Analysis
-
max time kernel
109s -
max time network
87s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
03-10-2022 23:29
Behavioral task
behavioral1
Sample
2f29859842238227915905dbc0304f847612fd49a627299dd5ef4f736e0123ca.exe
Resource
win7-20220812-en
General
-
Target
2f29859842238227915905dbc0304f847612fd49a627299dd5ef4f736e0123ca.exe
-
Size
350KB
-
MD5
65ce1f1c6ad608931fbfaa01cc0cc030
-
SHA1
4d1f438c285c5c29fd866ba1f7f68cab8af93333
-
SHA256
2f29859842238227915905dbc0304f847612fd49a627299dd5ef4f736e0123ca
-
SHA512
5dc528ea4bd0398144cf1a6a4281c74bc43db6d42e4f8776e20f9096a1492d97b925a5f5441c305d0bf5de53f31771e6574af55ed6ed1bd288f7408131fbeee4
-
SSDEEP
6144:KyXu7IEBSsQ9ElMwm60lmqs7MTRGA3h3GVqdppJXEGhBukJF/KAwxFUOWdEmh:K3BdQLL4BE93NGVYZX9BukJlwxSJdEm
Malware Config
Signatures
-
Drops file in Drivers directory 2 IoCs
Processes:
2f29859842238227915905dbc0304f847612fd49a627299dd5ef4f736e0123ca.exedescription ioc process File created C:\Windows\SysWOW64\drivers\1b9fd590.sys 2f29859842238227915905dbc0304f847612fd49a627299dd5ef4f736e0123ca.exe File created C:\Windows\SysWOW64\drivers\6734e016.sys 2f29859842238227915905dbc0304f847612fd49a627299dd5ef4f736e0123ca.exe -
Possible privilege escalation attempt 2 IoCs
Processes:
takeown.exeicacls.exepid process 1760 takeown.exe 1488 icacls.exe -
Sets service image path in registry 2 TTPs 2 IoCs
Processes:
2f29859842238227915905dbc0304f847612fd49a627299dd5ef4f736e0123ca.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\1b9fd590\ImagePath = "\\??\\C:\\Windows\\SysWOW64\\drivers\\1b9fd590.sys" 2f29859842238227915905dbc0304f847612fd49a627299dd5ef4f736e0123ca.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\6734e016\ImagePath = "\\??\\C:\\Windows\\SysWOW64\\drivers\\6734e016.sys" 2f29859842238227915905dbc0304f847612fd49a627299dd5ef4f736e0123ca.exe -
Processes:
resource yara_rule behavioral1/memory/1776-54-0x0000000001000000-0x000000000112D000-memory.dmp upx behavioral1/memory/1776-56-0x0000000001000000-0x000000000112D000-memory.dmp upx behavioral1/memory/1776-61-0x0000000001000000-0x000000000112D000-memory.dmp upx -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 852 cmd.exe -
Modifies file permissions 1 TTPs 2 IoCs
Processes:
takeown.exeicacls.exepid process 1760 takeown.exe 1488 icacls.exe -
Installs/modifies Browser Helper Object 2 TTPs 4 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
Processes:
2f29859842238227915905dbc0304f847612fd49a627299dd5ef4f736e0123ca.exedescription ioc process Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3} 2f29859842238227915905dbc0304f847612fd49a627299dd5ef4f736e0123ca.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects 2f29859842238227915905dbc0304f847612fd49a627299dd5ef4f736e0123ca.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF} 2f29859842238227915905dbc0304f847612fd49a627299dd5ef4f736e0123ca.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E} 2f29859842238227915905dbc0304f847612fd49a627299dd5ef4f736e0123ca.exe -
Drops file in System32 directory 5 IoCs
Processes:
2f29859842238227915905dbc0304f847612fd49a627299dd5ef4f736e0123ca.exedescription ioc process File opened for modification C:\Windows\SysWOW64\goodsb.dll 2f29859842238227915905dbc0304f847612fd49a627299dd5ef4f736e0123ca.exe File created C:\Windows\SysWOW64\goodsb.dll 2f29859842238227915905dbc0304f847612fd49a627299dd5ef4f736e0123ca.exe File created C:\Windows\SysWOW64\ws2tcpip.dll 2f29859842238227915905dbc0304f847612fd49a627299dd5ef4f736e0123ca.exe File opened for modification C:\Windows\SysWOW64\ws2tcpip.dll 2f29859842238227915905dbc0304f847612fd49a627299dd5ef4f736e0123ca.exe File created C:\Windows\SysWOW64\wshtcpip.dll 2f29859842238227915905dbc0304f847612fd49a627299dd5ef4f736e0123ca.exe -
Modifies registry class 4 IoCs
Processes:
2f29859842238227915905dbc0304f847612fd49a627299dd5ef4f736e0123ca.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\SYS_DLL\name = "IudAqUw.dll" 2f29859842238227915905dbc0304f847612fd49a627299dd5ef4f736e0123ca.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\HOOK_ID 2f29859842238227915905dbc0304f847612fd49a627299dd5ef4f736e0123ca.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\HOOK_ID\name = "2f29859842238227915905dbc0304f847612fd49a627299dd5ef4f736e0123ca.exe" 2f29859842238227915905dbc0304f847612fd49a627299dd5ef4f736e0123ca.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\SYS_DLL 2f29859842238227915905dbc0304f847612fd49a627299dd5ef4f736e0123ca.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
2f29859842238227915905dbc0304f847612fd49a627299dd5ef4f736e0123ca.exepid process 1776 2f29859842238227915905dbc0304f847612fd49a627299dd5ef4f736e0123ca.exe 1776 2f29859842238227915905dbc0304f847612fd49a627299dd5ef4f736e0123ca.exe 1776 2f29859842238227915905dbc0304f847612fd49a627299dd5ef4f736e0123ca.exe 1776 2f29859842238227915905dbc0304f847612fd49a627299dd5ef4f736e0123ca.exe 1776 2f29859842238227915905dbc0304f847612fd49a627299dd5ef4f736e0123ca.exe 1776 2f29859842238227915905dbc0304f847612fd49a627299dd5ef4f736e0123ca.exe 1776 2f29859842238227915905dbc0304f847612fd49a627299dd5ef4f736e0123ca.exe 1776 2f29859842238227915905dbc0304f847612fd49a627299dd5ef4f736e0123ca.exe 1776 2f29859842238227915905dbc0304f847612fd49a627299dd5ef4f736e0123ca.exe 1776 2f29859842238227915905dbc0304f847612fd49a627299dd5ef4f736e0123ca.exe 1776 2f29859842238227915905dbc0304f847612fd49a627299dd5ef4f736e0123ca.exe 1776 2f29859842238227915905dbc0304f847612fd49a627299dd5ef4f736e0123ca.exe 1776 2f29859842238227915905dbc0304f847612fd49a627299dd5ef4f736e0123ca.exe 1776 2f29859842238227915905dbc0304f847612fd49a627299dd5ef4f736e0123ca.exe 1776 2f29859842238227915905dbc0304f847612fd49a627299dd5ef4f736e0123ca.exe 1776 2f29859842238227915905dbc0304f847612fd49a627299dd5ef4f736e0123ca.exe 1776 2f29859842238227915905dbc0304f847612fd49a627299dd5ef4f736e0123ca.exe 1776 2f29859842238227915905dbc0304f847612fd49a627299dd5ef4f736e0123ca.exe 1776 2f29859842238227915905dbc0304f847612fd49a627299dd5ef4f736e0123ca.exe 1776 2f29859842238227915905dbc0304f847612fd49a627299dd5ef4f736e0123ca.exe 1776 2f29859842238227915905dbc0304f847612fd49a627299dd5ef4f736e0123ca.exe 1776 2f29859842238227915905dbc0304f847612fd49a627299dd5ef4f736e0123ca.exe 1776 2f29859842238227915905dbc0304f847612fd49a627299dd5ef4f736e0123ca.exe 1776 2f29859842238227915905dbc0304f847612fd49a627299dd5ef4f736e0123ca.exe 1776 2f29859842238227915905dbc0304f847612fd49a627299dd5ef4f736e0123ca.exe 1776 2f29859842238227915905dbc0304f847612fd49a627299dd5ef4f736e0123ca.exe 1776 2f29859842238227915905dbc0304f847612fd49a627299dd5ef4f736e0123ca.exe 1776 2f29859842238227915905dbc0304f847612fd49a627299dd5ef4f736e0123ca.exe 1776 2f29859842238227915905dbc0304f847612fd49a627299dd5ef4f736e0123ca.exe 1776 2f29859842238227915905dbc0304f847612fd49a627299dd5ef4f736e0123ca.exe 1776 2f29859842238227915905dbc0304f847612fd49a627299dd5ef4f736e0123ca.exe 1776 2f29859842238227915905dbc0304f847612fd49a627299dd5ef4f736e0123ca.exe 1776 2f29859842238227915905dbc0304f847612fd49a627299dd5ef4f736e0123ca.exe 1776 2f29859842238227915905dbc0304f847612fd49a627299dd5ef4f736e0123ca.exe 1776 2f29859842238227915905dbc0304f847612fd49a627299dd5ef4f736e0123ca.exe 1776 2f29859842238227915905dbc0304f847612fd49a627299dd5ef4f736e0123ca.exe 1776 2f29859842238227915905dbc0304f847612fd49a627299dd5ef4f736e0123ca.exe 1776 2f29859842238227915905dbc0304f847612fd49a627299dd5ef4f736e0123ca.exe 1776 2f29859842238227915905dbc0304f847612fd49a627299dd5ef4f736e0123ca.exe 1776 2f29859842238227915905dbc0304f847612fd49a627299dd5ef4f736e0123ca.exe 1776 2f29859842238227915905dbc0304f847612fd49a627299dd5ef4f736e0123ca.exe 1776 2f29859842238227915905dbc0304f847612fd49a627299dd5ef4f736e0123ca.exe 1776 2f29859842238227915905dbc0304f847612fd49a627299dd5ef4f736e0123ca.exe 1776 2f29859842238227915905dbc0304f847612fd49a627299dd5ef4f736e0123ca.exe 1776 2f29859842238227915905dbc0304f847612fd49a627299dd5ef4f736e0123ca.exe 1776 2f29859842238227915905dbc0304f847612fd49a627299dd5ef4f736e0123ca.exe 1776 2f29859842238227915905dbc0304f847612fd49a627299dd5ef4f736e0123ca.exe 1776 2f29859842238227915905dbc0304f847612fd49a627299dd5ef4f736e0123ca.exe 1776 2f29859842238227915905dbc0304f847612fd49a627299dd5ef4f736e0123ca.exe 1776 2f29859842238227915905dbc0304f847612fd49a627299dd5ef4f736e0123ca.exe 1776 2f29859842238227915905dbc0304f847612fd49a627299dd5ef4f736e0123ca.exe 1776 2f29859842238227915905dbc0304f847612fd49a627299dd5ef4f736e0123ca.exe 1776 2f29859842238227915905dbc0304f847612fd49a627299dd5ef4f736e0123ca.exe 1776 2f29859842238227915905dbc0304f847612fd49a627299dd5ef4f736e0123ca.exe 1776 2f29859842238227915905dbc0304f847612fd49a627299dd5ef4f736e0123ca.exe 1776 2f29859842238227915905dbc0304f847612fd49a627299dd5ef4f736e0123ca.exe 1776 2f29859842238227915905dbc0304f847612fd49a627299dd5ef4f736e0123ca.exe 1776 2f29859842238227915905dbc0304f847612fd49a627299dd5ef4f736e0123ca.exe 1776 2f29859842238227915905dbc0304f847612fd49a627299dd5ef4f736e0123ca.exe 1776 2f29859842238227915905dbc0304f847612fd49a627299dd5ef4f736e0123ca.exe 1776 2f29859842238227915905dbc0304f847612fd49a627299dd5ef4f736e0123ca.exe 1776 2f29859842238227915905dbc0304f847612fd49a627299dd5ef4f736e0123ca.exe 1776 2f29859842238227915905dbc0304f847612fd49a627299dd5ef4f736e0123ca.exe 1776 2f29859842238227915905dbc0304f847612fd49a627299dd5ef4f736e0123ca.exe -
Suspicious behavior: LoadsDriver 5 IoCs
Processes:
2f29859842238227915905dbc0304f847612fd49a627299dd5ef4f736e0123ca.exepid process 460 1776 2f29859842238227915905dbc0304f847612fd49a627299dd5ef4f736e0123ca.exe 460 1776 2f29859842238227915905dbc0304f847612fd49a627299dd5ef4f736e0123ca.exe 1776 2f29859842238227915905dbc0304f847612fd49a627299dd5ef4f736e0123ca.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
2f29859842238227915905dbc0304f847612fd49a627299dd5ef4f736e0123ca.exetakeown.exedescription pid process Token: SeDebugPrivilege 1776 2f29859842238227915905dbc0304f847612fd49a627299dd5ef4f736e0123ca.exe Token: SeTakeOwnershipPrivilege 1760 takeown.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
2f29859842238227915905dbc0304f847612fd49a627299dd5ef4f736e0123ca.execmd.exedescription pid process target process PID 1776 wrote to memory of 1708 1776 2f29859842238227915905dbc0304f847612fd49a627299dd5ef4f736e0123ca.exe cmd.exe PID 1776 wrote to memory of 1708 1776 2f29859842238227915905dbc0304f847612fd49a627299dd5ef4f736e0123ca.exe cmd.exe PID 1776 wrote to memory of 1708 1776 2f29859842238227915905dbc0304f847612fd49a627299dd5ef4f736e0123ca.exe cmd.exe PID 1776 wrote to memory of 1708 1776 2f29859842238227915905dbc0304f847612fd49a627299dd5ef4f736e0123ca.exe cmd.exe PID 1708 wrote to memory of 1760 1708 cmd.exe takeown.exe PID 1708 wrote to memory of 1760 1708 cmd.exe takeown.exe PID 1708 wrote to memory of 1760 1708 cmd.exe takeown.exe PID 1708 wrote to memory of 1760 1708 cmd.exe takeown.exe PID 1708 wrote to memory of 1488 1708 cmd.exe icacls.exe PID 1708 wrote to memory of 1488 1708 cmd.exe icacls.exe PID 1708 wrote to memory of 1488 1708 cmd.exe icacls.exe PID 1708 wrote to memory of 1488 1708 cmd.exe icacls.exe PID 1776 wrote to memory of 852 1776 2f29859842238227915905dbc0304f847612fd49a627299dd5ef4f736e0123ca.exe cmd.exe PID 1776 wrote to memory of 852 1776 2f29859842238227915905dbc0304f847612fd49a627299dd5ef4f736e0123ca.exe cmd.exe PID 1776 wrote to memory of 852 1776 2f29859842238227915905dbc0304f847612fd49a627299dd5ef4f736e0123ca.exe cmd.exe PID 1776 wrote to memory of 852 1776 2f29859842238227915905dbc0304f847612fd49a627299dd5ef4f736e0123ca.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2f29859842238227915905dbc0304f847612fd49a627299dd5ef4f736e0123ca.exe"C:\Users\Admin\AppData\Local\Temp\2f29859842238227915905dbc0304f847612fd49a627299dd5ef4f736e0123ca.exe"1⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /c takeown /f C:\Windows\SysWOW64\wshtcpip.dll && icacls C:\Windows\SysWOW64\wshtcpip.dll /grant administrators:F2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\SysWOW64\wshtcpip.dll3⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\icacls.exeicacls C:\Windows\SysWOW64\wshtcpip.dll /grant administrators:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\ahnmove.bat2⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\ahnmove.batFilesize
181B
MD51e0012c2adb936b0aa85eb9b1224c38c
SHA18e3317e3ff734cdc95708a84b91772ad3bbd1d2d
SHA2562563d289061a83fd9243a86e86cdef016faaca6cbad2c35f21ff23dc0c0ca997
SHA5124fee88f88f056a93004e60eeae6bf298992be85dfea5f7cd78cfee984a5ac24c349a9cb777cc7b03cb3d2052d2dc755a78b9ff043cac9fa8bf32b5b6f9ffc0b0
-
memory/852-60-0x0000000000000000-mapping.dmp
-
memory/1488-59-0x0000000000000000-mapping.dmp
-
memory/1708-57-0x0000000000000000-mapping.dmp
-
memory/1760-58-0x0000000000000000-mapping.dmp
-
memory/1776-54-0x0000000001000000-0x000000000112D000-memory.dmpFilesize
1.2MB
-
memory/1776-55-0x0000000074C91000-0x0000000074C93000-memory.dmpFilesize
8KB
-
memory/1776-56-0x0000000001000000-0x000000000112D000-memory.dmpFilesize
1.2MB
-
memory/1776-61-0x0000000001000000-0x000000000112D000-memory.dmpFilesize
1.2MB