Analysis
-
max time kernel
121s -
max time network
84s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
13-10-2022 15:24
Behavioral task
behavioral1
Sample
ac6cd43b406c40e2b135c3aea427c817c4921befa84bbbadad17bbb1628eed73.exe
Resource
win7-20220812-en
General
-
Target
ac6cd43b406c40e2b135c3aea427c817c4921befa84bbbadad17bbb1628eed73.exe
-
Size
350KB
-
MD5
6822f6f52fc026c121b2addec828b100
-
SHA1
9bb9100c807a26311100f7542657178ad13fbf36
-
SHA256
ac6cd43b406c40e2b135c3aea427c817c4921befa84bbbadad17bbb1628eed73
-
SHA512
bae02889d7b218eb9647b82bb356a6bc596b27171b5fc6d469250845b12e7c37ebb53c36b83b53b9e95ed2e385c76742f2ef31ff994a19941ccc01d394c94ea9
-
SSDEEP
6144:WyXu7IEBSsQ9ElMwm60lmqs7MTRGA3h3GVqdppJXEGhBukJF/KAwxFUOWdEmh:W3BdQLL4BE93NGVYZX9BukJlwxSJdEm
Malware Config
Signatures
-
Drops file in Drivers directory 2 IoCs
Processes:
ac6cd43b406c40e2b135c3aea427c817c4921befa84bbbadad17bbb1628eed73.exedescription ioc process File created C:\Windows\SysWOW64\drivers\726a4114.sys ac6cd43b406c40e2b135c3aea427c817c4921befa84bbbadad17bbb1628eed73.exe File created C:\Windows\SysWOW64\drivers\0ec17492.sys ac6cd43b406c40e2b135c3aea427c817c4921befa84bbbadad17bbb1628eed73.exe -
Possible privilege escalation attempt 2 IoCs
Processes:
takeown.exeicacls.exepid process 1064 takeown.exe 792 icacls.exe -
Sets service image path in registry 2 TTPs 2 IoCs
Processes:
ac6cd43b406c40e2b135c3aea427c817c4921befa84bbbadad17bbb1628eed73.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\726a4114\ImagePath = "\\??\\C:\\Windows\\SysWOW64\\drivers\\726a4114.sys" ac6cd43b406c40e2b135c3aea427c817c4921befa84bbbadad17bbb1628eed73.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\0ec17492\ImagePath = "\\??\\C:\\Windows\\SysWOW64\\drivers\\0ec17492.sys" ac6cd43b406c40e2b135c3aea427c817c4921befa84bbbadad17bbb1628eed73.exe -
Processes:
resource yara_rule behavioral1/memory/1728-55-0x0000000001000000-0x000000000112D000-memory.dmp upx behavioral1/memory/1728-56-0x0000000001000000-0x000000000112D000-memory.dmp upx behavioral1/memory/1728-62-0x0000000001000000-0x000000000112D000-memory.dmp upx -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1632 cmd.exe -
Modifies file permissions 1 TTPs 2 IoCs
Processes:
takeown.exeicacls.exepid process 1064 takeown.exe 792 icacls.exe -
Installs/modifies Browser Helper Object 2 TTPs 4 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
Processes:
ac6cd43b406c40e2b135c3aea427c817c4921befa84bbbadad17bbb1628eed73.exedescription ioc process Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects ac6cd43b406c40e2b135c3aea427c817c4921befa84bbbadad17bbb1628eed73.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF} ac6cd43b406c40e2b135c3aea427c817c4921befa84bbbadad17bbb1628eed73.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E} ac6cd43b406c40e2b135c3aea427c817c4921befa84bbbadad17bbb1628eed73.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3} ac6cd43b406c40e2b135c3aea427c817c4921befa84bbbadad17bbb1628eed73.exe -
Drops file in System32 directory 5 IoCs
Processes:
ac6cd43b406c40e2b135c3aea427c817c4921befa84bbbadad17bbb1628eed73.exedescription ioc process File created C:\Windows\SysWOW64\wshtcpip.dll ac6cd43b406c40e2b135c3aea427c817c4921befa84bbbadad17bbb1628eed73.exe File opened for modification C:\Windows\SysWOW64\goodsb.dll ac6cd43b406c40e2b135c3aea427c817c4921befa84bbbadad17bbb1628eed73.exe File created C:\Windows\SysWOW64\goodsb.dll ac6cd43b406c40e2b135c3aea427c817c4921befa84bbbadad17bbb1628eed73.exe File created C:\Windows\SysWOW64\ws2tcpip.dll ac6cd43b406c40e2b135c3aea427c817c4921befa84bbbadad17bbb1628eed73.exe File opened for modification C:\Windows\SysWOW64\ws2tcpip.dll ac6cd43b406c40e2b135c3aea427c817c4921befa84bbbadad17bbb1628eed73.exe -
Modifies registry class 4 IoCs
Processes:
ac6cd43b406c40e2b135c3aea427c817c4921befa84bbbadad17bbb1628eed73.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\SYS_DLL ac6cd43b406c40e2b135c3aea427c817c4921befa84bbbadad17bbb1628eed73.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\SYS_DLL\name = "afKw.dll" ac6cd43b406c40e2b135c3aea427c817c4921befa84bbbadad17bbb1628eed73.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\HOOK_ID ac6cd43b406c40e2b135c3aea427c817c4921befa84bbbadad17bbb1628eed73.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\HOOK_ID\name = "ac6cd43b406c40e2b135c3aea427c817c4921befa84bbbadad17bbb1628eed73.exe" ac6cd43b406c40e2b135c3aea427c817c4921befa84bbbadad17bbb1628eed73.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
ac6cd43b406c40e2b135c3aea427c817c4921befa84bbbadad17bbb1628eed73.exepid process 1728 ac6cd43b406c40e2b135c3aea427c817c4921befa84bbbadad17bbb1628eed73.exe 1728 ac6cd43b406c40e2b135c3aea427c817c4921befa84bbbadad17bbb1628eed73.exe 1728 ac6cd43b406c40e2b135c3aea427c817c4921befa84bbbadad17bbb1628eed73.exe 1728 ac6cd43b406c40e2b135c3aea427c817c4921befa84bbbadad17bbb1628eed73.exe 1728 ac6cd43b406c40e2b135c3aea427c817c4921befa84bbbadad17bbb1628eed73.exe 1728 ac6cd43b406c40e2b135c3aea427c817c4921befa84bbbadad17bbb1628eed73.exe 1728 ac6cd43b406c40e2b135c3aea427c817c4921befa84bbbadad17bbb1628eed73.exe 1728 ac6cd43b406c40e2b135c3aea427c817c4921befa84bbbadad17bbb1628eed73.exe 1728 ac6cd43b406c40e2b135c3aea427c817c4921befa84bbbadad17bbb1628eed73.exe 1728 ac6cd43b406c40e2b135c3aea427c817c4921befa84bbbadad17bbb1628eed73.exe 1728 ac6cd43b406c40e2b135c3aea427c817c4921befa84bbbadad17bbb1628eed73.exe 1728 ac6cd43b406c40e2b135c3aea427c817c4921befa84bbbadad17bbb1628eed73.exe 1728 ac6cd43b406c40e2b135c3aea427c817c4921befa84bbbadad17bbb1628eed73.exe 1728 ac6cd43b406c40e2b135c3aea427c817c4921befa84bbbadad17bbb1628eed73.exe 1728 ac6cd43b406c40e2b135c3aea427c817c4921befa84bbbadad17bbb1628eed73.exe 1728 ac6cd43b406c40e2b135c3aea427c817c4921befa84bbbadad17bbb1628eed73.exe 1728 ac6cd43b406c40e2b135c3aea427c817c4921befa84bbbadad17bbb1628eed73.exe 1728 ac6cd43b406c40e2b135c3aea427c817c4921befa84bbbadad17bbb1628eed73.exe 1728 ac6cd43b406c40e2b135c3aea427c817c4921befa84bbbadad17bbb1628eed73.exe 1728 ac6cd43b406c40e2b135c3aea427c817c4921befa84bbbadad17bbb1628eed73.exe 1728 ac6cd43b406c40e2b135c3aea427c817c4921befa84bbbadad17bbb1628eed73.exe 1728 ac6cd43b406c40e2b135c3aea427c817c4921befa84bbbadad17bbb1628eed73.exe 1728 ac6cd43b406c40e2b135c3aea427c817c4921befa84bbbadad17bbb1628eed73.exe 1728 ac6cd43b406c40e2b135c3aea427c817c4921befa84bbbadad17bbb1628eed73.exe 1728 ac6cd43b406c40e2b135c3aea427c817c4921befa84bbbadad17bbb1628eed73.exe 1728 ac6cd43b406c40e2b135c3aea427c817c4921befa84bbbadad17bbb1628eed73.exe 1728 ac6cd43b406c40e2b135c3aea427c817c4921befa84bbbadad17bbb1628eed73.exe 1728 ac6cd43b406c40e2b135c3aea427c817c4921befa84bbbadad17bbb1628eed73.exe 1728 ac6cd43b406c40e2b135c3aea427c817c4921befa84bbbadad17bbb1628eed73.exe 1728 ac6cd43b406c40e2b135c3aea427c817c4921befa84bbbadad17bbb1628eed73.exe 1728 ac6cd43b406c40e2b135c3aea427c817c4921befa84bbbadad17bbb1628eed73.exe 1728 ac6cd43b406c40e2b135c3aea427c817c4921befa84bbbadad17bbb1628eed73.exe 1728 ac6cd43b406c40e2b135c3aea427c817c4921befa84bbbadad17bbb1628eed73.exe 1728 ac6cd43b406c40e2b135c3aea427c817c4921befa84bbbadad17bbb1628eed73.exe 1728 ac6cd43b406c40e2b135c3aea427c817c4921befa84bbbadad17bbb1628eed73.exe 1728 ac6cd43b406c40e2b135c3aea427c817c4921befa84bbbadad17bbb1628eed73.exe 1728 ac6cd43b406c40e2b135c3aea427c817c4921befa84bbbadad17bbb1628eed73.exe 1728 ac6cd43b406c40e2b135c3aea427c817c4921befa84bbbadad17bbb1628eed73.exe 1728 ac6cd43b406c40e2b135c3aea427c817c4921befa84bbbadad17bbb1628eed73.exe 1728 ac6cd43b406c40e2b135c3aea427c817c4921befa84bbbadad17bbb1628eed73.exe 1728 ac6cd43b406c40e2b135c3aea427c817c4921befa84bbbadad17bbb1628eed73.exe 1728 ac6cd43b406c40e2b135c3aea427c817c4921befa84bbbadad17bbb1628eed73.exe 1728 ac6cd43b406c40e2b135c3aea427c817c4921befa84bbbadad17bbb1628eed73.exe 1728 ac6cd43b406c40e2b135c3aea427c817c4921befa84bbbadad17bbb1628eed73.exe 1728 ac6cd43b406c40e2b135c3aea427c817c4921befa84bbbadad17bbb1628eed73.exe 1728 ac6cd43b406c40e2b135c3aea427c817c4921befa84bbbadad17bbb1628eed73.exe 1728 ac6cd43b406c40e2b135c3aea427c817c4921befa84bbbadad17bbb1628eed73.exe 1728 ac6cd43b406c40e2b135c3aea427c817c4921befa84bbbadad17bbb1628eed73.exe 1728 ac6cd43b406c40e2b135c3aea427c817c4921befa84bbbadad17bbb1628eed73.exe 1728 ac6cd43b406c40e2b135c3aea427c817c4921befa84bbbadad17bbb1628eed73.exe 1728 ac6cd43b406c40e2b135c3aea427c817c4921befa84bbbadad17bbb1628eed73.exe 1728 ac6cd43b406c40e2b135c3aea427c817c4921befa84bbbadad17bbb1628eed73.exe 1728 ac6cd43b406c40e2b135c3aea427c817c4921befa84bbbadad17bbb1628eed73.exe 1728 ac6cd43b406c40e2b135c3aea427c817c4921befa84bbbadad17bbb1628eed73.exe 1728 ac6cd43b406c40e2b135c3aea427c817c4921befa84bbbadad17bbb1628eed73.exe 1728 ac6cd43b406c40e2b135c3aea427c817c4921befa84bbbadad17bbb1628eed73.exe 1728 ac6cd43b406c40e2b135c3aea427c817c4921befa84bbbadad17bbb1628eed73.exe 1728 ac6cd43b406c40e2b135c3aea427c817c4921befa84bbbadad17bbb1628eed73.exe 1728 ac6cd43b406c40e2b135c3aea427c817c4921befa84bbbadad17bbb1628eed73.exe 1728 ac6cd43b406c40e2b135c3aea427c817c4921befa84bbbadad17bbb1628eed73.exe 1728 ac6cd43b406c40e2b135c3aea427c817c4921befa84bbbadad17bbb1628eed73.exe 1728 ac6cd43b406c40e2b135c3aea427c817c4921befa84bbbadad17bbb1628eed73.exe 1728 ac6cd43b406c40e2b135c3aea427c817c4921befa84bbbadad17bbb1628eed73.exe 1728 ac6cd43b406c40e2b135c3aea427c817c4921befa84bbbadad17bbb1628eed73.exe -
Suspicious behavior: LoadsDriver 5 IoCs
Processes:
ac6cd43b406c40e2b135c3aea427c817c4921befa84bbbadad17bbb1628eed73.exepid process 460 1728 ac6cd43b406c40e2b135c3aea427c817c4921befa84bbbadad17bbb1628eed73.exe 460 1728 ac6cd43b406c40e2b135c3aea427c817c4921befa84bbbadad17bbb1628eed73.exe 1728 ac6cd43b406c40e2b135c3aea427c817c4921befa84bbbadad17bbb1628eed73.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
ac6cd43b406c40e2b135c3aea427c817c4921befa84bbbadad17bbb1628eed73.exetakeown.exedescription pid process Token: SeDebugPrivilege 1728 ac6cd43b406c40e2b135c3aea427c817c4921befa84bbbadad17bbb1628eed73.exe Token: SeTakeOwnershipPrivilege 1064 takeown.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
ac6cd43b406c40e2b135c3aea427c817c4921befa84bbbadad17bbb1628eed73.execmd.exedescription pid process target process PID 1728 wrote to memory of 2016 1728 ac6cd43b406c40e2b135c3aea427c817c4921befa84bbbadad17bbb1628eed73.exe cmd.exe PID 1728 wrote to memory of 2016 1728 ac6cd43b406c40e2b135c3aea427c817c4921befa84bbbadad17bbb1628eed73.exe cmd.exe PID 1728 wrote to memory of 2016 1728 ac6cd43b406c40e2b135c3aea427c817c4921befa84bbbadad17bbb1628eed73.exe cmd.exe PID 1728 wrote to memory of 2016 1728 ac6cd43b406c40e2b135c3aea427c817c4921befa84bbbadad17bbb1628eed73.exe cmd.exe PID 2016 wrote to memory of 1064 2016 cmd.exe takeown.exe PID 2016 wrote to memory of 1064 2016 cmd.exe takeown.exe PID 2016 wrote to memory of 1064 2016 cmd.exe takeown.exe PID 2016 wrote to memory of 1064 2016 cmd.exe takeown.exe PID 2016 wrote to memory of 792 2016 cmd.exe icacls.exe PID 2016 wrote to memory of 792 2016 cmd.exe icacls.exe PID 2016 wrote to memory of 792 2016 cmd.exe icacls.exe PID 2016 wrote to memory of 792 2016 cmd.exe icacls.exe PID 1728 wrote to memory of 1632 1728 ac6cd43b406c40e2b135c3aea427c817c4921befa84bbbadad17bbb1628eed73.exe cmd.exe PID 1728 wrote to memory of 1632 1728 ac6cd43b406c40e2b135c3aea427c817c4921befa84bbbadad17bbb1628eed73.exe cmd.exe PID 1728 wrote to memory of 1632 1728 ac6cd43b406c40e2b135c3aea427c817c4921befa84bbbadad17bbb1628eed73.exe cmd.exe PID 1728 wrote to memory of 1632 1728 ac6cd43b406c40e2b135c3aea427c817c4921befa84bbbadad17bbb1628eed73.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ac6cd43b406c40e2b135c3aea427c817c4921befa84bbbadad17bbb1628eed73.exe"C:\Users\Admin\AppData\Local\Temp\ac6cd43b406c40e2b135c3aea427c817c4921befa84bbbadad17bbb1628eed73.exe"1⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /c takeown /f C:\Windows\SysWOW64\wshtcpip.dll && icacls C:\Windows\SysWOW64\wshtcpip.dll /grant administrators:F2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\SysWOW64\wshtcpip.dll3⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\icacls.exeicacls C:\Windows\SysWOW64\wshtcpip.dll /grant administrators:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\ahnmove.bat2⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\ahnmove.batFilesize
181B
MD519b2a393858fca1b348005d2e76dc027
SHA1de3741d0dbc0873b6c159a5fe256c3e2bf714ac9
SHA25685e6e31ffe936ccc44718d3cda0a61d2b6160b4ec6625c4e2669859c6acd66ea
SHA512568e65fc83d84c604fa6938d528c45e4653989f7f47c18af9e2b26a834637b5746d7525a08100036c379b5eff4580bc696e8b5c4cc6eaea59046033e2f3d5490
-
memory/792-59-0x0000000000000000-mapping.dmp
-
memory/1064-58-0x0000000000000000-mapping.dmp
-
memory/1632-60-0x0000000000000000-mapping.dmp
-
memory/1728-54-0x0000000075CF1000-0x0000000075CF3000-memory.dmpFilesize
8KB
-
memory/1728-55-0x0000000001000000-0x000000000112D000-memory.dmpFilesize
1.2MB
-
memory/1728-56-0x0000000001000000-0x000000000112D000-memory.dmpFilesize
1.2MB
-
memory/1728-62-0x0000000001000000-0x000000000112D000-memory.dmpFilesize
1.2MB
-
memory/2016-57-0x0000000000000000-mapping.dmp