Analysis
-
max time kernel
98s -
max time network
79s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
20-10-2022 16:51
Behavioral task
behavioral1
Sample
3a42ce62dc71201bb0b8ee51bcae0504d98914c5ac78fddc733c97cb9a827fc0.exe
Resource
win7-20220812-en
General
-
Target
3a42ce62dc71201bb0b8ee51bcae0504d98914c5ac78fddc733c97cb9a827fc0.exe
-
Size
350KB
-
MD5
80fdd5e3fdfaba98ced681a84eb78d60
-
SHA1
7ae5391c4fd0c115c668a6341dbf60bd67d544e6
-
SHA256
3a42ce62dc71201bb0b8ee51bcae0504d98914c5ac78fddc733c97cb9a827fc0
-
SHA512
54c2a81a507b088fd9d55b213fac39bf9fb8cdd4dc0329fb31962ff5712db97e4356e1cdeab3fdda29da8fcdabbd0e5f8de533698d149f1a14f76fbc6b959476
-
SSDEEP
6144:XyXu7IEBSsQ9ElMwm60lmqs7MTRGA3h3GVqdppJXEGhBukJF/KAwxFUOWdEmh:X3BdQLL4BE93NGVYZX9BukJlwxSJdEm
Malware Config
Signatures
-
Drops file in Drivers directory 2 IoCs
Processes:
3a42ce62dc71201bb0b8ee51bcae0504d98914c5ac78fddc733c97cb9a827fc0.exedescription ioc process File created C:\Windows\SysWOW64\drivers\2e520b70.sys 3a42ce62dc71201bb0b8ee51bcae0504d98914c5ac78fddc733c97cb9a827fc0.exe File created C:\Windows\SysWOW64\drivers\52f93ef6.sys 3a42ce62dc71201bb0b8ee51bcae0504d98914c5ac78fddc733c97cb9a827fc0.exe -
Possible privilege escalation attempt 2 IoCs
Processes:
icacls.exetakeown.exepid process 364 icacls.exe 368 takeown.exe -
Sets service image path in registry 2 TTPs 2 IoCs
Processes:
3a42ce62dc71201bb0b8ee51bcae0504d98914c5ac78fddc733c97cb9a827fc0.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\2e520b70\ImagePath = "\\??\\C:\\Windows\\SysWOW64\\drivers\\2e520b70.sys" 3a42ce62dc71201bb0b8ee51bcae0504d98914c5ac78fddc733c97cb9a827fc0.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\52f93ef6\ImagePath = "\\??\\C:\\Windows\\SysWOW64\\drivers\\52f93ef6.sys" 3a42ce62dc71201bb0b8ee51bcae0504d98914c5ac78fddc733c97cb9a827fc0.exe -
Processes:
resource yara_rule behavioral1/memory/968-55-0x0000000001000000-0x000000000112D000-memory.dmp upx behavioral1/memory/968-56-0x0000000001000000-0x000000000112D000-memory.dmp upx behavioral1/memory/968-61-0x0000000001000000-0x000000000112D000-memory.dmp upx -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 780 cmd.exe -
Modifies file permissions 1 TTPs 2 IoCs
Processes:
icacls.exetakeown.exepid process 364 icacls.exe 368 takeown.exe -
Installs/modifies Browser Helper Object 2 TTPs 4 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
Processes:
3a42ce62dc71201bb0b8ee51bcae0504d98914c5ac78fddc733c97cb9a827fc0.exedescription ioc process Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF} 3a42ce62dc71201bb0b8ee51bcae0504d98914c5ac78fddc733c97cb9a827fc0.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E} 3a42ce62dc71201bb0b8ee51bcae0504d98914c5ac78fddc733c97cb9a827fc0.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3} 3a42ce62dc71201bb0b8ee51bcae0504d98914c5ac78fddc733c97cb9a827fc0.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects 3a42ce62dc71201bb0b8ee51bcae0504d98914c5ac78fddc733c97cb9a827fc0.exe -
Drops file in System32 directory 5 IoCs
Processes:
3a42ce62dc71201bb0b8ee51bcae0504d98914c5ac78fddc733c97cb9a827fc0.exedescription ioc process File opened for modification C:\Windows\SysWOW64\ws2tcpip.dll 3a42ce62dc71201bb0b8ee51bcae0504d98914c5ac78fddc733c97cb9a827fc0.exe File created C:\Windows\SysWOW64\wshtcpip.dll 3a42ce62dc71201bb0b8ee51bcae0504d98914c5ac78fddc733c97cb9a827fc0.exe File opened for modification C:\Windows\SysWOW64\goodsb.dll 3a42ce62dc71201bb0b8ee51bcae0504d98914c5ac78fddc733c97cb9a827fc0.exe File created C:\Windows\SysWOW64\goodsb.dll 3a42ce62dc71201bb0b8ee51bcae0504d98914c5ac78fddc733c97cb9a827fc0.exe File created C:\Windows\SysWOW64\ws2tcpip.dll 3a42ce62dc71201bb0b8ee51bcae0504d98914c5ac78fddc733c97cb9a827fc0.exe -
Modifies registry class 4 IoCs
Processes:
3a42ce62dc71201bb0b8ee51bcae0504d98914c5ac78fddc733c97cb9a827fc0.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\HOOK_ID 3a42ce62dc71201bb0b8ee51bcae0504d98914c5ac78fddc733c97cb9a827fc0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\HOOK_ID\name = "3a42ce62dc71201bb0b8ee51bcae0504d98914c5ac78fddc733c97cb9a827fc0.exe" 3a42ce62dc71201bb0b8ee51bcae0504d98914c5ac78fddc733c97cb9a827fc0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\SYS_DLL 3a42ce62dc71201bb0b8ee51bcae0504d98914c5ac78fddc733c97cb9a827fc0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\SYS_DLL\name = "Jn378.dll" 3a42ce62dc71201bb0b8ee51bcae0504d98914c5ac78fddc733c97cb9a827fc0.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
3a42ce62dc71201bb0b8ee51bcae0504d98914c5ac78fddc733c97cb9a827fc0.exepid process 968 3a42ce62dc71201bb0b8ee51bcae0504d98914c5ac78fddc733c97cb9a827fc0.exe 968 3a42ce62dc71201bb0b8ee51bcae0504d98914c5ac78fddc733c97cb9a827fc0.exe 968 3a42ce62dc71201bb0b8ee51bcae0504d98914c5ac78fddc733c97cb9a827fc0.exe 968 3a42ce62dc71201bb0b8ee51bcae0504d98914c5ac78fddc733c97cb9a827fc0.exe 968 3a42ce62dc71201bb0b8ee51bcae0504d98914c5ac78fddc733c97cb9a827fc0.exe 968 3a42ce62dc71201bb0b8ee51bcae0504d98914c5ac78fddc733c97cb9a827fc0.exe 968 3a42ce62dc71201bb0b8ee51bcae0504d98914c5ac78fddc733c97cb9a827fc0.exe 968 3a42ce62dc71201bb0b8ee51bcae0504d98914c5ac78fddc733c97cb9a827fc0.exe 968 3a42ce62dc71201bb0b8ee51bcae0504d98914c5ac78fddc733c97cb9a827fc0.exe 968 3a42ce62dc71201bb0b8ee51bcae0504d98914c5ac78fddc733c97cb9a827fc0.exe 968 3a42ce62dc71201bb0b8ee51bcae0504d98914c5ac78fddc733c97cb9a827fc0.exe 968 3a42ce62dc71201bb0b8ee51bcae0504d98914c5ac78fddc733c97cb9a827fc0.exe 968 3a42ce62dc71201bb0b8ee51bcae0504d98914c5ac78fddc733c97cb9a827fc0.exe 968 3a42ce62dc71201bb0b8ee51bcae0504d98914c5ac78fddc733c97cb9a827fc0.exe 968 3a42ce62dc71201bb0b8ee51bcae0504d98914c5ac78fddc733c97cb9a827fc0.exe 968 3a42ce62dc71201bb0b8ee51bcae0504d98914c5ac78fddc733c97cb9a827fc0.exe 968 3a42ce62dc71201bb0b8ee51bcae0504d98914c5ac78fddc733c97cb9a827fc0.exe 968 3a42ce62dc71201bb0b8ee51bcae0504d98914c5ac78fddc733c97cb9a827fc0.exe 968 3a42ce62dc71201bb0b8ee51bcae0504d98914c5ac78fddc733c97cb9a827fc0.exe 968 3a42ce62dc71201bb0b8ee51bcae0504d98914c5ac78fddc733c97cb9a827fc0.exe 968 3a42ce62dc71201bb0b8ee51bcae0504d98914c5ac78fddc733c97cb9a827fc0.exe 968 3a42ce62dc71201bb0b8ee51bcae0504d98914c5ac78fddc733c97cb9a827fc0.exe 968 3a42ce62dc71201bb0b8ee51bcae0504d98914c5ac78fddc733c97cb9a827fc0.exe 968 3a42ce62dc71201bb0b8ee51bcae0504d98914c5ac78fddc733c97cb9a827fc0.exe 968 3a42ce62dc71201bb0b8ee51bcae0504d98914c5ac78fddc733c97cb9a827fc0.exe 968 3a42ce62dc71201bb0b8ee51bcae0504d98914c5ac78fddc733c97cb9a827fc0.exe 968 3a42ce62dc71201bb0b8ee51bcae0504d98914c5ac78fddc733c97cb9a827fc0.exe 968 3a42ce62dc71201bb0b8ee51bcae0504d98914c5ac78fddc733c97cb9a827fc0.exe 968 3a42ce62dc71201bb0b8ee51bcae0504d98914c5ac78fddc733c97cb9a827fc0.exe 968 3a42ce62dc71201bb0b8ee51bcae0504d98914c5ac78fddc733c97cb9a827fc0.exe 968 3a42ce62dc71201bb0b8ee51bcae0504d98914c5ac78fddc733c97cb9a827fc0.exe 968 3a42ce62dc71201bb0b8ee51bcae0504d98914c5ac78fddc733c97cb9a827fc0.exe 968 3a42ce62dc71201bb0b8ee51bcae0504d98914c5ac78fddc733c97cb9a827fc0.exe 968 3a42ce62dc71201bb0b8ee51bcae0504d98914c5ac78fddc733c97cb9a827fc0.exe 968 3a42ce62dc71201bb0b8ee51bcae0504d98914c5ac78fddc733c97cb9a827fc0.exe 968 3a42ce62dc71201bb0b8ee51bcae0504d98914c5ac78fddc733c97cb9a827fc0.exe 968 3a42ce62dc71201bb0b8ee51bcae0504d98914c5ac78fddc733c97cb9a827fc0.exe 968 3a42ce62dc71201bb0b8ee51bcae0504d98914c5ac78fddc733c97cb9a827fc0.exe 968 3a42ce62dc71201bb0b8ee51bcae0504d98914c5ac78fddc733c97cb9a827fc0.exe 968 3a42ce62dc71201bb0b8ee51bcae0504d98914c5ac78fddc733c97cb9a827fc0.exe 968 3a42ce62dc71201bb0b8ee51bcae0504d98914c5ac78fddc733c97cb9a827fc0.exe 968 3a42ce62dc71201bb0b8ee51bcae0504d98914c5ac78fddc733c97cb9a827fc0.exe 968 3a42ce62dc71201bb0b8ee51bcae0504d98914c5ac78fddc733c97cb9a827fc0.exe 968 3a42ce62dc71201bb0b8ee51bcae0504d98914c5ac78fddc733c97cb9a827fc0.exe 968 3a42ce62dc71201bb0b8ee51bcae0504d98914c5ac78fddc733c97cb9a827fc0.exe 968 3a42ce62dc71201bb0b8ee51bcae0504d98914c5ac78fddc733c97cb9a827fc0.exe 968 3a42ce62dc71201bb0b8ee51bcae0504d98914c5ac78fddc733c97cb9a827fc0.exe 968 3a42ce62dc71201bb0b8ee51bcae0504d98914c5ac78fddc733c97cb9a827fc0.exe 968 3a42ce62dc71201bb0b8ee51bcae0504d98914c5ac78fddc733c97cb9a827fc0.exe 968 3a42ce62dc71201bb0b8ee51bcae0504d98914c5ac78fddc733c97cb9a827fc0.exe 968 3a42ce62dc71201bb0b8ee51bcae0504d98914c5ac78fddc733c97cb9a827fc0.exe 968 3a42ce62dc71201bb0b8ee51bcae0504d98914c5ac78fddc733c97cb9a827fc0.exe 968 3a42ce62dc71201bb0b8ee51bcae0504d98914c5ac78fddc733c97cb9a827fc0.exe 968 3a42ce62dc71201bb0b8ee51bcae0504d98914c5ac78fddc733c97cb9a827fc0.exe 968 3a42ce62dc71201bb0b8ee51bcae0504d98914c5ac78fddc733c97cb9a827fc0.exe 968 3a42ce62dc71201bb0b8ee51bcae0504d98914c5ac78fddc733c97cb9a827fc0.exe 968 3a42ce62dc71201bb0b8ee51bcae0504d98914c5ac78fddc733c97cb9a827fc0.exe 968 3a42ce62dc71201bb0b8ee51bcae0504d98914c5ac78fddc733c97cb9a827fc0.exe 968 3a42ce62dc71201bb0b8ee51bcae0504d98914c5ac78fddc733c97cb9a827fc0.exe 968 3a42ce62dc71201bb0b8ee51bcae0504d98914c5ac78fddc733c97cb9a827fc0.exe 968 3a42ce62dc71201bb0b8ee51bcae0504d98914c5ac78fddc733c97cb9a827fc0.exe 968 3a42ce62dc71201bb0b8ee51bcae0504d98914c5ac78fddc733c97cb9a827fc0.exe 968 3a42ce62dc71201bb0b8ee51bcae0504d98914c5ac78fddc733c97cb9a827fc0.exe 968 3a42ce62dc71201bb0b8ee51bcae0504d98914c5ac78fddc733c97cb9a827fc0.exe -
Suspicious behavior: LoadsDriver 5 IoCs
Processes:
3a42ce62dc71201bb0b8ee51bcae0504d98914c5ac78fddc733c97cb9a827fc0.exepid process 464 968 3a42ce62dc71201bb0b8ee51bcae0504d98914c5ac78fddc733c97cb9a827fc0.exe 464 968 3a42ce62dc71201bb0b8ee51bcae0504d98914c5ac78fddc733c97cb9a827fc0.exe 968 3a42ce62dc71201bb0b8ee51bcae0504d98914c5ac78fddc733c97cb9a827fc0.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
3a42ce62dc71201bb0b8ee51bcae0504d98914c5ac78fddc733c97cb9a827fc0.exetakeown.exedescription pid process Token: SeDebugPrivilege 968 3a42ce62dc71201bb0b8ee51bcae0504d98914c5ac78fddc733c97cb9a827fc0.exe Token: SeTakeOwnershipPrivilege 368 takeown.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
3a42ce62dc71201bb0b8ee51bcae0504d98914c5ac78fddc733c97cb9a827fc0.execmd.exedescription pid process target process PID 968 wrote to memory of 536 968 3a42ce62dc71201bb0b8ee51bcae0504d98914c5ac78fddc733c97cb9a827fc0.exe cmd.exe PID 968 wrote to memory of 536 968 3a42ce62dc71201bb0b8ee51bcae0504d98914c5ac78fddc733c97cb9a827fc0.exe cmd.exe PID 968 wrote to memory of 536 968 3a42ce62dc71201bb0b8ee51bcae0504d98914c5ac78fddc733c97cb9a827fc0.exe cmd.exe PID 968 wrote to memory of 536 968 3a42ce62dc71201bb0b8ee51bcae0504d98914c5ac78fddc733c97cb9a827fc0.exe cmd.exe PID 536 wrote to memory of 368 536 cmd.exe takeown.exe PID 536 wrote to memory of 368 536 cmd.exe takeown.exe PID 536 wrote to memory of 368 536 cmd.exe takeown.exe PID 536 wrote to memory of 368 536 cmd.exe takeown.exe PID 536 wrote to memory of 364 536 cmd.exe icacls.exe PID 536 wrote to memory of 364 536 cmd.exe icacls.exe PID 536 wrote to memory of 364 536 cmd.exe icacls.exe PID 536 wrote to memory of 364 536 cmd.exe icacls.exe PID 968 wrote to memory of 780 968 3a42ce62dc71201bb0b8ee51bcae0504d98914c5ac78fddc733c97cb9a827fc0.exe cmd.exe PID 968 wrote to memory of 780 968 3a42ce62dc71201bb0b8ee51bcae0504d98914c5ac78fddc733c97cb9a827fc0.exe cmd.exe PID 968 wrote to memory of 780 968 3a42ce62dc71201bb0b8ee51bcae0504d98914c5ac78fddc733c97cb9a827fc0.exe cmd.exe PID 968 wrote to memory of 780 968 3a42ce62dc71201bb0b8ee51bcae0504d98914c5ac78fddc733c97cb9a827fc0.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3a42ce62dc71201bb0b8ee51bcae0504d98914c5ac78fddc733c97cb9a827fc0.exe"C:\Users\Admin\AppData\Local\Temp\3a42ce62dc71201bb0b8ee51bcae0504d98914c5ac78fddc733c97cb9a827fc0.exe"1⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /c takeown /f C:\Windows\SysWOW64\wshtcpip.dll && icacls C:\Windows\SysWOW64\wshtcpip.dll /grant administrators:F2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\icacls.exeicacls C:\Windows\SysWOW64\wshtcpip.dll /grant administrators:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\SysWOW64\wshtcpip.dll3⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\ahnmove.bat2⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\ahnmove.batFilesize
181B
MD5f11b6a7c240583f4c5f5a6bf305faba8
SHA19d0f08bf31da8a594017a8b100388a2427943d9a
SHA256dfac64e662905004204ae16fac6685d314cd61a5b4238bed72e3ef7a04d653c8
SHA512d8897ebe26f2fbb7ee24a306dfd66cb477f9371cc7dfab11b8918016ec4c17f2d6e06b990e4e13e9c0822b3b4d4b3626de5b7894465379e6c798a370220d9b1f
-
memory/364-59-0x0000000000000000-mapping.dmp
-
memory/368-58-0x0000000000000000-mapping.dmp
-
memory/536-57-0x0000000000000000-mapping.dmp
-
memory/780-60-0x0000000000000000-mapping.dmp
-
memory/968-54-0x0000000075501000-0x0000000075503000-memory.dmpFilesize
8KB
-
memory/968-55-0x0000000001000000-0x000000000112D000-memory.dmpFilesize
1.2MB
-
memory/968-56-0x0000000001000000-0x000000000112D000-memory.dmpFilesize
1.2MB
-
memory/968-61-0x0000000001000000-0x000000000112D000-memory.dmpFilesize
1.2MB