Analysis
-
max time kernel
64s -
max time network
50s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
02-10-2022 23:09
Behavioral task
behavioral1
Sample
bd64fd55ecda8e48bfa8e6960c9918093c397ae7ad69e16e71335d29643489e7.exe
Resource
win7-20220812-en
General
-
Target
bd64fd55ecda8e48bfa8e6960c9918093c397ae7ad69e16e71335d29643489e7.exe
-
Size
350KB
-
MD5
59ace1765d1631be6d029db96725eb60
-
SHA1
94013b52a4c9509a97a6d81c7915445f36bf2471
-
SHA256
bd64fd55ecda8e48bfa8e6960c9918093c397ae7ad69e16e71335d29643489e7
-
SHA512
e9935fa476061b53f643e0dd4bb8cb16fb9476aa7419758bb3ca7b6eb49f4da58dcf21338344317bc9f4d4fd6086abfadcc19bfc62bdca94ef04e1a439ad2d9f
-
SSDEEP
6144:YyXu7IEBSsQ9ElMwm60lmqs7MTRGA3h3GVqdppJXEGhBukJF/KAwxFUOWdEmh:Y3BdQLL4BE93NGVYZX9BukJlwxSJdEm
Malware Config
Signatures
-
Drops file in Drivers directory 2 IoCs
Processes:
bd64fd55ecda8e48bfa8e6960c9918093c397ae7ad69e16e71335d29643489e7.exedescription ioc process File created C:\Windows\SysWOW64\drivers\13c06e7f.sys bd64fd55ecda8e48bfa8e6960c9918093c397ae7ad69e16e71335d29643489e7.exe File created C:\Windows\SysWOW64\drivers\6f6b5bf9.sys bd64fd55ecda8e48bfa8e6960c9918093c397ae7ad69e16e71335d29643489e7.exe -
Possible privilege escalation attempt 2 IoCs
Processes:
icacls.exetakeown.exepid process 944 icacls.exe 1012 takeown.exe -
Sets service image path in registry 2 TTPs 2 IoCs
Processes:
bd64fd55ecda8e48bfa8e6960c9918093c397ae7ad69e16e71335d29643489e7.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\13c06e7f\ImagePath = "\\??\\C:\\Windows\\SysWOW64\\drivers\\13c06e7f.sys" bd64fd55ecda8e48bfa8e6960c9918093c397ae7ad69e16e71335d29643489e7.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\6f6b5bf9\ImagePath = "\\??\\C:\\Windows\\SysWOW64\\drivers\\6f6b5bf9.sys" bd64fd55ecda8e48bfa8e6960c9918093c397ae7ad69e16e71335d29643489e7.exe -
Processes:
resource yara_rule behavioral1/memory/1452-55-0x0000000001000000-0x000000000112D000-memory.dmp upx behavioral1/memory/1452-56-0x0000000001000000-0x000000000112D000-memory.dmp upx behavioral1/memory/1452-61-0x0000000001000000-0x000000000112D000-memory.dmp upx -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1800 cmd.exe -
Modifies file permissions 1 TTPs 2 IoCs
Processes:
takeown.exeicacls.exepid process 1012 takeown.exe 944 icacls.exe -
Installs/modifies Browser Helper Object 2 TTPs 4 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
Processes:
bd64fd55ecda8e48bfa8e6960c9918093c397ae7ad69e16e71335d29643489e7.exedescription ioc process Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF} bd64fd55ecda8e48bfa8e6960c9918093c397ae7ad69e16e71335d29643489e7.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E} bd64fd55ecda8e48bfa8e6960c9918093c397ae7ad69e16e71335d29643489e7.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3} bd64fd55ecda8e48bfa8e6960c9918093c397ae7ad69e16e71335d29643489e7.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects bd64fd55ecda8e48bfa8e6960c9918093c397ae7ad69e16e71335d29643489e7.exe -
Drops file in System32 directory 5 IoCs
Processes:
bd64fd55ecda8e48bfa8e6960c9918093c397ae7ad69e16e71335d29643489e7.exedescription ioc process File created C:\Windows\SysWOW64\goodsb.dll bd64fd55ecda8e48bfa8e6960c9918093c397ae7ad69e16e71335d29643489e7.exe File created C:\Windows\SysWOW64\ws2tcpip.dll bd64fd55ecda8e48bfa8e6960c9918093c397ae7ad69e16e71335d29643489e7.exe File opened for modification C:\Windows\SysWOW64\ws2tcpip.dll bd64fd55ecda8e48bfa8e6960c9918093c397ae7ad69e16e71335d29643489e7.exe File created C:\Windows\SysWOW64\wshtcpip.dll bd64fd55ecda8e48bfa8e6960c9918093c397ae7ad69e16e71335d29643489e7.exe File opened for modification C:\Windows\SysWOW64\goodsb.dll bd64fd55ecda8e48bfa8e6960c9918093c397ae7ad69e16e71335d29643489e7.exe -
Modifies registry class 4 IoCs
Processes:
bd64fd55ecda8e48bfa8e6960c9918093c397ae7ad69e16e71335d29643489e7.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\HOOK_ID bd64fd55ecda8e48bfa8e6960c9918093c397ae7ad69e16e71335d29643489e7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\HOOK_ID\name = "bd64fd55ecda8e48bfa8e6960c9918093c397ae7ad69e16e71335d29643489e7.exe" bd64fd55ecda8e48bfa8e6960c9918093c397ae7ad69e16e71335d29643489e7.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\SYS_DLL bd64fd55ecda8e48bfa8e6960c9918093c397ae7ad69e16e71335d29643489e7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\SYS_DLL\name = "idn.dll" bd64fd55ecda8e48bfa8e6960c9918093c397ae7ad69e16e71335d29643489e7.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
bd64fd55ecda8e48bfa8e6960c9918093c397ae7ad69e16e71335d29643489e7.exepid process 1452 bd64fd55ecda8e48bfa8e6960c9918093c397ae7ad69e16e71335d29643489e7.exe 1452 bd64fd55ecda8e48bfa8e6960c9918093c397ae7ad69e16e71335d29643489e7.exe 1452 bd64fd55ecda8e48bfa8e6960c9918093c397ae7ad69e16e71335d29643489e7.exe 1452 bd64fd55ecda8e48bfa8e6960c9918093c397ae7ad69e16e71335d29643489e7.exe 1452 bd64fd55ecda8e48bfa8e6960c9918093c397ae7ad69e16e71335d29643489e7.exe 1452 bd64fd55ecda8e48bfa8e6960c9918093c397ae7ad69e16e71335d29643489e7.exe 1452 bd64fd55ecda8e48bfa8e6960c9918093c397ae7ad69e16e71335d29643489e7.exe 1452 bd64fd55ecda8e48bfa8e6960c9918093c397ae7ad69e16e71335d29643489e7.exe 1452 bd64fd55ecda8e48bfa8e6960c9918093c397ae7ad69e16e71335d29643489e7.exe 1452 bd64fd55ecda8e48bfa8e6960c9918093c397ae7ad69e16e71335d29643489e7.exe 1452 bd64fd55ecda8e48bfa8e6960c9918093c397ae7ad69e16e71335d29643489e7.exe 1452 bd64fd55ecda8e48bfa8e6960c9918093c397ae7ad69e16e71335d29643489e7.exe 1452 bd64fd55ecda8e48bfa8e6960c9918093c397ae7ad69e16e71335d29643489e7.exe 1452 bd64fd55ecda8e48bfa8e6960c9918093c397ae7ad69e16e71335d29643489e7.exe 1452 bd64fd55ecda8e48bfa8e6960c9918093c397ae7ad69e16e71335d29643489e7.exe 1452 bd64fd55ecda8e48bfa8e6960c9918093c397ae7ad69e16e71335d29643489e7.exe 1452 bd64fd55ecda8e48bfa8e6960c9918093c397ae7ad69e16e71335d29643489e7.exe 1452 bd64fd55ecda8e48bfa8e6960c9918093c397ae7ad69e16e71335d29643489e7.exe 1452 bd64fd55ecda8e48bfa8e6960c9918093c397ae7ad69e16e71335d29643489e7.exe 1452 bd64fd55ecda8e48bfa8e6960c9918093c397ae7ad69e16e71335d29643489e7.exe 1452 bd64fd55ecda8e48bfa8e6960c9918093c397ae7ad69e16e71335d29643489e7.exe 1452 bd64fd55ecda8e48bfa8e6960c9918093c397ae7ad69e16e71335d29643489e7.exe 1452 bd64fd55ecda8e48bfa8e6960c9918093c397ae7ad69e16e71335d29643489e7.exe 1452 bd64fd55ecda8e48bfa8e6960c9918093c397ae7ad69e16e71335d29643489e7.exe 1452 bd64fd55ecda8e48bfa8e6960c9918093c397ae7ad69e16e71335d29643489e7.exe 1452 bd64fd55ecda8e48bfa8e6960c9918093c397ae7ad69e16e71335d29643489e7.exe 1452 bd64fd55ecda8e48bfa8e6960c9918093c397ae7ad69e16e71335d29643489e7.exe 1452 bd64fd55ecda8e48bfa8e6960c9918093c397ae7ad69e16e71335d29643489e7.exe 1452 bd64fd55ecda8e48bfa8e6960c9918093c397ae7ad69e16e71335d29643489e7.exe 1452 bd64fd55ecda8e48bfa8e6960c9918093c397ae7ad69e16e71335d29643489e7.exe 1452 bd64fd55ecda8e48bfa8e6960c9918093c397ae7ad69e16e71335d29643489e7.exe 1452 bd64fd55ecda8e48bfa8e6960c9918093c397ae7ad69e16e71335d29643489e7.exe 1452 bd64fd55ecda8e48bfa8e6960c9918093c397ae7ad69e16e71335d29643489e7.exe 1452 bd64fd55ecda8e48bfa8e6960c9918093c397ae7ad69e16e71335d29643489e7.exe 1452 bd64fd55ecda8e48bfa8e6960c9918093c397ae7ad69e16e71335d29643489e7.exe 1452 bd64fd55ecda8e48bfa8e6960c9918093c397ae7ad69e16e71335d29643489e7.exe 1452 bd64fd55ecda8e48bfa8e6960c9918093c397ae7ad69e16e71335d29643489e7.exe 1452 bd64fd55ecda8e48bfa8e6960c9918093c397ae7ad69e16e71335d29643489e7.exe 1452 bd64fd55ecda8e48bfa8e6960c9918093c397ae7ad69e16e71335d29643489e7.exe 1452 bd64fd55ecda8e48bfa8e6960c9918093c397ae7ad69e16e71335d29643489e7.exe 1452 bd64fd55ecda8e48bfa8e6960c9918093c397ae7ad69e16e71335d29643489e7.exe 1452 bd64fd55ecda8e48bfa8e6960c9918093c397ae7ad69e16e71335d29643489e7.exe 1452 bd64fd55ecda8e48bfa8e6960c9918093c397ae7ad69e16e71335d29643489e7.exe 1452 bd64fd55ecda8e48bfa8e6960c9918093c397ae7ad69e16e71335d29643489e7.exe 1452 bd64fd55ecda8e48bfa8e6960c9918093c397ae7ad69e16e71335d29643489e7.exe 1452 bd64fd55ecda8e48bfa8e6960c9918093c397ae7ad69e16e71335d29643489e7.exe 1452 bd64fd55ecda8e48bfa8e6960c9918093c397ae7ad69e16e71335d29643489e7.exe 1452 bd64fd55ecda8e48bfa8e6960c9918093c397ae7ad69e16e71335d29643489e7.exe 1452 bd64fd55ecda8e48bfa8e6960c9918093c397ae7ad69e16e71335d29643489e7.exe 1452 bd64fd55ecda8e48bfa8e6960c9918093c397ae7ad69e16e71335d29643489e7.exe 1452 bd64fd55ecda8e48bfa8e6960c9918093c397ae7ad69e16e71335d29643489e7.exe 1452 bd64fd55ecda8e48bfa8e6960c9918093c397ae7ad69e16e71335d29643489e7.exe 1452 bd64fd55ecda8e48bfa8e6960c9918093c397ae7ad69e16e71335d29643489e7.exe 1452 bd64fd55ecda8e48bfa8e6960c9918093c397ae7ad69e16e71335d29643489e7.exe 1452 bd64fd55ecda8e48bfa8e6960c9918093c397ae7ad69e16e71335d29643489e7.exe 1452 bd64fd55ecda8e48bfa8e6960c9918093c397ae7ad69e16e71335d29643489e7.exe 1452 bd64fd55ecda8e48bfa8e6960c9918093c397ae7ad69e16e71335d29643489e7.exe 1452 bd64fd55ecda8e48bfa8e6960c9918093c397ae7ad69e16e71335d29643489e7.exe 1452 bd64fd55ecda8e48bfa8e6960c9918093c397ae7ad69e16e71335d29643489e7.exe 1452 bd64fd55ecda8e48bfa8e6960c9918093c397ae7ad69e16e71335d29643489e7.exe 1452 bd64fd55ecda8e48bfa8e6960c9918093c397ae7ad69e16e71335d29643489e7.exe 1452 bd64fd55ecda8e48bfa8e6960c9918093c397ae7ad69e16e71335d29643489e7.exe 1452 bd64fd55ecda8e48bfa8e6960c9918093c397ae7ad69e16e71335d29643489e7.exe 1452 bd64fd55ecda8e48bfa8e6960c9918093c397ae7ad69e16e71335d29643489e7.exe -
Suspicious behavior: LoadsDriver 5 IoCs
Processes:
bd64fd55ecda8e48bfa8e6960c9918093c397ae7ad69e16e71335d29643489e7.exepid process 468 1452 bd64fd55ecda8e48bfa8e6960c9918093c397ae7ad69e16e71335d29643489e7.exe 468 1452 bd64fd55ecda8e48bfa8e6960c9918093c397ae7ad69e16e71335d29643489e7.exe 1452 bd64fd55ecda8e48bfa8e6960c9918093c397ae7ad69e16e71335d29643489e7.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
bd64fd55ecda8e48bfa8e6960c9918093c397ae7ad69e16e71335d29643489e7.exetakeown.exedescription pid process Token: SeDebugPrivilege 1452 bd64fd55ecda8e48bfa8e6960c9918093c397ae7ad69e16e71335d29643489e7.exe Token: SeTakeOwnershipPrivilege 1012 takeown.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
bd64fd55ecda8e48bfa8e6960c9918093c397ae7ad69e16e71335d29643489e7.execmd.exedescription pid process target process PID 1452 wrote to memory of 1188 1452 bd64fd55ecda8e48bfa8e6960c9918093c397ae7ad69e16e71335d29643489e7.exe cmd.exe PID 1452 wrote to memory of 1188 1452 bd64fd55ecda8e48bfa8e6960c9918093c397ae7ad69e16e71335d29643489e7.exe cmd.exe PID 1452 wrote to memory of 1188 1452 bd64fd55ecda8e48bfa8e6960c9918093c397ae7ad69e16e71335d29643489e7.exe cmd.exe PID 1452 wrote to memory of 1188 1452 bd64fd55ecda8e48bfa8e6960c9918093c397ae7ad69e16e71335d29643489e7.exe cmd.exe PID 1188 wrote to memory of 1012 1188 cmd.exe takeown.exe PID 1188 wrote to memory of 1012 1188 cmd.exe takeown.exe PID 1188 wrote to memory of 1012 1188 cmd.exe takeown.exe PID 1188 wrote to memory of 1012 1188 cmd.exe takeown.exe PID 1188 wrote to memory of 944 1188 cmd.exe icacls.exe PID 1188 wrote to memory of 944 1188 cmd.exe icacls.exe PID 1188 wrote to memory of 944 1188 cmd.exe icacls.exe PID 1188 wrote to memory of 944 1188 cmd.exe icacls.exe PID 1452 wrote to memory of 1800 1452 bd64fd55ecda8e48bfa8e6960c9918093c397ae7ad69e16e71335d29643489e7.exe cmd.exe PID 1452 wrote to memory of 1800 1452 bd64fd55ecda8e48bfa8e6960c9918093c397ae7ad69e16e71335d29643489e7.exe cmd.exe PID 1452 wrote to memory of 1800 1452 bd64fd55ecda8e48bfa8e6960c9918093c397ae7ad69e16e71335d29643489e7.exe cmd.exe PID 1452 wrote to memory of 1800 1452 bd64fd55ecda8e48bfa8e6960c9918093c397ae7ad69e16e71335d29643489e7.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bd64fd55ecda8e48bfa8e6960c9918093c397ae7ad69e16e71335d29643489e7.exe"C:\Users\Admin\AppData\Local\Temp\bd64fd55ecda8e48bfa8e6960c9918093c397ae7ad69e16e71335d29643489e7.exe"1⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /c takeown /f C:\Windows\SysWOW64\wshtcpip.dll && icacls C:\Windows\SysWOW64\wshtcpip.dll /grant administrators:F2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\SysWOW64\wshtcpip.dll3⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\icacls.exeicacls C:\Windows\SysWOW64\wshtcpip.dll /grant administrators:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\ahnmove.bat2⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\ahnmove.batFilesize
181B
MD586f243582c0e83c46615ac599d55ca44
SHA14816252b2fb6775945c8786f4c14b24f3d682aeb
SHA2568fc7b1e45b8339a2a8324628122273f96fc684f19296a591261ece9a5ed93855
SHA5123efa785ed42061cea1be0980b40ca99e569afb50883c90293411566fb73f3864c654e86dbb269b77de4894eb9705d09a5b546bfbb10e9e886c44fc3676a0a5a0
-
memory/944-59-0x0000000000000000-mapping.dmp
-
memory/1012-58-0x0000000000000000-mapping.dmp
-
memory/1188-57-0x0000000000000000-mapping.dmp
-
memory/1452-54-0x0000000075041000-0x0000000075043000-memory.dmpFilesize
8KB
-
memory/1452-55-0x0000000001000000-0x000000000112D000-memory.dmpFilesize
1.2MB
-
memory/1452-56-0x0000000001000000-0x000000000112D000-memory.dmpFilesize
1.2MB
-
memory/1452-61-0x0000000001000000-0x000000000112D000-memory.dmpFilesize
1.2MB
-
memory/1800-60-0x0000000000000000-mapping.dmp