Analysis
-
max time kernel
69s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
30-10-2022 08:04
Behavioral task
behavioral1
Sample
8c5e8c97e8bbfbd946a70450ce4752f4ba06605d0140d043a75fd6c1f867018c.exe
Resource
win7-20220812-en
General
-
Target
8c5e8c97e8bbfbd946a70450ce4752f4ba06605d0140d043a75fd6c1f867018c.exe
-
Size
350KB
-
MD5
93aaadc0d0b4a41ce82654d48f857010
-
SHA1
45812eb55e5a2f6b360645e44b6b07fc48ec640b
-
SHA256
8c5e8c97e8bbfbd946a70450ce4752f4ba06605d0140d043a75fd6c1f867018c
-
SHA512
bee069511ea882ca8abde7534b5d1d37c3a6660557c710675decc738bf8ec4f981b80282cae337dfb2115c51d4b4c83ede92ad2ec91ddcbc129d0eb22d079ef6
-
SSDEEP
6144:EyXu7IEBSsQ9ElMwm60lmqs7MTRGA3h3GVqdppJXEGhBukJF/KAwxFUOWdEmh:E3BdQLL4BE93NGVYZX9BukJlwxSJdEm
Malware Config
Signatures
-
Drops file in Drivers directory 2 IoCs
Processes:
8c5e8c97e8bbfbd946a70450ce4752f4ba06605d0140d043a75fd6c1f867018c.exedescription ioc process File created C:\Windows\SysWOW64\drivers\28cd68a6.sys 8c5e8c97e8bbfbd946a70450ce4752f4ba06605d0140d043a75fd6c1f867018c.exe File created C:\Windows\SysWOW64\drivers\54665d20.sys 8c5e8c97e8bbfbd946a70450ce4752f4ba06605d0140d043a75fd6c1f867018c.exe -
Possible privilege escalation attempt 2 IoCs
Processes:
takeown.exeicacls.exepid process 1916 takeown.exe 752 icacls.exe -
Sets service image path in registry 2 TTPs 2 IoCs
Processes:
8c5e8c97e8bbfbd946a70450ce4752f4ba06605d0140d043a75fd6c1f867018c.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\28cd68a6\ImagePath = "\\??\\C:\\Windows\\SysWOW64\\drivers\\28cd68a6.sys" 8c5e8c97e8bbfbd946a70450ce4752f4ba06605d0140d043a75fd6c1f867018c.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\54665d20\ImagePath = "\\??\\C:\\Windows\\SysWOW64\\drivers\\54665d20.sys" 8c5e8c97e8bbfbd946a70450ce4752f4ba06605d0140d043a75fd6c1f867018c.exe -
Processes:
resource yara_rule behavioral1/memory/2036-55-0x0000000001000000-0x000000000112D000-memory.dmp upx behavioral1/memory/2036-56-0x0000000001000000-0x000000000112D000-memory.dmp upx behavioral1/memory/2036-61-0x0000000001000000-0x000000000112D000-memory.dmp upx -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1144 cmd.exe -
Modifies file permissions 1 TTPs 2 IoCs
Processes:
takeown.exeicacls.exepid process 1916 takeown.exe 752 icacls.exe -
Installs/modifies Browser Helper Object 2 TTPs 4 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
Processes:
8c5e8c97e8bbfbd946a70450ce4752f4ba06605d0140d043a75fd6c1f867018c.exedescription ioc process Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E} 8c5e8c97e8bbfbd946a70450ce4752f4ba06605d0140d043a75fd6c1f867018c.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3} 8c5e8c97e8bbfbd946a70450ce4752f4ba06605d0140d043a75fd6c1f867018c.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects 8c5e8c97e8bbfbd946a70450ce4752f4ba06605d0140d043a75fd6c1f867018c.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF} 8c5e8c97e8bbfbd946a70450ce4752f4ba06605d0140d043a75fd6c1f867018c.exe -
Drops file in System32 directory 5 IoCs
Processes:
8c5e8c97e8bbfbd946a70450ce4752f4ba06605d0140d043a75fd6c1f867018c.exedescription ioc process File opened for modification C:\Windows\SysWOW64\goodsb.dll 8c5e8c97e8bbfbd946a70450ce4752f4ba06605d0140d043a75fd6c1f867018c.exe File created C:\Windows\SysWOW64\goodsb.dll 8c5e8c97e8bbfbd946a70450ce4752f4ba06605d0140d043a75fd6c1f867018c.exe File created C:\Windows\SysWOW64\ws2tcpip.dll 8c5e8c97e8bbfbd946a70450ce4752f4ba06605d0140d043a75fd6c1f867018c.exe File opened for modification C:\Windows\SysWOW64\ws2tcpip.dll 8c5e8c97e8bbfbd946a70450ce4752f4ba06605d0140d043a75fd6c1f867018c.exe File created C:\Windows\SysWOW64\wshtcpip.dll 8c5e8c97e8bbfbd946a70450ce4752f4ba06605d0140d043a75fd6c1f867018c.exe -
Modifies registry class 4 IoCs
Processes:
8c5e8c97e8bbfbd946a70450ce4752f4ba06605d0140d043a75fd6c1f867018c.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\HOOK_ID 8c5e8c97e8bbfbd946a70450ce4752f4ba06605d0140d043a75fd6c1f867018c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\HOOK_ID\name = "8c5e8c97e8bbfbd946a70450ce4752f4ba06605d0140d043a75fd6c1f867018c.exe" 8c5e8c97e8bbfbd946a70450ce4752f4ba06605d0140d043a75fd6c1f867018c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\SYS_DLL 8c5e8c97e8bbfbd946a70450ce4752f4ba06605d0140d043a75fd6c1f867018c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\SYS_DLL\name = "D2Gugqf.dll" 8c5e8c97e8bbfbd946a70450ce4752f4ba06605d0140d043a75fd6c1f867018c.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
8c5e8c97e8bbfbd946a70450ce4752f4ba06605d0140d043a75fd6c1f867018c.exepid process 2036 8c5e8c97e8bbfbd946a70450ce4752f4ba06605d0140d043a75fd6c1f867018c.exe 2036 8c5e8c97e8bbfbd946a70450ce4752f4ba06605d0140d043a75fd6c1f867018c.exe 2036 8c5e8c97e8bbfbd946a70450ce4752f4ba06605d0140d043a75fd6c1f867018c.exe 2036 8c5e8c97e8bbfbd946a70450ce4752f4ba06605d0140d043a75fd6c1f867018c.exe 2036 8c5e8c97e8bbfbd946a70450ce4752f4ba06605d0140d043a75fd6c1f867018c.exe 2036 8c5e8c97e8bbfbd946a70450ce4752f4ba06605d0140d043a75fd6c1f867018c.exe 2036 8c5e8c97e8bbfbd946a70450ce4752f4ba06605d0140d043a75fd6c1f867018c.exe 2036 8c5e8c97e8bbfbd946a70450ce4752f4ba06605d0140d043a75fd6c1f867018c.exe 2036 8c5e8c97e8bbfbd946a70450ce4752f4ba06605d0140d043a75fd6c1f867018c.exe 2036 8c5e8c97e8bbfbd946a70450ce4752f4ba06605d0140d043a75fd6c1f867018c.exe 2036 8c5e8c97e8bbfbd946a70450ce4752f4ba06605d0140d043a75fd6c1f867018c.exe 2036 8c5e8c97e8bbfbd946a70450ce4752f4ba06605d0140d043a75fd6c1f867018c.exe 2036 8c5e8c97e8bbfbd946a70450ce4752f4ba06605d0140d043a75fd6c1f867018c.exe 2036 8c5e8c97e8bbfbd946a70450ce4752f4ba06605d0140d043a75fd6c1f867018c.exe 2036 8c5e8c97e8bbfbd946a70450ce4752f4ba06605d0140d043a75fd6c1f867018c.exe 2036 8c5e8c97e8bbfbd946a70450ce4752f4ba06605d0140d043a75fd6c1f867018c.exe 2036 8c5e8c97e8bbfbd946a70450ce4752f4ba06605d0140d043a75fd6c1f867018c.exe 2036 8c5e8c97e8bbfbd946a70450ce4752f4ba06605d0140d043a75fd6c1f867018c.exe 2036 8c5e8c97e8bbfbd946a70450ce4752f4ba06605d0140d043a75fd6c1f867018c.exe 2036 8c5e8c97e8bbfbd946a70450ce4752f4ba06605d0140d043a75fd6c1f867018c.exe 2036 8c5e8c97e8bbfbd946a70450ce4752f4ba06605d0140d043a75fd6c1f867018c.exe 2036 8c5e8c97e8bbfbd946a70450ce4752f4ba06605d0140d043a75fd6c1f867018c.exe 2036 8c5e8c97e8bbfbd946a70450ce4752f4ba06605d0140d043a75fd6c1f867018c.exe 2036 8c5e8c97e8bbfbd946a70450ce4752f4ba06605d0140d043a75fd6c1f867018c.exe 2036 8c5e8c97e8bbfbd946a70450ce4752f4ba06605d0140d043a75fd6c1f867018c.exe 2036 8c5e8c97e8bbfbd946a70450ce4752f4ba06605d0140d043a75fd6c1f867018c.exe 2036 8c5e8c97e8bbfbd946a70450ce4752f4ba06605d0140d043a75fd6c1f867018c.exe 2036 8c5e8c97e8bbfbd946a70450ce4752f4ba06605d0140d043a75fd6c1f867018c.exe 2036 8c5e8c97e8bbfbd946a70450ce4752f4ba06605d0140d043a75fd6c1f867018c.exe 2036 8c5e8c97e8bbfbd946a70450ce4752f4ba06605d0140d043a75fd6c1f867018c.exe 2036 8c5e8c97e8bbfbd946a70450ce4752f4ba06605d0140d043a75fd6c1f867018c.exe 2036 8c5e8c97e8bbfbd946a70450ce4752f4ba06605d0140d043a75fd6c1f867018c.exe 2036 8c5e8c97e8bbfbd946a70450ce4752f4ba06605d0140d043a75fd6c1f867018c.exe 2036 8c5e8c97e8bbfbd946a70450ce4752f4ba06605d0140d043a75fd6c1f867018c.exe 2036 8c5e8c97e8bbfbd946a70450ce4752f4ba06605d0140d043a75fd6c1f867018c.exe 2036 8c5e8c97e8bbfbd946a70450ce4752f4ba06605d0140d043a75fd6c1f867018c.exe 2036 8c5e8c97e8bbfbd946a70450ce4752f4ba06605d0140d043a75fd6c1f867018c.exe 2036 8c5e8c97e8bbfbd946a70450ce4752f4ba06605d0140d043a75fd6c1f867018c.exe 2036 8c5e8c97e8bbfbd946a70450ce4752f4ba06605d0140d043a75fd6c1f867018c.exe 2036 8c5e8c97e8bbfbd946a70450ce4752f4ba06605d0140d043a75fd6c1f867018c.exe 2036 8c5e8c97e8bbfbd946a70450ce4752f4ba06605d0140d043a75fd6c1f867018c.exe 2036 8c5e8c97e8bbfbd946a70450ce4752f4ba06605d0140d043a75fd6c1f867018c.exe 2036 8c5e8c97e8bbfbd946a70450ce4752f4ba06605d0140d043a75fd6c1f867018c.exe 2036 8c5e8c97e8bbfbd946a70450ce4752f4ba06605d0140d043a75fd6c1f867018c.exe 2036 8c5e8c97e8bbfbd946a70450ce4752f4ba06605d0140d043a75fd6c1f867018c.exe 2036 8c5e8c97e8bbfbd946a70450ce4752f4ba06605d0140d043a75fd6c1f867018c.exe 2036 8c5e8c97e8bbfbd946a70450ce4752f4ba06605d0140d043a75fd6c1f867018c.exe 2036 8c5e8c97e8bbfbd946a70450ce4752f4ba06605d0140d043a75fd6c1f867018c.exe 2036 8c5e8c97e8bbfbd946a70450ce4752f4ba06605d0140d043a75fd6c1f867018c.exe 2036 8c5e8c97e8bbfbd946a70450ce4752f4ba06605d0140d043a75fd6c1f867018c.exe 2036 8c5e8c97e8bbfbd946a70450ce4752f4ba06605d0140d043a75fd6c1f867018c.exe 2036 8c5e8c97e8bbfbd946a70450ce4752f4ba06605d0140d043a75fd6c1f867018c.exe 2036 8c5e8c97e8bbfbd946a70450ce4752f4ba06605d0140d043a75fd6c1f867018c.exe 2036 8c5e8c97e8bbfbd946a70450ce4752f4ba06605d0140d043a75fd6c1f867018c.exe 2036 8c5e8c97e8bbfbd946a70450ce4752f4ba06605d0140d043a75fd6c1f867018c.exe 2036 8c5e8c97e8bbfbd946a70450ce4752f4ba06605d0140d043a75fd6c1f867018c.exe 2036 8c5e8c97e8bbfbd946a70450ce4752f4ba06605d0140d043a75fd6c1f867018c.exe 2036 8c5e8c97e8bbfbd946a70450ce4752f4ba06605d0140d043a75fd6c1f867018c.exe 2036 8c5e8c97e8bbfbd946a70450ce4752f4ba06605d0140d043a75fd6c1f867018c.exe 2036 8c5e8c97e8bbfbd946a70450ce4752f4ba06605d0140d043a75fd6c1f867018c.exe 2036 8c5e8c97e8bbfbd946a70450ce4752f4ba06605d0140d043a75fd6c1f867018c.exe 2036 8c5e8c97e8bbfbd946a70450ce4752f4ba06605d0140d043a75fd6c1f867018c.exe 2036 8c5e8c97e8bbfbd946a70450ce4752f4ba06605d0140d043a75fd6c1f867018c.exe 2036 8c5e8c97e8bbfbd946a70450ce4752f4ba06605d0140d043a75fd6c1f867018c.exe -
Suspicious behavior: LoadsDriver 5 IoCs
Processes:
8c5e8c97e8bbfbd946a70450ce4752f4ba06605d0140d043a75fd6c1f867018c.exepid process 460 2036 8c5e8c97e8bbfbd946a70450ce4752f4ba06605d0140d043a75fd6c1f867018c.exe 460 2036 8c5e8c97e8bbfbd946a70450ce4752f4ba06605d0140d043a75fd6c1f867018c.exe 2036 8c5e8c97e8bbfbd946a70450ce4752f4ba06605d0140d043a75fd6c1f867018c.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
8c5e8c97e8bbfbd946a70450ce4752f4ba06605d0140d043a75fd6c1f867018c.exetakeown.exedescription pid process Token: SeDebugPrivilege 2036 8c5e8c97e8bbfbd946a70450ce4752f4ba06605d0140d043a75fd6c1f867018c.exe Token: SeTakeOwnershipPrivilege 1916 takeown.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
8c5e8c97e8bbfbd946a70450ce4752f4ba06605d0140d043a75fd6c1f867018c.execmd.exedescription pid process target process PID 2036 wrote to memory of 664 2036 8c5e8c97e8bbfbd946a70450ce4752f4ba06605d0140d043a75fd6c1f867018c.exe cmd.exe PID 2036 wrote to memory of 664 2036 8c5e8c97e8bbfbd946a70450ce4752f4ba06605d0140d043a75fd6c1f867018c.exe cmd.exe PID 2036 wrote to memory of 664 2036 8c5e8c97e8bbfbd946a70450ce4752f4ba06605d0140d043a75fd6c1f867018c.exe cmd.exe PID 2036 wrote to memory of 664 2036 8c5e8c97e8bbfbd946a70450ce4752f4ba06605d0140d043a75fd6c1f867018c.exe cmd.exe PID 664 wrote to memory of 1916 664 cmd.exe takeown.exe PID 664 wrote to memory of 1916 664 cmd.exe takeown.exe PID 664 wrote to memory of 1916 664 cmd.exe takeown.exe PID 664 wrote to memory of 1916 664 cmd.exe takeown.exe PID 664 wrote to memory of 752 664 cmd.exe icacls.exe PID 664 wrote to memory of 752 664 cmd.exe icacls.exe PID 664 wrote to memory of 752 664 cmd.exe icacls.exe PID 664 wrote to memory of 752 664 cmd.exe icacls.exe PID 2036 wrote to memory of 1144 2036 8c5e8c97e8bbfbd946a70450ce4752f4ba06605d0140d043a75fd6c1f867018c.exe cmd.exe PID 2036 wrote to memory of 1144 2036 8c5e8c97e8bbfbd946a70450ce4752f4ba06605d0140d043a75fd6c1f867018c.exe cmd.exe PID 2036 wrote to memory of 1144 2036 8c5e8c97e8bbfbd946a70450ce4752f4ba06605d0140d043a75fd6c1f867018c.exe cmd.exe PID 2036 wrote to memory of 1144 2036 8c5e8c97e8bbfbd946a70450ce4752f4ba06605d0140d043a75fd6c1f867018c.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8c5e8c97e8bbfbd946a70450ce4752f4ba06605d0140d043a75fd6c1f867018c.exe"C:\Users\Admin\AppData\Local\Temp\8c5e8c97e8bbfbd946a70450ce4752f4ba06605d0140d043a75fd6c1f867018c.exe"1⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /c takeown /f C:\Windows\SysWOW64\wshtcpip.dll && icacls C:\Windows\SysWOW64\wshtcpip.dll /grant administrators:F2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\SysWOW64\wshtcpip.dll3⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\icacls.exeicacls C:\Windows\SysWOW64\wshtcpip.dll /grant administrators:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\ahnmove.bat2⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\ahnmove.batFilesize
181B
MD595033318d5d8464aaae7fef0efb57b86
SHA15a45a6773ea564bce82e16cde4bf6b593de15831
SHA256953dbe0fed3f7526a8800fec07a9953957e3ad8c9ce8bcc35f7bc47b6cd2d4c9
SHA512cdac408f33db55e53eec07be6f8bc4812f172eb27d2c1d9e78c7fa8157dc998a27275f23f9bf6ec2198b58f9e7aa4e356b9419ef5bfb8a00f70b7073da63852a
-
memory/664-57-0x0000000000000000-mapping.dmp
-
memory/752-59-0x0000000000000000-mapping.dmp
-
memory/1144-60-0x0000000000000000-mapping.dmp
-
memory/1916-58-0x0000000000000000-mapping.dmp
-
memory/2036-54-0x0000000075521000-0x0000000075523000-memory.dmpFilesize
8KB
-
memory/2036-55-0x0000000001000000-0x000000000112D000-memory.dmpFilesize
1.2MB
-
memory/2036-56-0x0000000001000000-0x000000000112D000-memory.dmpFilesize
1.2MB
-
memory/2036-61-0x0000000001000000-0x000000000112D000-memory.dmpFilesize
1.2MB