Analysis

  • max time kernel
    68s
  • max time network
    53s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    29-10-2022 12:45

General

  • Target

    e7f0a3a3553dc4eb25e9337f664d93c8fd951a328952883f10f09621a2255968.exe

  • Size

    1.3MB

  • MD5

    ef47687cddafd1fb06d3705b3409a52e

  • SHA1

    5c3c7ed3705205c38cf2a12a1ccc9a4e394da1ee

  • SHA256

    e7f0a3a3553dc4eb25e9337f664d93c8fd951a328952883f10f09621a2255968

  • SHA512

    b178465e17738f9489fc75bd5d5866de361bd88182bf214066884fa3e9d7a83ec40b7d4b9ba063d6668c0ae86e22d4385ad51994116c414651434a4225eb5100

  • SSDEEP

    24576:u7Djpcup0fXIXSxJxqW6ZvNrryeq7Xr8N9bb3DFsH:uzmupI9xJEWstyewkb7ZsH

Malware Config

Signatures

  • Drops file in Drivers directory 1 IoCs
  • Executes dropped EXE 3 IoCs
  • Possible privilege escalation attempt 4 IoCs
  • Sets service image path in registry 2 TTPs 1 IoCs
  • Deletes itself 1 IoCs
  • Loads dropped DLL 6 IoCs
  • Modifies file permissions 1 TTPs 4 IoCs
  • Installs/modifies Browser Helper Object 2 TTPs 4 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

  • Maps connected drives based on registry 3 TTPs 3 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory 4 IoCs
  • Modifies registry class 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 40 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e7f0a3a3553dc4eb25e9337f664d93c8fd951a328952883f10f09621a2255968.exe
    "C:\Users\Admin\AppData\Local\Temp\e7f0a3a3553dc4eb25e9337f664d93c8fd951a328952883f10f09621a2255968.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1132
    • C:\Users\Admin\AppData\Local\Temp\6c2e90.tmp
      >C:\Users\Admin\AppData\Local\Temp\e7f0a3a3553dc4eb25e9337f664d93c8fd951a328952883f10f09621a2255968.exe
      2⤵
      • Executes dropped EXE
      • Deletes itself
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1172
      • C:\Users\Admin\AppData\Local\Temp\e7f0a3a3553dc4eb25e9337f664d93c8fd951a328952883f10f09621a2255968.exe
        "C:\Users\Admin\AppData\Local\Temp\e7f0a3a3553dc4eb25e9337f664d93c8fd951a328952883f10f09621a2255968.exe"
        3⤵
        • Executes dropped EXE
        PID:280
      • C:\Users\Admin\AppData\Local\Temp\6c364d.exe
        "C:\Users\Admin\AppData\Local\Temp\\6c364d.exe"
        3⤵
        • Drops file in Drivers directory
        • Executes dropped EXE
        • Sets service image path in registry
        • Installs/modifies Browser Helper Object
        • Maps connected drives based on registry
        • Drops file in System32 directory
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: LoadsDriver
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:944
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c takeown /f C:\Windows\SysWOW64\wshtcpip.dll && icacls C:\Windows\SysWOW64\wshtcpip.dll /grant administrators:F
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1004
          • C:\Windows\SysWOW64\takeown.exe
            takeown /f C:\Windows\SysWOW64\wshtcpip.dll
            5⤵
            • Possible privilege escalation attempt
            • Modifies file permissions
            • Suspicious use of AdjustPrivilegeToken
            PID:484
          • C:\Windows\SysWOW64\icacls.exe
            icacls C:\Windows\SysWOW64\wshtcpip.dll /grant administrators:F
            5⤵
            • Possible privilege escalation attempt
            • Modifies file permissions
            PID:964
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c takeown /f C:\Windows\SysWOW64\midimap.dll && icacls C:\Windows\SysWOW64\midimap.dll /grant administrators:F
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1724
          • C:\Windows\SysWOW64\takeown.exe
            takeown /f C:\Windows\SysWOW64\midimap.dll
            5⤵
            • Possible privilege escalation attempt
            • Modifies file permissions
            • Suspicious use of AdjustPrivilegeToken
            PID:1332
          • C:\Windows\SysWOW64\icacls.exe
            icacls C:\Windows\SysWOW64\midimap.dll /grant administrators:F
            5⤵
            • Possible privilege escalation attempt
            • Modifies file permissions
            PID:1284
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c C:\Users\Admin\AppData\Local\Temp\ahnmove.bat
          4⤵
            PID:1540

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\6c2e90.tmp
      Filesize

      1.3MB

      MD5

      ef47687cddafd1fb06d3705b3409a52e

      SHA1

      5c3c7ed3705205c38cf2a12a1ccc9a4e394da1ee

      SHA256

      e7f0a3a3553dc4eb25e9337f664d93c8fd951a328952883f10f09621a2255968

      SHA512

      b178465e17738f9489fc75bd5d5866de361bd88182bf214066884fa3e9d7a83ec40b7d4b9ba063d6668c0ae86e22d4385ad51994116c414651434a4225eb5100

    • C:\Users\Admin\AppData\Local\Temp\6c2e90.tmp
      Filesize

      1.3MB

      MD5

      ef47687cddafd1fb06d3705b3409a52e

      SHA1

      5c3c7ed3705205c38cf2a12a1ccc9a4e394da1ee

      SHA256

      e7f0a3a3553dc4eb25e9337f664d93c8fd951a328952883f10f09621a2255968

      SHA512

      b178465e17738f9489fc75bd5d5866de361bd88182bf214066884fa3e9d7a83ec40b7d4b9ba063d6668c0ae86e22d4385ad51994116c414651434a4225eb5100

    • C:\Users\Admin\AppData\Local\Temp\6c364d.exe
      Filesize

      846KB

      MD5

      ba68d4c5343746d9bcf3cbadad3ba564

      SHA1

      3c23f9c71854c070203f45b9775b6b74d9a8658f

      SHA256

      63077e0732540d09c8c64c68239a213b910b2182de1d9893c51f8ef0bde5c32c

      SHA512

      7ee9b012c2ed8abe9be931ea9b1d927f6b9f948fe98cc3856a4a34be1fd1699bd4c47ad09694e5cdbb5c57da8f6160fcc6c6196a79c920eabc356ade4b6e90e9

    • C:\Users\Admin\AppData\Local\Temp\6c364d.exe
      Filesize

      846KB

      MD5

      ba68d4c5343746d9bcf3cbadad3ba564

      SHA1

      3c23f9c71854c070203f45b9775b6b74d9a8658f

      SHA256

      63077e0732540d09c8c64c68239a213b910b2182de1d9893c51f8ef0bde5c32c

      SHA512

      7ee9b012c2ed8abe9be931ea9b1d927f6b9f948fe98cc3856a4a34be1fd1699bd4c47ad09694e5cdbb5c57da8f6160fcc6c6196a79c920eabc356ade4b6e90e9

    • C:\Users\Admin\AppData\Local\Temp\ahnmove.bat
      Filesize

      177B

      MD5

      1575c9c4849e4adf93cb4b18ab85ef10

      SHA1

      e89db69b736a790315ac038111b74d31469b7b29

      SHA256

      77095f007b9d18f84cc1154922553ae00ea660c1a95297ff402ab77cec1256ba

      SHA512

      a4855935aea2b223ca9dc16a2d4f10573bc300501e8facc25c5e5b18787c68ba15d52f3b52aae921f0ffb47427564657a4f5e352d402fec36d9edc7279f65696

    • C:\Users\Admin\AppData\Local\Temp\e7f0a3a3553dc4eb25e9337f664d93c8fd951a328952883f10f09621a2255968.exe
      Filesize

      473KB

      MD5

      5283b78d841e568f2dcff0ccf357222e

      SHA1

      c47b70ed9e3838c2a18cb49f099b0b72f13c268c

      SHA256

      4eacb02bbf469948b82c124a1bd7b22308705c121db3016ac7b7e2abe5cef6c9

      SHA512

      3518f00e0f89c231249b4d99da10203dc7fb579f40267697caa1715a64dce1b814dfccdadc5f0898d6f5eb048daeef8f5435922b8e7836ac1bdaa021aaf2c912

    • \Users\Admin\AppData\Local\Temp\6c2e90.tmp
      Filesize

      1.3MB

      MD5

      ef47687cddafd1fb06d3705b3409a52e

      SHA1

      5c3c7ed3705205c38cf2a12a1ccc9a4e394da1ee

      SHA256

      e7f0a3a3553dc4eb25e9337f664d93c8fd951a328952883f10f09621a2255968

      SHA512

      b178465e17738f9489fc75bd5d5866de361bd88182bf214066884fa3e9d7a83ec40b7d4b9ba063d6668c0ae86e22d4385ad51994116c414651434a4225eb5100

    • \Users\Admin\AppData\Local\Temp\6c2e90.tmp
      Filesize

      1.3MB

      MD5

      ef47687cddafd1fb06d3705b3409a52e

      SHA1

      5c3c7ed3705205c38cf2a12a1ccc9a4e394da1ee

      SHA256

      e7f0a3a3553dc4eb25e9337f664d93c8fd951a328952883f10f09621a2255968

      SHA512

      b178465e17738f9489fc75bd5d5866de361bd88182bf214066884fa3e9d7a83ec40b7d4b9ba063d6668c0ae86e22d4385ad51994116c414651434a4225eb5100

    • \Users\Admin\AppData\Local\Temp\6c364d.exe
      Filesize

      846KB

      MD5

      ba68d4c5343746d9bcf3cbadad3ba564

      SHA1

      3c23f9c71854c070203f45b9775b6b74d9a8658f

      SHA256

      63077e0732540d09c8c64c68239a213b910b2182de1d9893c51f8ef0bde5c32c

      SHA512

      7ee9b012c2ed8abe9be931ea9b1d927f6b9f948fe98cc3856a4a34be1fd1699bd4c47ad09694e5cdbb5c57da8f6160fcc6c6196a79c920eabc356ade4b6e90e9

    • \Users\Admin\AppData\Local\Temp\6c364d.exe
      Filesize

      846KB

      MD5

      ba68d4c5343746d9bcf3cbadad3ba564

      SHA1

      3c23f9c71854c070203f45b9775b6b74d9a8658f

      SHA256

      63077e0732540d09c8c64c68239a213b910b2182de1d9893c51f8ef0bde5c32c

      SHA512

      7ee9b012c2ed8abe9be931ea9b1d927f6b9f948fe98cc3856a4a34be1fd1699bd4c47ad09694e5cdbb5c57da8f6160fcc6c6196a79c920eabc356ade4b6e90e9

    • \Users\Admin\AppData\Local\Temp\e7f0a3a3553dc4eb25e9337f664d93c8fd951a328952883f10f09621a2255968.exe
      Filesize

      473KB

      MD5

      5283b78d841e568f2dcff0ccf357222e

      SHA1

      c47b70ed9e3838c2a18cb49f099b0b72f13c268c

      SHA256

      4eacb02bbf469948b82c124a1bd7b22308705c121db3016ac7b7e2abe5cef6c9

      SHA512

      3518f00e0f89c231249b4d99da10203dc7fb579f40267697caa1715a64dce1b814dfccdadc5f0898d6f5eb048daeef8f5435922b8e7836ac1bdaa021aaf2c912

    • \Users\Admin\AppData\Local\Temp\e7f0a3a3553dc4eb25e9337f664d93c8fd951a328952883f10f09621a2255968.exe
      Filesize

      473KB

      MD5

      5283b78d841e568f2dcff0ccf357222e

      SHA1

      c47b70ed9e3838c2a18cb49f099b0b72f13c268c

      SHA256

      4eacb02bbf469948b82c124a1bd7b22308705c121db3016ac7b7e2abe5cef6c9

      SHA512

      3518f00e0f89c231249b4d99da10203dc7fb579f40267697caa1715a64dce1b814dfccdadc5f0898d6f5eb048daeef8f5435922b8e7836ac1bdaa021aaf2c912

    • memory/280-62-0x0000000000000000-mapping.dmp
    • memory/280-74-0x0000000000400000-0x00000000007A1000-memory.dmp
      Filesize

      3.6MB

    • memory/280-64-0x0000000075561000-0x0000000075563000-memory.dmp
      Filesize

      8KB

    • memory/280-77-0x0000000000400000-0x00000000007A1000-memory.dmp
      Filesize

      3.6MB

    • memory/280-73-0x0000000000400000-0x00000000007A1000-memory.dmp
      Filesize

      3.6MB

    • memory/484-80-0x0000000000000000-mapping.dmp
    • memory/944-78-0x0000000001000000-0x0000000001C57000-memory.dmp
      Filesize

      12.3MB

    • memory/944-75-0x0000000001000000-0x0000000001C57000-memory.dmp
      Filesize

      12.3MB

    • memory/944-76-0x00000000002B0000-0x00000000002D0000-memory.dmp
      Filesize

      128KB

    • memory/944-87-0x0000000001000000-0x0000000001C57000-memory.dmp
      Filesize

      12.3MB

    • memory/944-67-0x0000000000000000-mapping.dmp
    • memory/944-72-0x00000000002B0000-0x00000000002D0000-memory.dmp
      Filesize

      128KB

    • memory/964-81-0x0000000000000000-mapping.dmp
    • memory/1004-79-0x0000000000000000-mapping.dmp
    • memory/1132-57-0x0000000000400000-0x000000000040B000-memory.dmp
      Filesize

      44KB

    • memory/1172-69-0x0000000000400000-0x000000000040B000-memory.dmp
      Filesize

      44KB

    • memory/1172-56-0x0000000000000000-mapping.dmp
    • memory/1284-84-0x0000000000000000-mapping.dmp
    • memory/1332-83-0x0000000000000000-mapping.dmp
    • memory/1540-85-0x0000000000000000-mapping.dmp
    • memory/1724-82-0x0000000000000000-mapping.dmp