Analysis
-
max time kernel
148s -
max time network
164s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
06-11-2022 05:04
Static task
static1
Behavioral task
behavioral1
Sample
a6d42ce9c848da1be899cdc96a33c7378d3b6563f616ac4e6c32b5cb1e5ccfe8.exe
Resource
win7-20220812-en
General
-
Target
a6d42ce9c848da1be899cdc96a33c7378d3b6563f616ac4e6c32b5cb1e5ccfe8.exe
-
Size
1.4MB
-
MD5
250c1b6bcc5fe9b36a485d0debe048a0
-
SHA1
5ba0c24a3e61c66793e594be30ba4c2ac9401641
-
SHA256
a6d42ce9c848da1be899cdc96a33c7378d3b6563f616ac4e6c32b5cb1e5ccfe8
-
SHA512
640711b94b0e7cb6f10fa30f6062e9f90a34bc732ab45ec3a3fb40d1a9dac3e31709121b2a2585f979e0c43ea93c17b1c89826539a0877882a323628dedc1dcb
-
SSDEEP
24576:RNmF/mnBoDM5f7F2RdcclPqVX7TwBTGQOD6N+FrFtTp3I1gRUfbVx5rLIhkp8TR/:RYVZo5TcRB1oNp4v7L81/
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
ms.exepid process 1188 ms.exe -
Possible privilege escalation attempt 2 IoCs
Processes:
takeown.exeicacls.exepid process 892 takeown.exe 1144 icacls.exe -
Loads dropped DLL 1 IoCs
Processes:
a6d42ce9c848da1be899cdc96a33c7378d3b6563f616ac4e6c32b5cb1e5ccfe8.exepid process 1032 a6d42ce9c848da1be899cdc96a33c7378d3b6563f616ac4e6c32b5cb1e5ccfe8.exe -
Modifies file permissions 1 TTPs 2 IoCs
Processes:
takeown.exeicacls.exepid process 892 takeown.exe 1144 icacls.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Windows directory 2 IoCs
Processes:
a6d42ce9c848da1be899cdc96a33c7378d3b6563f616ac4e6c32b5cb1e5ccfe8.exedescription ioc process File opened for modification C:\WINDOWS\Bef.tmp a6d42ce9c848da1be899cdc96a33c7378d3b6563f616ac4e6c32b5cb1e5ccfe8.exe File opened for modification C:\Windows\yre.tmp a6d42ce9c848da1be899cdc96a33c7378d3b6563f616ac4e6c32b5cb1e5ccfe8.exe -
Suspicious behavior: EnumeratesProcesses 37 IoCs
Processes:
a6d42ce9c848da1be899cdc96a33c7378d3b6563f616ac4e6c32b5cb1e5ccfe8.exepid process 1032 a6d42ce9c848da1be899cdc96a33c7378d3b6563f616ac4e6c32b5cb1e5ccfe8.exe 1032 a6d42ce9c848da1be899cdc96a33c7378d3b6563f616ac4e6c32b5cb1e5ccfe8.exe 1032 a6d42ce9c848da1be899cdc96a33c7378d3b6563f616ac4e6c32b5cb1e5ccfe8.exe 1032 a6d42ce9c848da1be899cdc96a33c7378d3b6563f616ac4e6c32b5cb1e5ccfe8.exe 1032 a6d42ce9c848da1be899cdc96a33c7378d3b6563f616ac4e6c32b5cb1e5ccfe8.exe 1032 a6d42ce9c848da1be899cdc96a33c7378d3b6563f616ac4e6c32b5cb1e5ccfe8.exe 1032 a6d42ce9c848da1be899cdc96a33c7378d3b6563f616ac4e6c32b5cb1e5ccfe8.exe 1032 a6d42ce9c848da1be899cdc96a33c7378d3b6563f616ac4e6c32b5cb1e5ccfe8.exe 1032 a6d42ce9c848da1be899cdc96a33c7378d3b6563f616ac4e6c32b5cb1e5ccfe8.exe 1032 a6d42ce9c848da1be899cdc96a33c7378d3b6563f616ac4e6c32b5cb1e5ccfe8.exe 1032 a6d42ce9c848da1be899cdc96a33c7378d3b6563f616ac4e6c32b5cb1e5ccfe8.exe 1032 a6d42ce9c848da1be899cdc96a33c7378d3b6563f616ac4e6c32b5cb1e5ccfe8.exe 1032 a6d42ce9c848da1be899cdc96a33c7378d3b6563f616ac4e6c32b5cb1e5ccfe8.exe 1032 a6d42ce9c848da1be899cdc96a33c7378d3b6563f616ac4e6c32b5cb1e5ccfe8.exe 1032 a6d42ce9c848da1be899cdc96a33c7378d3b6563f616ac4e6c32b5cb1e5ccfe8.exe 1032 a6d42ce9c848da1be899cdc96a33c7378d3b6563f616ac4e6c32b5cb1e5ccfe8.exe 1032 a6d42ce9c848da1be899cdc96a33c7378d3b6563f616ac4e6c32b5cb1e5ccfe8.exe 1032 a6d42ce9c848da1be899cdc96a33c7378d3b6563f616ac4e6c32b5cb1e5ccfe8.exe 1032 a6d42ce9c848da1be899cdc96a33c7378d3b6563f616ac4e6c32b5cb1e5ccfe8.exe 1032 a6d42ce9c848da1be899cdc96a33c7378d3b6563f616ac4e6c32b5cb1e5ccfe8.exe 1032 a6d42ce9c848da1be899cdc96a33c7378d3b6563f616ac4e6c32b5cb1e5ccfe8.exe 1032 a6d42ce9c848da1be899cdc96a33c7378d3b6563f616ac4e6c32b5cb1e5ccfe8.exe 1032 a6d42ce9c848da1be899cdc96a33c7378d3b6563f616ac4e6c32b5cb1e5ccfe8.exe 1032 a6d42ce9c848da1be899cdc96a33c7378d3b6563f616ac4e6c32b5cb1e5ccfe8.exe 1032 a6d42ce9c848da1be899cdc96a33c7378d3b6563f616ac4e6c32b5cb1e5ccfe8.exe 1032 a6d42ce9c848da1be899cdc96a33c7378d3b6563f616ac4e6c32b5cb1e5ccfe8.exe 1032 a6d42ce9c848da1be899cdc96a33c7378d3b6563f616ac4e6c32b5cb1e5ccfe8.exe 1032 a6d42ce9c848da1be899cdc96a33c7378d3b6563f616ac4e6c32b5cb1e5ccfe8.exe 1032 a6d42ce9c848da1be899cdc96a33c7378d3b6563f616ac4e6c32b5cb1e5ccfe8.exe 1032 a6d42ce9c848da1be899cdc96a33c7378d3b6563f616ac4e6c32b5cb1e5ccfe8.exe 1032 a6d42ce9c848da1be899cdc96a33c7378d3b6563f616ac4e6c32b5cb1e5ccfe8.exe 1032 a6d42ce9c848da1be899cdc96a33c7378d3b6563f616ac4e6c32b5cb1e5ccfe8.exe 1032 a6d42ce9c848da1be899cdc96a33c7378d3b6563f616ac4e6c32b5cb1e5ccfe8.exe 1032 a6d42ce9c848da1be899cdc96a33c7378d3b6563f616ac4e6c32b5cb1e5ccfe8.exe 1032 a6d42ce9c848da1be899cdc96a33c7378d3b6563f616ac4e6c32b5cb1e5ccfe8.exe 1032 a6d42ce9c848da1be899cdc96a33c7378d3b6563f616ac4e6c32b5cb1e5ccfe8.exe 1032 a6d42ce9c848da1be899cdc96a33c7378d3b6563f616ac4e6c32b5cb1e5ccfe8.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
takeown.exedescription pid process Token: SeTakeOwnershipPrivilege 892 takeown.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
ms.exepid process 1188 ms.exe 1188 ms.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
a6d42ce9c848da1be899cdc96a33c7378d3b6563f616ac4e6c32b5cb1e5ccfe8.exems.exedescription pid process target process PID 1032 wrote to memory of 1188 1032 a6d42ce9c848da1be899cdc96a33c7378d3b6563f616ac4e6c32b5cb1e5ccfe8.exe ms.exe PID 1032 wrote to memory of 1188 1032 a6d42ce9c848da1be899cdc96a33c7378d3b6563f616ac4e6c32b5cb1e5ccfe8.exe ms.exe PID 1032 wrote to memory of 1188 1032 a6d42ce9c848da1be899cdc96a33c7378d3b6563f616ac4e6c32b5cb1e5ccfe8.exe ms.exe PID 1032 wrote to memory of 1188 1032 a6d42ce9c848da1be899cdc96a33c7378d3b6563f616ac4e6c32b5cb1e5ccfe8.exe ms.exe PID 1188 wrote to memory of 892 1188 ms.exe takeown.exe PID 1188 wrote to memory of 892 1188 ms.exe takeown.exe PID 1188 wrote to memory of 892 1188 ms.exe takeown.exe PID 1188 wrote to memory of 892 1188 ms.exe takeown.exe PID 1188 wrote to memory of 1144 1188 ms.exe icacls.exe PID 1188 wrote to memory of 1144 1188 ms.exe icacls.exe PID 1188 wrote to memory of 1144 1188 ms.exe icacls.exe PID 1188 wrote to memory of 1144 1188 ms.exe icacls.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a6d42ce9c848da1be899cdc96a33c7378d3b6563f616ac4e6c32b5cb1e5ccfe8.exe"C:\Users\Admin\AppData\Local\Temp\a6d42ce9c848da1be899cdc96a33c7378d3b6563f616ac4e6c32b5cb1e5ccfe8.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1032 -
C:\Users\Admin\AppData\Local\Temp\ms.exeC:\Users\Admin\AppData\Local\Temp\ms.exe k2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1188 -
C:\Windows\system32\takeown.exetakeown /f "C:\WINDOWS\system32\Sens.dll"3⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:892 -
C:\Windows\system32\icacls.exeicacls "C:\WINDOWS\system32\Sens.dll" /grant administrators:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1144
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\ms.exeFilesize
424KB
MD5a37f6986bc775c44618b3809c558234a
SHA1725ff87dd8c8a45e03dc184545d0867c273284fa
SHA256057da3046d0a3c08b7c3da9422b1a983d3f46a4d4a6739f3c2d1e1e1cd2c8e85
SHA512d1dc31e73eff083799bfb28cd429f8365ee128ddc71ef9bd7f80b01de1b5d8088038fcfc04e2d131d6e6e0252721b5a5ac23e33bf659f8756d401b1021581ccc
-
C:\Users\Admin\AppData\Local\Temp\ms.exeFilesize
424KB
MD5a37f6986bc775c44618b3809c558234a
SHA1725ff87dd8c8a45e03dc184545d0867c273284fa
SHA256057da3046d0a3c08b7c3da9422b1a983d3f46a4d4a6739f3c2d1e1e1cd2c8e85
SHA512d1dc31e73eff083799bfb28cd429f8365ee128ddc71ef9bd7f80b01de1b5d8088038fcfc04e2d131d6e6e0252721b5a5ac23e33bf659f8756d401b1021581ccc
-
\Users\Admin\AppData\Local\Temp\ms.exeFilesize
424KB
MD5a37f6986bc775c44618b3809c558234a
SHA1725ff87dd8c8a45e03dc184545d0867c273284fa
SHA256057da3046d0a3c08b7c3da9422b1a983d3f46a4d4a6739f3c2d1e1e1cd2c8e85
SHA512d1dc31e73eff083799bfb28cd429f8365ee128ddc71ef9bd7f80b01de1b5d8088038fcfc04e2d131d6e6e0252721b5a5ac23e33bf659f8756d401b1021581ccc
-
memory/892-60-0x0000000000000000-mapping.dmp
-
memory/1032-54-0x00000000762D1000-0x00000000762D3000-memory.dmpFilesize
8KB
-
memory/1144-61-0x0000000000000000-mapping.dmp
-
memory/1188-56-0x0000000000000000-mapping.dmp