 304 wrote to memory of 2028 304 cmd.exe icacls.exe PID 304 wrote to memory of 2028 304 cmd.exe icacls.exe PID 304 wrote to memory of 2028 304 cmd.exe icacls.exe PID 304 wrote to memory of 2028 304 cmd.exe icacls.exe PID 1600 wrote to memory of 1096 1600 f33ba83b791e93de63f6bcd2a96366e66c1ff9a4ae9d90eef8dc06307ad46972.exe cmd.exe PID 1600 wrote to memory of 1096 1600 f33ba83b791e93de63f6bcd2a96366e66c1ff9a4ae9d90eef8dc06307ad46972.exe cmd.exe PID 1600 wrote to memory of 1096 1600 f33ba83b791e93de63f6bcd2a96366e66c1ff9a4ae9d90eef8dc06307ad46972.exe cmd.exe PID 1600 wrote to memory of 1096 1600 f33ba83b791e93de63f6bcd2a96366e66c1ff9a4ae9d90eef8dc06307ad46972.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f33ba83b791e93de63f6bcd2a96366e66c1ff9a4ae9d90eef8dc06307ad46972.exe"C:\Users\Admin\AppData\Local\Temp\f33ba83b791e93de63f6bcd2a96366e66c1ff9a4ae9d90eef8dc06307ad46972.exe"1⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /c takeown /f C:\Windows\SysWOW64\wshtcpip.dll && icacls C:\Windows\SysWOW64\wshtcpip.dll /grant administrators:F2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\SysWOW64\wshtcpip.dll3⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\icacls.exeicacls C:\Windows\SysWOW64\wshtcpip.dll /grant administrators:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\ahnmove.bat2⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\ahnmove.batFilesize
181B
MD54b2860d3344b5d23cc88f405cdc1c880
SHA130304e23db627527e47f5afd04745b1e98cf103e
SHA25607973b6c4bda7ad8a2fb271c9d3573eed7c88f022a5a64621ae2d1a627385b75
SHA512279b4c7e0f953764904f47915c6d7ee6320d933da538e40de0459200d70943df21f35b798675d4a76d1d8f29448e954d4b88e9d5304c98dbc279870ebe8ffe80
-
memory/304-56-0x0000000000000000-mapping.dmp
-
memory/740-57-0x0000000000000000-mapping.dmp
-
memory/1096-59-0x0000000000000000-mapping.dmp
-
memory/1600-54-0x0000000076461000-0x0000000076463000-memory.dmpFilesize
8KB
-
memory/1600-55-0x0000000001000000-0x000000000112D000-memory.dmpFilesize
1.2MB
-
memory/1600-60-0x0000000001000000-0x000000000112D000-memory.dmpFilesize
1.2MB
-
memory/2028-58-0x0000000000000000-mapping.dmp