Analysis
-
max time kernel
91s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
03/10/2022, 23:29
Behavioral task
behavioral1
Sample
3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe
Resource
win7-20220812-en
windows7-x64
13 signatures
150 seconds
General
-
Target
3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe
-
Size
350KB
-
MD5
61dbb42d14e7d603d236c60288685ad0
-
SHA1
b0a58d549087d8824a5f4f71e46506a96a5cefe2
-
SHA256
3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07
-
SHA512
fa7b66cfba7304f1b6a5b2ef2b1ea7d9fcb506eb3957cb61694b6f22c4b17d8ff6c18bfb46d123e4716f75fad3bcec1dd638af4b3ae55c2f8b954d31c75045dc
-
SSDEEP
6144:oyXu7IEBSsQ9ElMwm60lmqs7MTRGA3h3GVqdppJXEGhBukJF/KAwxFUOWdEmh:o3BdQLL4BE93NGVYZX9BukJlwxSJdEm
Malware Config
Signatures
-
Drops file in Drivers directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\drivers\02198fdc.sys 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe File created C:\Windows\SysWOW64\drivers\7eb2ba5a.sys 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe -
Possible privilege escalation attempt 2 IoCs
pid Process 2116 takeown.exe 3748 icacls.exe -
Sets service image path in registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\02198fdc\ImagePath = "\\??\\C:\\Windows\\SysWOW64\\drivers\\02198fdc.sys" 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\7eb2ba5a\ImagePath = "\\??\\C:\\Windows\\SysWOW64\\drivers\\7eb2ba5a.sys" 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe -
resource yara_rule behavioral2/memory/4724-132-0x0000000001000000-0x000000000112D000-memory.dmp upx behavioral2/memory/4724-133-0x0000000001000000-0x000000000112D000-memory.dmp upx behavioral2/memory/4724-138-0x0000000001000000-0x000000000112D000-memory.dmp upx -
Modifies file permissions 1 TTPs 2 IoCs
pid Process 2116 takeown.exe 3748 icacls.exe -
Installs/modifies Browser Helper Object 2 TTPs 3 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA} 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C} 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe -
Drops file in System32 directory 5 IoCs
description ioc Process File created C:\Windows\SysWOW64\goodsb.dll 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe File created C:\Windows\SysWOW64\ws2tcpip.dll 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe File opened for modification C:\Windows\SysWOW64\ws2tcpip.dll 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe File created C:\Windows\SysWOW64\wshtcpip.dll 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe File opened for modification C:\Windows\SysWOW64\goodsb.dll 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe -
Modifies registry class 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\HOOK_ID\name = "3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe" 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\SYS_DLL 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\SYS_DLL\name = "WhfqUH8u7y.dll" 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\HOOK_ID 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4724 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 4724 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 4724 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 4724 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 4724 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 4724 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 4724 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 4724 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 4724 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 4724 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 4724 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 4724 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 4724 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 4724 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 4724 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 4724 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 4724 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 4724 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 4724 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 4724 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 4724 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 4724 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 4724 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 4724 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 4724 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 4724 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 4724 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 4724 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 4724 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 4724 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 4724 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 4724 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 4724 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 4724 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 4724 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 4724 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 4724 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 4724 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 4724 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 4724 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 4724 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 4724 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 4724 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 4724 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 4724 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 4724 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 4724 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 4724 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 4724 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 4724 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 4724 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 4724 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 4724 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 4724 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 4724 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 4724 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 4724 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 4724 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 4724 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 4724 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 4724 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 4724 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 4724 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 4724 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe -
Suspicious behavior: LoadsDriver 5 IoCs
pid Process 664 Process not Found 4724 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 664 Process not Found 4724 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 4724 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4724 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe Token: SeTakeOwnershipPrivilege 2116 takeown.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 4724 wrote to memory of 3084 4724 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 84 PID 4724 wrote to memory of 3084 4724 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 84 PID 4724 wrote to memory of 3084 4724 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 84 PID 3084 wrote to memory of 2116 3084 cmd.exe 86 PID 3084 wrote to memory of 2116 3084 cmd.exe 86 PID 3084 wrote to memory of 2116 3084 cmd.exe 86 PID 3084 wrote to memory of 3748 3084 cmd.exe 87 PID 3084 wrote to memory of 3748 3084 cmd.exe 87 PID 3084 wrote to memory of 3748 3084 cmd.exe 87 PID 4724 wrote to memory of 1164 4724 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 88 PID 4724 wrote to memory of 1164 4724 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 88 PID 4724 wrote to memory of 1164 4724 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe"C:\Users\Admin\AppData\Local\Temp\3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe"1⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Windows\SysWOW64\cmd.execmd.exe /c takeown /f C:\Windows\SysWOW64\wshtcpip.dll && icacls C:\Windows\SysWOW64\wshtcpip.dll /grant administrators:F2⤵
- Suspicious use of WriteProcessMemory
PID:3084 -
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\SysWOW64\wshtcpip.dll3⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:2116
-
-
C:\Windows\SysWOW64\icacls.exeicacls C:\Windows\SysWOW64\wshtcpip.dll /grant administrators:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:3748
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ahnmove.bat2⤵PID:1164
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
181B
MD554671520f7273afc6d4ebc660d9b32df
SHA1baae797a8f52cb27d7297ef95fb46b976e2434f6
SHA256434f21a835545abb34d9c93a9afbf6ecdab03a32d5a97d938350a50a119ce4fc
SHA5121c68d52d60b4af22404498bea72eee40e30914da8ba95fc6ae32263f784f7e47b519f9d5a8883231ddc4b2ad783957ced7f78fef0a2807c3586a338d8579e816