5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618

General

Target

5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
Size

667KB
MD5

6f30aa9bd7e8aa967bba9e63eaa45580
SHA1

5fe1bf96805d5fc173d132d80545b307f6e3254b
SHA256

5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618
SHA512

a496b924ddf5abfa920c5fd992f3908c04e580114d890827b4d3f6a8849ec6f1295217cc98bb5c8754c05200ba8486eae119128feb46ae6f4afa4f6b7480177d
SSDEEP

12288:/c0zvQ9wQflcC2C+w2P3z+qeWU+7FjiPPnYR9d2mUNpZ:/3zveflc5CP2/zt3F7FWfY1upZ

Score

8^/10

adware discovery exploit persistence stealer

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe

description ioc process

File created C:\Windows\SysWOW64\drivers\7c3ba0e1.sys 5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
Possible privilege escalation attempt 4 IoCs
exploit

Processes:

takeown.exeicacls.exetakeown.exeicacls.exe

pid process

3860 takeown.exe
3600 icacls.exe
212 takeown.exe
376 icacls.exe

description	ioc	process
File created	C:\Windows\SysWOW64\drivers\7c3ba0e1.sys	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe

pid	process
3860	takeown.exe
3600	icacls.exe
212	takeown.exe
376	icacls.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\7c3ba0e1\ImagePath = "\\??\\C:\\Windows\\SysWOW64\\drivers\\7c3ba0e1.sys"	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe

Modifies file permissions 1 TTPs 4 IoCs
discovery

File Permissions Modification
T1222

Processes:

takeown.exeicacls.exetakeown.exeicacls.exe

pid process

3860 takeown.exe
3600 icacls.exe
212 takeown.exe
376 icacls.exe

pid	process
3860	takeown.exe
3600	icacls.exe
212	takeown.exe
376	icacls.exe

Installs/modifies Browser Helper Object 2 TTPs 3 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

Processes:

5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe

Maps connected drives based on registry 3 TTPs 3 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe

description	ioc	process
Key value enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe

Drops file in System32 directory 5 IoCs

Processes:

5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe

description	ioc	process
File created	C:\Windows\SysWOW64\dhiJs8js.dll	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
File created	C:\Windows\SysWOW64\hJubwieG.dll	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
File created	C:\Windows\SysWOW64\wshtcpip.dll	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
File opened for modification	C:\Windows\SysWOW64\wshtcpip.dll	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
File created	C:\Windows\SysWOW64\midimap.dll	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe

Modifies registry class 4 IoCs

Processes:

5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\HOOK_ID	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\HOOK_ID\name = "5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe"	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\SYS_DLL	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\SYS_DLL\name = "ffwFgF.dll"	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe

pid	process
1296	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
1296	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
1296	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
1296	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
1296	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
1296	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
1296	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
1296	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
1296	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
1296	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
1296	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
1296	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
1296	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
1296	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
1296	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
1296	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
1296	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
1296	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
1296	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
1296	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
1296	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
1296	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
1296	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
1296	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
1296	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
1296	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
1296	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
1296	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
1296	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
1296	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
1296	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
1296	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
1296	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
1296	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
1296	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
1296	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
1296	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
1296	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
1296	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
1296	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
1296	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
1296	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
1296	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
1296	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
1296	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
1296	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
1296	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
1296	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
1296	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
1296	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
1296	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
1296	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
1296	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
1296	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
1296	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
1296	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
1296	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
1296	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
1296	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
1296	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
1296	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
1296	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
1296	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
1296	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe

Suspicious behavior: LoadsDriver 2 IoCs

Processes:

5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe

pid process

664
1296 5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe

pid	process
664
1296	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

takeown.exetakeown.exe5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe

description	pid	process
Token: SeTakeOwnershipPrivilege	3860	takeown.exe
Token: SeTakeOwnershipPrivilege	212	takeown.exe
Token: SeDebugPrivilege	1296	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.execmd.execmd.exe

description	pid	process	target process
PID 1296 wrote to memory of 1036	1296	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe	cmd.exe
PID 1296 wrote to memory of 1036	1296	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe	cmd.exe
PID 1296 wrote to memory of 1036	1296	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe	cmd.exe
PID 1036 wrote to memory of 3860	1036	cmd.exe	takeown.exe
PID 1036 wrote to memory of 3860	1036	cmd.exe	takeown.exe
PID 1036 wrote to memory of 3860	1036	cmd.exe	takeown.exe
PID 1036 wrote to memory of 3600	1036	cmd.exe	icacls.exe
PID 1036 wrote to memory of 3600	1036	cmd.exe	icacls.exe
PID 1036 wrote to memory of 3600	1036	cmd.exe	icacls.exe
PID 1296 wrote to memory of 1748	1296	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe	cmd.exe
PID 1296 wrote to memory of 1748	1296	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe	cmd.exe
PID 1296 wrote to memory of 1748	1296	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe	cmd.exe
PID 1748 wrote to memory of 212	1748	cmd.exe	takeown.exe
PID 1748 wrote to memory of 212	1748	cmd.exe	takeown.exe
PID 1748 wrote to memory of 212	1748	cmd.exe	takeown.exe
PID 1748 wrote to memory of 376	1748	cmd.exe	icacls.exe
PID 1748 wrote to memory of 376	1748	cmd.exe	icacls.exe
PID 1748 wrote to memory of 376	1748	cmd.exe	icacls.exe
PID 1296 wrote to memory of 4560	1296	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe	cmd.exe
PID 1296 wrote to memory of 4560	1296	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe	cmd.exe
PID 1296 wrote to memory of 4560	1296	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
"C:\Users\Admin\AppData\Local\Temp\5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe"
1⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Installs/modifies Browser Helper Object
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1296

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c takeown /f C:\Windows\SysWOW64\wshtcpip.dll && icacls C:\Windows\SysWOW64\wshtcpip.dll /grant administrators:F
2⤵
- Suspicious use of WriteProcessMemory
PID:1036

C:\Windows\SysWOW64\takeown.exe
takeown /f C:\Windows\SysWOW64\wshtcpip.dll
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:3860

C:\Windows\SysWOW64\icacls.exe
icacls C:\Windows\SysWOW64\wshtcpip.dll /grant administrators:F
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:3600

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c takeown /f C:\Windows\SysWOW64\midimap.dll && icacls C:\Windows\SysWOW64\midimap.dll /grant administrators:F
2⤵
- Suspicious use of WriteProcessMemory
PID:1748

C:\Windows\SysWOW64\takeown.exe
takeown /f C:\Windows\SysWOW64\midimap.dll
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:212

C:\Windows\SysWOW64\icacls.exe
icacls C:\Windows\SysWOW64\midimap.dll /grant administrators:F
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:376

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ahnmove.bat
2⤵
PID:4560

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Browser Extensions

1

T1176

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

File Permissions Modification

1

T1222

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ahnmove.bat
Filesize
181B

MD5
4bc4681ba8c6f4fc81cdc017130edba4

SHA1
17334637f9dfe18b2dda6d0da0155719dd8ff1a3

SHA256
0ee763f971b22334907748e0e0563c53e75b1f3be6f02d827c25a0e564fbb349

SHA512
42df11991864c96ad88f86c3296a0f9d27b2247a379357c98731df6fd088d144fc54b13dc50d953fa1bcd9c5563617f244a565b58642cf41ee625211b8581ebb

Download Submit
memory/212-138-0x0000000000000000-mapping.dmp

Download
memory/376-139-0x0000000000000000-mapping.dmp

Download
memory/1036-134-0x0000000000000000-mapping.dmp

Download
memory/1296-141-0x0000000000D30000-0x0000000000D50000-memory.dmp

Filesize
128KB

Download
memory/1296-140-0x0000000001000000-0x000000000177C000-memory.dmp

Filesize
7.5MB

Download
memory/1296-132-0x0000000001000000-0x000000000177C000-memory.dmp

Filesize
7.5MB

Download
memory/1296-143-0x0000000001000000-0x000000000177C000-memory.dmp

Filesize
7.5MB

Download
memory/1296-133-0x0000000000D30000-0x0000000000D50000-memory.dmp

Filesize
128KB

Download
memory/1748-137-0x0000000000000000-mapping.dmp

Download
memory/3600-136-0x0000000000000000-mapping.dmp

Download
memory/3860-135-0x0000000000000000-mapping.dmp

Download
memory/4560-142-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads