Analysis
-
max time kernel
62s -
max time network
53s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
02-10-2022 23:09
Behavioral task
behavioral1
Sample
96378dc27af88a1fd79c47f0ed4c48937a61ef0171d4d8b0477b204c6fc6391f.exe
Resource
win7-20220812-en
General
-
Target
96378dc27af88a1fd79c47f0ed4c48937a61ef0171d4d8b0477b204c6fc6391f.exe
-
Size
350KB
-
MD5
706ad4b575fe2ddf15af1f7436459530
-
SHA1
8a47c755d727b3659ad45f159c6c02ef3e2d3f03
-
SHA256
96378dc27af88a1fd79c47f0ed4c48937a61ef0171d4d8b0477b204c6fc6391f
-
SHA512
565e325aaa708620c2207cb9bd523e5be4e21a449fafdb697a2822ba1350ffa0b60b42ab05f84a6f175a1a7d4cf33dbaf7828cfa1f902962e5e74b8416047ad4
-
SSDEEP
6144:GyXu7IEBSsQ9ElMwm60lmqs7MTRGA3h3GVqdppJXEGhBukJF/KAwxFUOWdEmh:G3BdQLL4BE93NGVYZX9BukJlwxSJdEm
Malware Config
Signatures
-
Drops file in Drivers directory 2 IoCs
Processes:
96378dc27af88a1fd79c47f0ed4c48937a61ef0171d4d8b0477b204c6fc6391f.exedescription ioc process File created C:\Windows\SysWOW64\drivers\5249a5e9.sys 96378dc27af88a1fd79c47f0ed4c48937a61ef0171d4d8b0477b204c6fc6391f.exe File created C:\Windows\SysWOW64\drivers\2ee2906f.sys 96378dc27af88a1fd79c47f0ed4c48937a61ef0171d4d8b0477b204c6fc6391f.exe -
Possible privilege escalation attempt 2 IoCs
Processes:
takeown.exeicacls.exepid process 1752 takeown.exe 1652 icacls.exe -
Sets service image path in registry 2 TTPs 2 IoCs
Processes:
96378dc27af88a1fd79c47f0ed4c48937a61ef0171d4d8b0477b204c6fc6391f.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\5249a5e9\ImagePath = "\\??\\C:\\Windows\\SysWOW64\\drivers\\5249a5e9.sys" 96378dc27af88a1fd79c47f0ed4c48937a61ef0171d4d8b0477b204c6fc6391f.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\2ee2906f\ImagePath = "\\??\\C:\\Windows\\SysWOW64\\drivers\\2ee2906f.sys" 96378dc27af88a1fd79c47f0ed4c48937a61ef0171d4d8b0477b204c6fc6391f.exe -
Processes:
resource yara_rule behavioral1/memory/1348-55-0x0000000001000000-0x000000000112D000-memory.dmp upx behavioral1/memory/1348-56-0x0000000001000000-0x000000000112D000-memory.dmp upx behavioral1/memory/1348-61-0x0000000001000000-0x000000000112D000-memory.dmp upx -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 552 cmd.exe -
Modifies file permissions 1 TTPs 2 IoCs
Processes:
takeown.exeicacls.exepid process 1752 takeown.exe 1652 icacls.exe -
Installs/modifies Browser Helper Object 2 TTPs 4 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
Processes:
96378dc27af88a1fd79c47f0ed4c48937a61ef0171d4d8b0477b204c6fc6391f.exedescription ioc process Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects 96378dc27af88a1fd79c47f0ed4c48937a61ef0171d4d8b0477b204c6fc6391f.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF} 96378dc27af88a1fd79c47f0ed4c48937a61ef0171d4d8b0477b204c6fc6391f.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E} 96378dc27af88a1fd79c47f0ed4c48937a61ef0171d4d8b0477b204c6fc6391f.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3} 96378dc27af88a1fd79c47f0ed4c48937a61ef0171d4d8b0477b204c6fc6391f.exe -
Drops file in System32 directory 5 IoCs
Processes:
96378dc27af88a1fd79c47f0ed4c48937a61ef0171d4d8b0477b204c6fc6391f.exedescription ioc process File opened for modification C:\Windows\SysWOW64\goodsb.dll 96378dc27af88a1fd79c47f0ed4c48937a61ef0171d4d8b0477b204c6fc6391f.exe File created C:\Windows\SysWOW64\goodsb.dll 96378dc27af88a1fd79c47f0ed4c48937a61ef0171d4d8b0477b204c6fc6391f.exe File created C:\Windows\SysWOW64\ws2tcpip.dll 96378dc27af88a1fd79c47f0ed4c48937a61ef0171d4d8b0477b204c6fc6391f.exe File opened for modification C:\Windows\SysWOW64\ws2tcpip.dll 96378dc27af88a1fd79c47f0ed4c48937a61ef0171d4d8b0477b204c6fc6391f.exe File created C:\Windows\SysWOW64\wshtcpip.dll 96378dc27af88a1fd79c47f0ed4c48937a61ef0171d4d8b0477b204c6fc6391f.exe -
Modifies registry class 4 IoCs
Processes:
96378dc27af88a1fd79c47f0ed4c48937a61ef0171d4d8b0477b204c6fc6391f.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\HOOK_ID 96378dc27af88a1fd79c47f0ed4c48937a61ef0171d4d8b0477b204c6fc6391f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\HOOK_ID\name = "96378dc27af88a1fd79c47f0ed4c48937a61ef0171d4d8b0477b204c6fc6391f.exe" 96378dc27af88a1fd79c47f0ed4c48937a61ef0171d4d8b0477b204c6fc6391f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\SYS_DLL 96378dc27af88a1fd79c47f0ed4c48937a61ef0171d4d8b0477b204c6fc6391f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\SYS_DLL\name = "gqjfu.dll" 96378dc27af88a1fd79c47f0ed4c48937a61ef0171d4d8b0477b204c6fc6391f.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
96378dc27af88a1fd79c47f0ed4c48937a61ef0171d4d8b0477b204c6fc6391f.exepid process 1348 96378dc27af88a1fd79c47f0ed4c48937a61ef0171d4d8b0477b204c6fc6391f.exe 1348 96378dc27af88a1fd79c47f0ed4c48937a61ef0171d4d8b0477b204c6fc6391f.exe 1348 96378dc27af88a1fd79c47f0ed4c48937a61ef0171d4d8b0477b204c6fc6391f.exe 1348 96378dc27af88a1fd79c47f0ed4c48937a61ef0171d4d8b0477b204c6fc6391f.exe 1348 96378dc27af88a1fd79c47f0ed4c48937a61ef0171d4d8b0477b204c6fc6391f.exe 1348 96378dc27af88a1fd79c47f0ed4c48937a61ef0171d4d8b0477b204c6fc6391f.exe 1348 96378dc27af88a1fd79c47f0ed4c48937a61ef0171d4d8b0477b204c6fc6391f.exe 1348 96378dc27af88a1fd79c47f0ed4c48937a61ef0171d4d8b0477b204c6fc6391f.exe 1348 96378dc27af88a1fd79c47f0ed4c48937a61ef0171d4d8b0477b204c6fc6391f.exe 1348 96378dc27af88a1fd79c47f0ed4c48937a61ef0171d4d8b0477b204c6fc6391f.exe 1348 96378dc27af88a1fd79c47f0ed4c48937a61ef0171d4d8b0477b204c6fc6391f.exe 1348 96378dc27af88a1fd79c47f0ed4c48937a61ef0171d4d8b0477b204c6fc6391f.exe 1348 96378dc27af88a1fd79c47f0ed4c48937a61ef0171d4d8b0477b204c6fc6391f.exe 1348 96378dc27af88a1fd79c47f0ed4c48937a61ef0171d4d8b0477b204c6fc6391f.exe 1348 96378dc27af88a1fd79c47f0ed4c48937a61ef0171d4d8b0477b204c6fc6391f.exe 1348 96378dc27af88a1fd79c47f0ed4c48937a61ef0171d4d8b0477b204c6fc6391f.exe 1348 96378dc27af88a1fd79c47f0ed4c48937a61ef0171d4d8b0477b204c6fc6391f.exe 1348 96378dc27af88a1fd79c47f0ed4c48937a61ef0171d4d8b0477b204c6fc6391f.exe 1348 96378dc27af88a1fd79c47f0ed4c48937a61ef0171d4d8b0477b204c6fc6391f.exe 1348 96378dc27af88a1fd79c47f0ed4c48937a61ef0171d4d8b0477b204c6fc6391f.exe 1348 96378dc27af88a1fd79c47f0ed4c48937a61ef0171d4d8b0477b204c6fc6391f.exe 1348 96378dc27af88a1fd79c47f0ed4c48937a61ef0171d4d8b0477b204c6fc6391f.exe 1348 96378dc27af88a1fd79c47f0ed4c48937a61ef0171d4d8b0477b204c6fc6391f.exe 1348 96378dc27af88a1fd79c47f0ed4c48937a61ef0171d4d8b0477b204c6fc6391f.exe 1348 96378dc27af88a1fd79c47f0ed4c48937a61ef0171d4d8b0477b204c6fc6391f.exe 1348 96378dc27af88a1fd79c47f0ed4c48937a61ef0171d4d8b0477b204c6fc6391f.exe 1348 96378dc27af88a1fd79c47f0ed4c48937a61ef0171d4d8b0477b204c6fc6391f.exe 1348 96378dc27af88a1fd79c47f0ed4c48937a61ef0171d4d8b0477b204c6fc6391f.exe 1348 96378dc27af88a1fd79c47f0ed4c48937a61ef0171d4d8b0477b204c6fc6391f.exe 1348 96378dc27af88a1fd79c47f0ed4c48937a61ef0171d4d8b0477b204c6fc6391f.exe 1348 96378dc27af88a1fd79c47f0ed4c48937a61ef0171d4d8b0477b204c6fc6391f.exe 1348 96378dc27af88a1fd79c47f0ed4c48937a61ef0171d4d8b0477b204c6fc6391f.exe 1348 96378dc27af88a1fd79c47f0ed4c48937a61ef0171d4d8b0477b204c6fc6391f.exe 1348 96378dc27af88a1fd79c47f0ed4c48937a61ef0171d4d8b0477b204c6fc6391f.exe 1348 96378dc27af88a1fd79c47f0ed4c48937a61ef0171d4d8b0477b204c6fc6391f.exe 1348 96378dc27af88a1fd79c47f0ed4c48937a61ef0171d4d8b0477b204c6fc6391f.exe 1348 96378dc27af88a1fd79c47f0ed4c48937a61ef0171d4d8b0477b204c6fc6391f.exe 1348 96378dc27af88a1fd79c47f0ed4c48937a61ef0171d4d8b0477b204c6fc6391f.exe 1348 96378dc27af88a1fd79c47f0ed4c48937a61ef0171d4d8b0477b204c6fc6391f.exe 1348 96378dc27af88a1fd79c47f0ed4c48937a61ef0171d4d8b0477b204c6fc6391f.exe 1348 96378dc27af88a1fd79c47f0ed4c48937a61ef0171d4d8b0477b204c6fc6391f.exe 1348 96378dc27af88a1fd79c47f0ed4c48937a61ef0171d4d8b0477b204c6fc6391f.exe 1348 96378dc27af88a1fd79c47f0ed4c48937a61ef0171d4d8b0477b204c6fc6391f.exe 1348 96378dc27af88a1fd79c47f0ed4c48937a61ef0171d4d8b0477b204c6fc6391f.exe 1348 96378dc27af88a1fd79c47f0ed4c48937a61ef0171d4d8b0477b204c6fc6391f.exe 1348 96378dc27af88a1fd79c47f0ed4c48937a61ef0171d4d8b0477b204c6fc6391f.exe 1348 96378dc27af88a1fd79c47f0ed4c48937a61ef0171d4d8b0477b204c6fc6391f.exe 1348 96378dc27af88a1fd79c47f0ed4c48937a61ef0171d4d8b0477b204c6fc6391f.exe 1348 96378dc27af88a1fd79c47f0ed4c48937a61ef0171d4d8b0477b204c6fc6391f.exe 1348 96378dc27af88a1fd79c47f0ed4c48937a61ef0171d4d8b0477b204c6fc6391f.exe 1348 96378dc27af88a1fd79c47f0ed4c48937a61ef0171d4d8b0477b204c6fc6391f.exe 1348 96378dc27af88a1fd79c47f0ed4c48937a61ef0171d4d8b0477b204c6fc6391f.exe 1348 96378dc27af88a1fd79c47f0ed4c48937a61ef0171d4d8b0477b204c6fc6391f.exe 1348 96378dc27af88a1fd79c47f0ed4c48937a61ef0171d4d8b0477b204c6fc6391f.exe 1348 96378dc27af88a1fd79c47f0ed4c48937a61ef0171d4d8b0477b204c6fc6391f.exe 1348 96378dc27af88a1fd79c47f0ed4c48937a61ef0171d4d8b0477b204c6fc6391f.exe 1348 96378dc27af88a1fd79c47f0ed4c48937a61ef0171d4d8b0477b204c6fc6391f.exe 1348 96378dc27af88a1fd79c47f0ed4c48937a61ef0171d4d8b0477b204c6fc6391f.exe 1348 96378dc27af88a1fd79c47f0ed4c48937a61ef0171d4d8b0477b204c6fc6391f.exe 1348 96378dc27af88a1fd79c47f0ed4c48937a61ef0171d4d8b0477b204c6fc6391f.exe 1348 96378dc27af88a1fd79c47f0ed4c48937a61ef0171d4d8b0477b204c6fc6391f.exe 1348 96378dc27af88a1fd79c47f0ed4c48937a61ef0171d4d8b0477b204c6fc6391f.exe 1348 96378dc27af88a1fd79c47f0ed4c48937a61ef0171d4d8b0477b204c6fc6391f.exe 1348 96378dc27af88a1fd79c47f0ed4c48937a61ef0171d4d8b0477b204c6fc6391f.exe -
Suspicious behavior: LoadsDriver 5 IoCs
Processes:
96378dc27af88a1fd79c47f0ed4c48937a61ef0171d4d8b0477b204c6fc6391f.exepid process 464 1348 96378dc27af88a1fd79c47f0ed4c48937a61ef0171d4d8b0477b204c6fc6391f.exe 464 1348 96378dc27af88a1fd79c47f0ed4c48937a61ef0171d4d8b0477b204c6fc6391f.exe 1348 96378dc27af88a1fd79c47f0ed4c48937a61ef0171d4d8b0477b204c6fc6391f.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
96378dc27af88a1fd79c47f0ed4c48937a61ef0171d4d8b0477b204c6fc6391f.exetakeown.exedescription pid process Token: SeDebugPrivilege 1348 96378dc27af88a1fd79c47f0ed4c48937a61ef0171d4d8b0477b204c6fc6391f.exe Token: SeTakeOwnershipPrivilege 1752 takeown.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
96378dc27af88a1fd79c47f0ed4c48937a61ef0171d4d8b0477b204c6fc6391f.execmd.exedescription pid process target process PID 1348 wrote to memory of 1784 1348 96378dc27af88a1fd79c47f0ed4c48937a61ef0171d4d8b0477b204c6fc6391f.exe cmd.exe PID 1348 wrote to memory of 1784 1348 96378dc27af88a1fd79c47f0ed4c48937a61ef0171d4d8b0477b204c6fc6391f.exe cmd.exe PID 1348 wrote to memory of 1784 1348 96378dc27af88a1fd79c47f0ed4c48937a61ef0171d4d8b0477b204c6fc6391f.exe cmd.exe PID 1348 wrote to memory of 1784 1348 96378dc27af88a1fd79c47f0ed4c48937a61ef0171d4d8b0477b204c6fc6391f.exe cmd.exe PID 1784 wrote to memory of 1752 1784 cmd.exe takeown.exe PID 1784 wrote to memory of 1752 1784 cmd.exe takeown.exe PID 1784 wrote to memory of 1752 1784 cmd.exe takeown.exe PID 1784 wrote to memory of 1752 1784 cmd.exe takeown.exe PID 1784 wrote to memory of 1652 1784 cmd.exe icacls.exe PID 1784 wrote to memory of 1652 1784 cmd.exe icacls.exe PID 1784 wrote to memory of 1652 1784 cmd.exe icacls.exe PID 1784 wrote to memory of 1652 1784 cmd.exe icacls.exe PID 1348 wrote to memory of 552 1348 96378dc27af88a1fd79c47f0ed4c48937a61ef0171d4d8b0477b204c6fc6391f.exe cmd.exe PID 1348 wrote to memory of 552 1348 96378dc27af88a1fd79c47f0ed4c48937a61ef0171d4d8b0477b204c6fc6391f.exe cmd.exe PID 1348 wrote to memory of 552 1348 96378dc27af88a1fd79c47f0ed4c48937a61ef0171d4d8b0477b204c6fc6391f.exe cmd.exe PID 1348 wrote to memory of 552 1348 96378dc27af88a1fd79c47f0ed4c48937a61ef0171d4d8b0477b204c6fc6391f.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\96378dc27af88a1fd79c47f0ed4c48937a61ef0171d4d8b0477b204c6fc6391f.exe"C:\Users\Admin\AppData\Local\Temp\96378dc27af88a1fd79c47f0ed4c48937a61ef0171d4d8b0477b204c6fc6391f.exe"1⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /c takeown /f C:\Windows\SysWOW64\wshtcpip.dll && icacls C:\Windows\SysWOW64\wshtcpip.dll /grant administrators:F2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\SysWOW64\wshtcpip.dll3⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\icacls.exeicacls C:\Windows\SysWOW64\wshtcpip.dll /grant administrators:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\ahnmove.bat2⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\ahnmove.batFilesize
181B
MD57d29ff033138dc49c661f1e3e3ecb90c
SHA1ec9e8151ff50e97e25f85bc8f87f39d52c66901c
SHA2566d2085a8d0990c6722f79805aa37ecf24562f03e8047c1ae24fd02ae2646fc80
SHA512d961c1fde81dd671d1c674f0738bbd87c937f929d1553b307fffd53000f29a4895ecc1a4b90e28359eb23f9c015387de8a2daa0be94beac63338d39094b46d5c
-
memory/552-60-0x0000000000000000-mapping.dmp
-
memory/1348-54-0x00000000750A1000-0x00000000750A3000-memory.dmpFilesize
8KB
-
memory/1348-55-0x0000000001000000-0x000000000112D000-memory.dmpFilesize
1.2MB
-
memory/1348-56-0x0000000001000000-0x000000000112D000-memory.dmpFilesize
1.2MB
-
memory/1348-61-0x0000000001000000-0x000000000112D000-memory.dmpFilesize
1.2MB
-
memory/1652-59-0x0000000000000000-mapping.dmp
-
memory/1752-58-0x0000000000000000-mapping.dmp
-
memory/1784-57-0x0000000000000000-mapping.dmp