Analysis
-
max time kernel
42s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
11-10-2022 16:23
Static task
static1
Behavioral task
behavioral1
Sample
e23a84573f263fa777d4960bb80c11fe48408edf640b0b1c0da886fc08e7fc67.exe
Resource
win7-20220812-en
General
-
Target
e23a84573f263fa777d4960bb80c11fe48408edf640b0b1c0da886fc08e7fc67.exe
-
Size
1.4MB
-
MD5
4b9ae3ddf312aecbd5565378c9834c50
-
SHA1
99efa90050a1a0eae5de992c89a5a2c8ad067d0b
-
SHA256
e23a84573f263fa777d4960bb80c11fe48408edf640b0b1c0da886fc08e7fc67
-
SHA512
36282a300299cecd11a89b112722c808fb8ce5e381456d9a45b1992b3d072c67e50c6b64802e625de3e2e3041d82e36696475eda799453603723aafe4ba8e510
-
SSDEEP
24576:aNmF/mnBoDM5f7F23rKZk+61i5cCPWZj+VhL8OamPRKplJfVXT24WTEvzHJDsP:aYVZo5Tc30k+61i5cYWZjSTDPYtfVjNG
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
ms.exepid process 1684 ms.exe -
Possible privilege escalation attempt 2 IoCs
Processes:
takeown.exeicacls.exepid process 1376 takeown.exe 1764 icacls.exe -
Loads dropped DLL 1 IoCs
Processes:
e23a84573f263fa777d4960bb80c11fe48408edf640b0b1c0da886fc08e7fc67.exepid process 1636 e23a84573f263fa777d4960bb80c11fe48408edf640b0b1c0da886fc08e7fc67.exe -
Modifies file permissions 1 TTPs 2 IoCs
Processes:
takeown.exeicacls.exepid process 1376 takeown.exe 1764 icacls.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Windows directory 2 IoCs
Processes:
e23a84573f263fa777d4960bb80c11fe48408edf640b0b1c0da886fc08e7fc67.exedescription ioc process File opened for modification C:\WINDOWS\Bef.tmp e23a84573f263fa777d4960bb80c11fe48408edf640b0b1c0da886fc08e7fc67.exe File opened for modification C:\Windows\yre.tmp e23a84573f263fa777d4960bb80c11fe48408edf640b0b1c0da886fc08e7fc67.exe -
Suspicious behavior: EnumeratesProcesses 37 IoCs
Processes:
e23a84573f263fa777d4960bb80c11fe48408edf640b0b1c0da886fc08e7fc67.exepid process 1636 e23a84573f263fa777d4960bb80c11fe48408edf640b0b1c0da886fc08e7fc67.exe 1636 e23a84573f263fa777d4960bb80c11fe48408edf640b0b1c0da886fc08e7fc67.exe 1636 e23a84573f263fa777d4960bb80c11fe48408edf640b0b1c0da886fc08e7fc67.exe 1636 e23a84573f263fa777d4960bb80c11fe48408edf640b0b1c0da886fc08e7fc67.exe 1636 e23a84573f263fa777d4960bb80c11fe48408edf640b0b1c0da886fc08e7fc67.exe 1636 e23a84573f263fa777d4960bb80c11fe48408edf640b0b1c0da886fc08e7fc67.exe 1636 e23a84573f263fa777d4960bb80c11fe48408edf640b0b1c0da886fc08e7fc67.exe 1636 e23a84573f263fa777d4960bb80c11fe48408edf640b0b1c0da886fc08e7fc67.exe 1636 e23a84573f263fa777d4960bb80c11fe48408edf640b0b1c0da886fc08e7fc67.exe 1636 e23a84573f263fa777d4960bb80c11fe48408edf640b0b1c0da886fc08e7fc67.exe 1636 e23a84573f263fa777d4960bb80c11fe48408edf640b0b1c0da886fc08e7fc67.exe 1636 e23a84573f263fa777d4960bb80c11fe48408edf640b0b1c0da886fc08e7fc67.exe 1636 e23a84573f263fa777d4960bb80c11fe48408edf640b0b1c0da886fc08e7fc67.exe 1636 e23a84573f263fa777d4960bb80c11fe48408edf640b0b1c0da886fc08e7fc67.exe 1636 e23a84573f263fa777d4960bb80c11fe48408edf640b0b1c0da886fc08e7fc67.exe 1636 e23a84573f263fa777d4960bb80c11fe48408edf640b0b1c0da886fc08e7fc67.exe 1636 e23a84573f263fa777d4960bb80c11fe48408edf640b0b1c0da886fc08e7fc67.exe 1636 e23a84573f263fa777d4960bb80c11fe48408edf640b0b1c0da886fc08e7fc67.exe 1636 e23a84573f263fa777d4960bb80c11fe48408edf640b0b1c0da886fc08e7fc67.exe 1636 e23a84573f263fa777d4960bb80c11fe48408edf640b0b1c0da886fc08e7fc67.exe 1636 e23a84573f263fa777d4960bb80c11fe48408edf640b0b1c0da886fc08e7fc67.exe 1636 e23a84573f263fa777d4960bb80c11fe48408edf640b0b1c0da886fc08e7fc67.exe 1636 e23a84573f263fa777d4960bb80c11fe48408edf640b0b1c0da886fc08e7fc67.exe 1636 e23a84573f263fa777d4960bb80c11fe48408edf640b0b1c0da886fc08e7fc67.exe 1636 e23a84573f263fa777d4960bb80c11fe48408edf640b0b1c0da886fc08e7fc67.exe 1636 e23a84573f263fa777d4960bb80c11fe48408edf640b0b1c0da886fc08e7fc67.exe 1636 e23a84573f263fa777d4960bb80c11fe48408edf640b0b1c0da886fc08e7fc67.exe 1636 e23a84573f263fa777d4960bb80c11fe48408edf640b0b1c0da886fc08e7fc67.exe 1636 e23a84573f263fa777d4960bb80c11fe48408edf640b0b1c0da886fc08e7fc67.exe 1636 e23a84573f263fa777d4960bb80c11fe48408edf640b0b1c0da886fc08e7fc67.exe 1636 e23a84573f263fa777d4960bb80c11fe48408edf640b0b1c0da886fc08e7fc67.exe 1636 e23a84573f263fa777d4960bb80c11fe48408edf640b0b1c0da886fc08e7fc67.exe 1636 e23a84573f263fa777d4960bb80c11fe48408edf640b0b1c0da886fc08e7fc67.exe 1636 e23a84573f263fa777d4960bb80c11fe48408edf640b0b1c0da886fc08e7fc67.exe 1636 e23a84573f263fa777d4960bb80c11fe48408edf640b0b1c0da886fc08e7fc67.exe 1636 e23a84573f263fa777d4960bb80c11fe48408edf640b0b1c0da886fc08e7fc67.exe 1636 e23a84573f263fa777d4960bb80c11fe48408edf640b0b1c0da886fc08e7fc67.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
takeown.exedescription pid process Token: SeTakeOwnershipPrivilege 1376 takeown.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
ms.exepid process 1684 ms.exe 1684 ms.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
e23a84573f263fa777d4960bb80c11fe48408edf640b0b1c0da886fc08e7fc67.exems.exedescription pid process target process PID 1636 wrote to memory of 1684 1636 e23a84573f263fa777d4960bb80c11fe48408edf640b0b1c0da886fc08e7fc67.exe ms.exe PID 1636 wrote to memory of 1684 1636 e23a84573f263fa777d4960bb80c11fe48408edf640b0b1c0da886fc08e7fc67.exe ms.exe PID 1636 wrote to memory of 1684 1636 e23a84573f263fa777d4960bb80c11fe48408edf640b0b1c0da886fc08e7fc67.exe ms.exe PID 1636 wrote to memory of 1684 1636 e23a84573f263fa777d4960bb80c11fe48408edf640b0b1c0da886fc08e7fc67.exe ms.exe PID 1684 wrote to memory of 1376 1684 ms.exe takeown.exe PID 1684 wrote to memory of 1376 1684 ms.exe takeown.exe PID 1684 wrote to memory of 1376 1684 ms.exe takeown.exe PID 1684 wrote to memory of 1376 1684 ms.exe takeown.exe PID 1684 wrote to memory of 1764 1684 ms.exe icacls.exe PID 1684 wrote to memory of 1764 1684 ms.exe icacls.exe PID 1684 wrote to memory of 1764 1684 ms.exe icacls.exe PID 1684 wrote to memory of 1764 1684 ms.exe icacls.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e23a84573f263fa777d4960bb80c11fe48408edf640b0b1c0da886fc08e7fc67.exe"C:\Users\Admin\AppData\Local\Temp\e23a84573f263fa777d4960bb80c11fe48408edf640b0b1c0da886fc08e7fc67.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ms.exeC:\Users\Admin\AppData\Local\Temp\ms.exe k2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\takeown.exetakeown /f "C:\WINDOWS\system32\Sens.dll"3⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\icacls.exeicacls "C:\WINDOWS\system32\Sens.dll" /grant administrators:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\ms.exeFilesize
424KB
MD5a6c6dc74d7f061d01ef9b2cc4451a760
SHA146158a4b95126d95e0187ce066126c9482b44568
SHA256c63e23d1efe9bbb79cb80def879c087fafe4ee4dfb4e8918cb0bc9ac72db0915
SHA512800236114c6f9a5a25b425a2ba1f118250b6ecc7d935fa980b2e9408c0d8d1991c2be5fc698ca951375c0fb0d79edd878c323bd230bb7084c2fe7f1362deb3bd
-
C:\Users\Admin\AppData\Local\Temp\ms.exeFilesize
424KB
MD5a6c6dc74d7f061d01ef9b2cc4451a760
SHA146158a4b95126d95e0187ce066126c9482b44568
SHA256c63e23d1efe9bbb79cb80def879c087fafe4ee4dfb4e8918cb0bc9ac72db0915
SHA512800236114c6f9a5a25b425a2ba1f118250b6ecc7d935fa980b2e9408c0d8d1991c2be5fc698ca951375c0fb0d79edd878c323bd230bb7084c2fe7f1362deb3bd
-
\Users\Admin\AppData\Local\Temp\ms.exeFilesize
424KB
MD5a6c6dc74d7f061d01ef9b2cc4451a760
SHA146158a4b95126d95e0187ce066126c9482b44568
SHA256c63e23d1efe9bbb79cb80def879c087fafe4ee4dfb4e8918cb0bc9ac72db0915
SHA512800236114c6f9a5a25b425a2ba1f118250b6ecc7d935fa980b2e9408c0d8d1991c2be5fc698ca951375c0fb0d79edd878c323bd230bb7084c2fe7f1362deb3bd
-
memory/1376-60-0x0000000000000000-mapping.dmp
-
memory/1636-54-0x00000000762F1000-0x00000000762F3000-memory.dmpFilesize
8KB
-
memory/1684-56-0x0000000000000000-mapping.dmp
-
memory/1764-61-0x0000000000000000-mapping.dmp