Analysis
-
max time kernel
79s -
max time network
66s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
13-10-2022 15:24
Behavioral task
behavioral1
Sample
3158cda4e07d82f1fd2dc35d742a604d1f5cdb61c5735691f214bfb53833bd26.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
3158cda4e07d82f1fd2dc35d742a604d1f5cdb61c5735691f214bfb53833bd26.exe
Resource
win10v2004-20220901-en
General
-
Target
3158cda4e07d82f1fd2dc35d742a604d1f5cdb61c5735691f214bfb53833bd26.exe
-
Size
350KB
-
MD5
6df0fd28e6eb0fc7f5378a3f3bac59b0
-
SHA1
b3ab7616456a66149286f936001affad10e35388
-
SHA256
3158cda4e07d82f1fd2dc35d742a604d1f5cdb61c5735691f214bfb53833bd26
-
SHA512
69f8af1ae83800b9a40cf381ef573e0ea865329d07139f943fbc21e225453951bf0444e9d2f565dea097d8a905951f802a48749a51f96e519dd625766f84b7d7
-
SSDEEP
6144:/yXu7IEBSsQ9ElMwm60lmqs7MTRGA3h3GVqdppJXEGhBukJF/KAwxFUOWdEmh:/3BdQLL4BE93NGVYZX9BukJlwxSJdEm
Malware Config
Signatures
-
Drops file in Drivers directory 2 IoCs
Processes:
3158cda4e07d82f1fd2dc35d742a604d1f5cdb61c5735691f214bfb53833bd26.exedescription ioc process File created C:\Windows\SysWOW64\drivers\30f52960.sys 3158cda4e07d82f1fd2dc35d742a604d1f5cdb61c5735691f214bfb53833bd26.exe File created C:\Windows\SysWOW64\drivers\4c5e1ce6.sys 3158cda4e07d82f1fd2dc35d742a604d1f5cdb61c5735691f214bfb53833bd26.exe -
Possible privilege escalation attempt 2 IoCs
Processes:
takeown.exeicacls.exepid process 1144 takeown.exe 1556 icacls.exe -
Sets service image path in registry 2 TTPs 2 IoCs
Processes:
3158cda4e07d82f1fd2dc35d742a604d1f5cdb61c5735691f214bfb53833bd26.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\30f52960\ImagePath = "\\??\\C:\\Windows\\SysWOW64\\drivers\\30f52960.sys" 3158cda4e07d82f1fd2dc35d742a604d1f5cdb61c5735691f214bfb53833bd26.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\4c5e1ce6\ImagePath = "\\??\\C:\\Windows\\SysWOW64\\drivers\\4c5e1ce6.sys" 3158cda4e07d82f1fd2dc35d742a604d1f5cdb61c5735691f214bfb53833bd26.exe -
Processes:
resource yara_rule behavioral1/memory/2016-54-0x0000000001000000-0x000000000112D000-memory.dmp upx behavioral1/memory/2016-56-0x0000000001000000-0x000000000112D000-memory.dmp upx behavioral1/memory/2016-61-0x0000000001000000-0x000000000112D000-memory.dmp upx -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1060 cmd.exe -
Modifies file permissions 1 TTPs 2 IoCs
Processes:
takeown.exeicacls.exepid process 1144 takeown.exe 1556 icacls.exe -
Installs/modifies Browser Helper Object 2 TTPs 4 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
Processes:
3158cda4e07d82f1fd2dc35d742a604d1f5cdb61c5735691f214bfb53833bd26.exedescription ioc process Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF} 3158cda4e07d82f1fd2dc35d742a604d1f5cdb61c5735691f214bfb53833bd26.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E} 3158cda4e07d82f1fd2dc35d742a604d1f5cdb61c5735691f214bfb53833bd26.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3} 3158cda4e07d82f1fd2dc35d742a604d1f5cdb61c5735691f214bfb53833bd26.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects 3158cda4e07d82f1fd2dc35d742a604d1f5cdb61c5735691f214bfb53833bd26.exe -
Drops file in System32 directory 5 IoCs
Processes:
3158cda4e07d82f1fd2dc35d742a604d1f5cdb61c5735691f214bfb53833bd26.exedescription ioc process File created C:\Windows\SysWOW64\ws2tcpip.dll 3158cda4e07d82f1fd2dc35d742a604d1f5cdb61c5735691f214bfb53833bd26.exe File opened for modification C:\Windows\SysWOW64\ws2tcpip.dll 3158cda4e07d82f1fd2dc35d742a604d1f5cdb61c5735691f214bfb53833bd26.exe File created C:\Windows\SysWOW64\wshtcpip.dll 3158cda4e07d82f1fd2dc35d742a604d1f5cdb61c5735691f214bfb53833bd26.exe File opened for modification C:\Windows\SysWOW64\goodsb.dll 3158cda4e07d82f1fd2dc35d742a604d1f5cdb61c5735691f214bfb53833bd26.exe File created C:\Windows\SysWOW64\goodsb.dll 3158cda4e07d82f1fd2dc35d742a604d1f5cdb61c5735691f214bfb53833bd26.exe -
Modifies registry class 4 IoCs
Processes:
3158cda4e07d82f1fd2dc35d742a604d1f5cdb61c5735691f214bfb53833bd26.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\HOOK_ID 3158cda4e07d82f1fd2dc35d742a604d1f5cdb61c5735691f214bfb53833bd26.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\HOOK_ID\name = "3158cda4e07d82f1fd2dc35d742a604d1f5cdb61c5735691f214bfb53833bd26.exe" 3158cda4e07d82f1fd2dc35d742a604d1f5cdb61c5735691f214bfb53833bd26.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\SYS_DLL 3158cda4e07d82f1fd2dc35d742a604d1f5cdb61c5735691f214bfb53833bd26.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\SYS_DLL\name = "re2b5Y3.dll" 3158cda4e07d82f1fd2dc35d742a604d1f5cdb61c5735691f214bfb53833bd26.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
3158cda4e07d82f1fd2dc35d742a604d1f5cdb61c5735691f214bfb53833bd26.exepid process 2016 3158cda4e07d82f1fd2dc35d742a604d1f5cdb61c5735691f214bfb53833bd26.exe 2016 3158cda4e07d82f1fd2dc35d742a604d1f5cdb61c5735691f214bfb53833bd26.exe 2016 3158cda4e07d82f1fd2dc35d742a604d1f5cdb61c5735691f214bfb53833bd26.exe 2016 3158cda4e07d82f1fd2dc35d742a604d1f5cdb61c5735691f214bfb53833bd26.exe 2016 3158cda4e07d82f1fd2dc35d742a604d1f5cdb61c5735691f214bfb53833bd26.exe 2016 3158cda4e07d82f1fd2dc35d742a604d1f5cdb61c5735691f214bfb53833bd26.exe 2016 3158cda4e07d82f1fd2dc35d742a604d1f5cdb61c5735691f214bfb53833bd26.exe 2016 3158cda4e07d82f1fd2dc35d742a604d1f5cdb61c5735691f214bfb53833bd26.exe 2016 3158cda4e07d82f1fd2dc35d742a604d1f5cdb61c5735691f214bfb53833bd26.exe 2016 3158cda4e07d82f1fd2dc35d742a604d1f5cdb61c5735691f214bfb53833bd26.exe 2016 3158cda4e07d82f1fd2dc35d742a604d1f5cdb61c5735691f214bfb53833bd26.exe 2016 3158cda4e07d82f1fd2dc35d742a604d1f5cdb61c5735691f214bfb53833bd26.exe 2016 3158cda4e07d82f1fd2dc35d742a604d1f5cdb61c5735691f214bfb53833bd26.exe 2016 3158cda4e07d82f1fd2dc35d742a604d1f5cdb61c5735691f214bfb53833bd26.exe 2016 3158cda4e07d82f1fd2dc35d742a604d1f5cdb61c5735691f214bfb53833bd26.exe 2016 3158cda4e07d82f1fd2dc35d742a604d1f5cdb61c5735691f214bfb53833bd26.exe 2016 3158cda4e07d82f1fd2dc35d742a604d1f5cdb61c5735691f214bfb53833bd26.exe 2016 3158cda4e07d82f1fd2dc35d742a604d1f5cdb61c5735691f214bfb53833bd26.exe 2016 3158cda4e07d82f1fd2dc35d742a604d1f5cdb61c5735691f214bfb53833bd26.exe 2016 3158cda4e07d82f1fd2dc35d742a604d1f5cdb61c5735691f214bfb53833bd26.exe 2016 3158cda4e07d82f1fd2dc35d742a604d1f5cdb61c5735691f214bfb53833bd26.exe 2016 3158cda4e07d82f1fd2dc35d742a604d1f5cdb61c5735691f214bfb53833bd26.exe 2016 3158cda4e07d82f1fd2dc35d742a604d1f5cdb61c5735691f214bfb53833bd26.exe 2016 3158cda4e07d82f1fd2dc35d742a604d1f5cdb61c5735691f214bfb53833bd26.exe 2016 3158cda4e07d82f1fd2dc35d742a604d1f5cdb61c5735691f214bfb53833bd26.exe 2016 3158cda4e07d82f1fd2dc35d742a604d1f5cdb61c5735691f214bfb53833bd26.exe 2016 3158cda4e07d82f1fd2dc35d742a604d1f5cdb61c5735691f214bfb53833bd26.exe 2016 3158cda4e07d82f1fd2dc35d742a604d1f5cdb61c5735691f214bfb53833bd26.exe 2016 3158cda4e07d82f1fd2dc35d742a604d1f5cdb61c5735691f214bfb53833bd26.exe 2016 3158cda4e07d82f1fd2dc35d742a604d1f5cdb61c5735691f214bfb53833bd26.exe 2016 3158cda4e07d82f1fd2dc35d742a604d1f5cdb61c5735691f214bfb53833bd26.exe 2016 3158cda4e07d82f1fd2dc35d742a604d1f5cdb61c5735691f214bfb53833bd26.exe 2016 3158cda4e07d82f1fd2dc35d742a604d1f5cdb61c5735691f214bfb53833bd26.exe 2016 3158cda4e07d82f1fd2dc35d742a604d1f5cdb61c5735691f214bfb53833bd26.exe 2016 3158cda4e07d82f1fd2dc35d742a604d1f5cdb61c5735691f214bfb53833bd26.exe 2016 3158cda4e07d82f1fd2dc35d742a604d1f5cdb61c5735691f214bfb53833bd26.exe 2016 3158cda4e07d82f1fd2dc35d742a604d1f5cdb61c5735691f214bfb53833bd26.exe 2016 3158cda4e07d82f1fd2dc35d742a604d1f5cdb61c5735691f214bfb53833bd26.exe 2016 3158cda4e07d82f1fd2dc35d742a604d1f5cdb61c5735691f214bfb53833bd26.exe 2016 3158cda4e07d82f1fd2dc35d742a604d1f5cdb61c5735691f214bfb53833bd26.exe 2016 3158cda4e07d82f1fd2dc35d742a604d1f5cdb61c5735691f214bfb53833bd26.exe 2016 3158cda4e07d82f1fd2dc35d742a604d1f5cdb61c5735691f214bfb53833bd26.exe 2016 3158cda4e07d82f1fd2dc35d742a604d1f5cdb61c5735691f214bfb53833bd26.exe 2016 3158cda4e07d82f1fd2dc35d742a604d1f5cdb61c5735691f214bfb53833bd26.exe 2016 3158cda4e07d82f1fd2dc35d742a604d1f5cdb61c5735691f214bfb53833bd26.exe 2016 3158cda4e07d82f1fd2dc35d742a604d1f5cdb61c5735691f214bfb53833bd26.exe 2016 3158cda4e07d82f1fd2dc35d742a604d1f5cdb61c5735691f214bfb53833bd26.exe 2016 3158cda4e07d82f1fd2dc35d742a604d1f5cdb61c5735691f214bfb53833bd26.exe 2016 3158cda4e07d82f1fd2dc35d742a604d1f5cdb61c5735691f214bfb53833bd26.exe 2016 3158cda4e07d82f1fd2dc35d742a604d1f5cdb61c5735691f214bfb53833bd26.exe 2016 3158cda4e07d82f1fd2dc35d742a604d1f5cdb61c5735691f214bfb53833bd26.exe 2016 3158cda4e07d82f1fd2dc35d742a604d1f5cdb61c5735691f214bfb53833bd26.exe 2016 3158cda4e07d82f1fd2dc35d742a604d1f5cdb61c5735691f214bfb53833bd26.exe 2016 3158cda4e07d82f1fd2dc35d742a604d1f5cdb61c5735691f214bfb53833bd26.exe 2016 3158cda4e07d82f1fd2dc35d742a604d1f5cdb61c5735691f214bfb53833bd26.exe 2016 3158cda4e07d82f1fd2dc35d742a604d1f5cdb61c5735691f214bfb53833bd26.exe 2016 3158cda4e07d82f1fd2dc35d742a604d1f5cdb61c5735691f214bfb53833bd26.exe 2016 3158cda4e07d82f1fd2dc35d742a604d1f5cdb61c5735691f214bfb53833bd26.exe 2016 3158cda4e07d82f1fd2dc35d742a604d1f5cdb61c5735691f214bfb53833bd26.exe 2016 3158cda4e07d82f1fd2dc35d742a604d1f5cdb61c5735691f214bfb53833bd26.exe 2016 3158cda4e07d82f1fd2dc35d742a604d1f5cdb61c5735691f214bfb53833bd26.exe 2016 3158cda4e07d82f1fd2dc35d742a604d1f5cdb61c5735691f214bfb53833bd26.exe 2016 3158cda4e07d82f1fd2dc35d742a604d1f5cdb61c5735691f214bfb53833bd26.exe 2016 3158cda4e07d82f1fd2dc35d742a604d1f5cdb61c5735691f214bfb53833bd26.exe -
Suspicious behavior: LoadsDriver 5 IoCs
Processes:
3158cda4e07d82f1fd2dc35d742a604d1f5cdb61c5735691f214bfb53833bd26.exepid process 460 2016 3158cda4e07d82f1fd2dc35d742a604d1f5cdb61c5735691f214bfb53833bd26.exe 460 2016 3158cda4e07d82f1fd2dc35d742a604d1f5cdb61c5735691f214bfb53833bd26.exe 2016 3158cda4e07d82f1fd2dc35d742a604d1f5cdb61c5735691f214bfb53833bd26.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
3158cda4e07d82f1fd2dc35d742a604d1f5cdb61c5735691f214bfb53833bd26.exetakeown.exedescription pid process Token: SeDebugPrivilege 2016 3158cda4e07d82f1fd2dc35d742a604d1f5cdb61c5735691f214bfb53833bd26.exe Token: SeTakeOwnershipPrivilege 1144 takeown.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
3158cda4e07d82f1fd2dc35d742a604d1f5cdb61c5735691f214bfb53833bd26.execmd.exedescription pid process target process PID 2016 wrote to memory of 1420 2016 3158cda4e07d82f1fd2dc35d742a604d1f5cdb61c5735691f214bfb53833bd26.exe cmd.exe PID 2016 wrote to memory of 1420 2016 3158cda4e07d82f1fd2dc35d742a604d1f5cdb61c5735691f214bfb53833bd26.exe cmd.exe PID 2016 wrote to memory of 1420 2016 3158cda4e07d82f1fd2dc35d742a604d1f5cdb61c5735691f214bfb53833bd26.exe cmd.exe PID 2016 wrote to memory of 1420 2016 3158cda4e07d82f1fd2dc35d742a604d1f5cdb61c5735691f214bfb53833bd26.exe cmd.exe PID 1420 wrote to memory of 1144 1420 cmd.exe takeown.exe PID 1420 wrote to memory of 1144 1420 cmd.exe takeown.exe PID 1420 wrote to memory of 1144 1420 cmd.exe takeown.exe PID 1420 wrote to memory of 1144 1420 cmd.exe takeown.exe PID 1420 wrote to memory of 1556 1420 cmd.exe icacls.exe PID 1420 wrote to memory of 1556 1420 cmd.exe icacls.exe PID 1420 wrote to memory of 1556 1420 cmd.exe icacls.exe PID 1420 wrote to memory of 1556 1420 cmd.exe icacls.exe PID 2016 wrote to memory of 1060 2016 3158cda4e07d82f1fd2dc35d742a604d1f5cdb61c5735691f214bfb53833bd26.exe cmd.exe PID 2016 wrote to memory of 1060 2016 3158cda4e07d82f1fd2dc35d742a604d1f5cdb61c5735691f214bfb53833bd26.exe cmd.exe PID 2016 wrote to memory of 1060 2016 3158cda4e07d82f1fd2dc35d742a604d1f5cdb61c5735691f214bfb53833bd26.exe cmd.exe PID 2016 wrote to memory of 1060 2016 3158cda4e07d82f1fd2dc35d742a604d1f5cdb61c5735691f214bfb53833bd26.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3158cda4e07d82f1fd2dc35d742a604d1f5cdb61c5735691f214bfb53833bd26.exe"C:\Users\Admin\AppData\Local\Temp\3158cda4e07d82f1fd2dc35d742a604d1f5cdb61c5735691f214bfb53833bd26.exe"1⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /c takeown /f C:\Windows\SysWOW64\wshtcpip.dll && icacls C:\Windows\SysWOW64\wshtcpip.dll /grant administrators:F2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\SysWOW64\wshtcpip.dll3⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\icacls.exeicacls C:\Windows\SysWOW64\wshtcpip.dll /grant administrators:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\ahnmove.bat2⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\ahnmove.batFilesize
181B
MD555d461f73fb10ce37344f136e6cc1841
SHA11d0d6ef181bf155bb80f6632da5476ab9a6f346e
SHA2566ae0a273690cebadc37a98b53cf92cadd16ffcf8f9f9e6034c45b32bb7579a11
SHA5124f85ac057474a738565db19e2c0ea67b89f9739631da5d3dffec3f9f85f05c305c51a34fdeb453d623aea039c8465c2fae2b461d37e29ff84f121376769e9b71
-
memory/1060-60-0x0000000000000000-mapping.dmp
-
memory/1144-58-0x0000000000000000-mapping.dmp
-
memory/1420-57-0x0000000000000000-mapping.dmp
-
memory/1556-59-0x0000000000000000-mapping.dmp
-
memory/2016-54-0x0000000001000000-0x000000000112D000-memory.dmpFilesize
1.2MB
-
memory/2016-55-0x00000000761F1000-0x00000000761F3000-memory.dmpFilesize
8KB
-
memory/2016-56-0x0000000001000000-0x000000000112D000-memory.dmpFilesize
1.2MB
-
memory/2016-61-0x0000000001000000-0x000000000112D000-memory.dmpFilesize
1.2MB