c18ee90d498e93fa17062888949374f04ad669279cd5c280141c44909e964ed5

General

Target

c18ee90d498e93fa17062888949374f04ad669279cd5c280141c44909e964ed5.exe
Size

328KB
MD5

10fae866dbd55867907d6bc219024cd0
SHA1

daba60701a1baf5db980c0103fc3294e7b84380a
SHA256

c18ee90d498e93fa17062888949374f04ad669279cd5c280141c44909e964ed5
SHA512

a1cb8a86f209ca716ce7cba855be8b675ea355323a9eeb43da1b496e5953829b91ab244e45001a5c6ec3a4bba7162de6f7ee2c5ec2239c6faa76cd5cb17f7135
SSDEEP

6144:RyWOeLm+tkxoGQvT+W4+HMc+MEGRQ6saHSMf3z0AzbLUG50Tpm+MmvbWdlL0d5aU:RCemx0vN3HKGi6sYjJLUGGtedud5tr7

Score

8^/10

adware discovery exploit persistence stealer

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

c18ee90d498e93fa17062888949374f04ad669279cd5c280141c44909e964ed5.exe

description ioc process

File created C:\Windows\SysWOW64\drivers\38733fb9.sys c18ee90d498e93fa17062888949374f04ad669279cd5c280141c44909e964ed5.exe
Possible privilege escalation attempt 4 IoCs
exploit

Processes:

takeown.exeicacls.exetakeown.exeicacls.exe

pid process

980 takeown.exe
2024 icacls.exe
788 takeown.exe
1892 icacls.exe

description	ioc	process
File created	C:\Windows\SysWOW64\drivers\38733fb9.sys	c18ee90d498e93fa17062888949374f04ad669279cd5c280141c44909e964ed5.exe

pid	process
980	takeown.exe
2024	icacls.exe
788	takeown.exe
1892	icacls.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

c18ee90d498e93fa17062888949374f04ad669279cd5c280141c44909e964ed5.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\38733fb9\ImagePath = "\\??\\C:\\Windows\\SysWOW64\\drivers\\38733fb9.sys"	c18ee90d498e93fa17062888949374f04ad669279cd5c280141c44909e964ed5.exe

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1964 cmd.exe
Modifies file permissions 1 TTPs 4 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

takeown.exeicacls.exetakeown.exeicacls.exe

pid process

980 takeown.exe
2024 icacls.exe
788 takeown.exe
1892 icacls.exe

pid	process
1964	cmd.exe

pid	process
980	takeown.exe
2024	icacls.exe
788	takeown.exe
1892	icacls.exe

Installs/modifies Browser Helper Object 2 TTPs 4 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

Processes:

c18ee90d498e93fa17062888949374f04ad669279cd5c280141c44909e964ed5.exe

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}	c18ee90d498e93fa17062888949374f04ad669279cd5c280141c44909e964ed5.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}	c18ee90d498e93fa17062888949374f04ad669279cd5c280141c44909e964ed5.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}	c18ee90d498e93fa17062888949374f04ad669279cd5c280141c44909e964ed5.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects	c18ee90d498e93fa17062888949374f04ad669279cd5c280141c44909e964ed5.exe

Maps connected drives based on registry 3 TTPs 3 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

c18ee90d498e93fa17062888949374f04ad669279cd5c280141c44909e964ed5.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	c18ee90d498e93fa17062888949374f04ad669279cd5c280141c44909e964ed5.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	c18ee90d498e93fa17062888949374f04ad669279cd5c280141c44909e964ed5.exe
Key value enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	c18ee90d498e93fa17062888949374f04ad669279cd5c280141c44909e964ed5.exe

Drops file in System32 directory 4 IoCs

Processes:

c18ee90d498e93fa17062888949374f04ad669279cd5c280141c44909e964ed5.exe

description	ioc	process
File created	C:\Windows\SysWOW64\ws2tcpip.dll	c18ee90d498e93fa17062888949374f04ad669279cd5c280141c44909e964ed5.exe
File opened for modification	C:\Windows\SysWOW64\ws2tcpip.dll	c18ee90d498e93fa17062888949374f04ad669279cd5c280141c44909e964ed5.exe
File created	C:\Windows\SysWOW64\wshtcpip.dll	c18ee90d498e93fa17062888949374f04ad669279cd5c280141c44909e964ed5.exe
File created	C:\Windows\SysWOW64\midimap.dll	c18ee90d498e93fa17062888949374f04ad669279cd5c280141c44909e964ed5.exe

Modifies registry class 4 IoCs

Processes:

c18ee90d498e93fa17062888949374f04ad669279cd5c280141c44909e964ed5.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\HOOK_ID\name = "c18ee90d498e93fa17062888949374f04ad669279cd5c280141c44909e964ed5.exe"	c18ee90d498e93fa17062888949374f04ad669279cd5c280141c44909e964ed5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\SYS_DLL	c18ee90d498e93fa17062888949374f04ad669279cd5c280141c44909e964ed5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\SYS_DLL\name = "gdYf2HJ.dll"	c18ee90d498e93fa17062888949374f04ad669279cd5c280141c44909e964ed5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\HOOK_ID	c18ee90d498e93fa17062888949374f04ad669279cd5c280141c44909e964ed5.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

c18ee90d498e93fa17062888949374f04ad669279cd5c280141c44909e964ed5.exe

pid	process
1708	c18ee90d498e93fa17062888949374f04ad669279cd5c280141c44909e964ed5.exe
1708	c18ee90d498e93fa17062888949374f04ad669279cd5c280141c44909e964ed5.exe
1708	c18ee90d498e93fa17062888949374f04ad669279cd5c280141c44909e964ed5.exe
1708	c18ee90d498e93fa17062888949374f04ad669279cd5c280141c44909e964ed5.exe
1708	c18ee90d498e93fa17062888949374f04ad669279cd5c280141c44909e964ed5.exe
1708	c18ee90d498e93fa17062888949374f04ad669279cd5c280141c44909e964ed5.exe
1708	c18ee90d498e93fa17062888949374f04ad669279cd5c280141c44909e964ed5.exe
1708	c18ee90d498e93fa17062888949374f04ad669279cd5c280141c44909e964ed5.exe
1708	c18ee90d498e93fa17062888949374f04ad669279cd5c280141c44909e964ed5.exe
1708	c18ee90d498e93fa17062888949374f04ad669279cd5c280141c44909e964ed5.exe
1708	c18ee90d498e93fa17062888949374f04ad669279cd5c280141c44909e964ed5.exe
1708	c18ee90d498e93fa17062888949374f04ad669279cd5c280141c44909e964ed5.exe
1708	c18ee90d498e93fa17062888949374f04ad669279cd5c280141c44909e964ed5.exe
1708	c18ee90d498e93fa17062888949374f04ad669279cd5c280141c44909e964ed5.exe
1708	c18ee90d498e93fa17062888949374f04ad669279cd5c280141c44909e964ed5.exe
1708	c18ee90d498e93fa17062888949374f04ad669279cd5c280141c44909e964ed5.exe
1708	c18ee90d498e93fa17062888949374f04ad669279cd5c280141c44909e964ed5.exe
1708	c18ee90d498e93fa17062888949374f04ad669279cd5c280141c44909e964ed5.exe
1708	c18ee90d498e93fa17062888949374f04ad669279cd5c280141c44909e964ed5.exe
1708	c18ee90d498e93fa17062888949374f04ad669279cd5c280141c44909e964ed5.exe
1708	c18ee90d498e93fa17062888949374f04ad669279cd5c280141c44909e964ed5.exe
1708	c18ee90d498e93fa17062888949374f04ad669279cd5c280141c44909e964ed5.exe
1708	c18ee90d498e93fa17062888949374f04ad669279cd5c280141c44909e964ed5.exe
1708	c18ee90d498e93fa17062888949374f04ad669279cd5c280141c44909e964ed5.exe
1708	c18ee90d498e93fa17062888949374f04ad669279cd5c280141c44909e964ed5.exe
1708	c18ee90d498e93fa17062888949374f04ad669279cd5c280141c44909e964ed5.exe
1708	c18ee90d498e93fa17062888949374f04ad669279cd5c280141c44909e964ed5.exe
1708	c18ee90d498e93fa17062888949374f04ad669279cd5c280141c44909e964ed5.exe
1708	c18ee90d498e93fa17062888949374f04ad669279cd5c280141c44909e964ed5.exe
1708	c18ee90d498e93fa17062888949374f04ad669279cd5c280141c44909e964ed5.exe
1708	c18ee90d498e93fa17062888949374f04ad669279cd5c280141c44909e964ed5.exe
1708	c18ee90d498e93fa17062888949374f04ad669279cd5c280141c44909e964ed5.exe
1708	c18ee90d498e93fa17062888949374f04ad669279cd5c280141c44909e964ed5.exe
1708	c18ee90d498e93fa17062888949374f04ad669279cd5c280141c44909e964ed5.exe
1708	c18ee90d498e93fa17062888949374f04ad669279cd5c280141c44909e964ed5.exe
1708	c18ee90d498e93fa17062888949374f04ad669279cd5c280141c44909e964ed5.exe
1708	c18ee90d498e93fa17062888949374f04ad669279cd5c280141c44909e964ed5.exe
1708	c18ee90d498e93fa17062888949374f04ad669279cd5c280141c44909e964ed5.exe
1708	c18ee90d498e93fa17062888949374f04ad669279cd5c280141c44909e964ed5.exe
1708	c18ee90d498e93fa17062888949374f04ad669279cd5c280141c44909e964ed5.exe
1708	c18ee90d498e93fa17062888949374f04ad669279cd5c280141c44909e964ed5.exe
1708	c18ee90d498e93fa17062888949374f04ad669279cd5c280141c44909e964ed5.exe
1708	c18ee90d498e93fa17062888949374f04ad669279cd5c280141c44909e964ed5.exe
1708	c18ee90d498e93fa17062888949374f04ad669279cd5c280141c44909e964ed5.exe
1708	c18ee90d498e93fa17062888949374f04ad669279cd5c280141c44909e964ed5.exe
1708	c18ee90d498e93fa17062888949374f04ad669279cd5c280141c44909e964ed5.exe
1708	c18ee90d498e93fa17062888949374f04ad669279cd5c280141c44909e964ed5.exe
1708	c18ee90d498e93fa17062888949374f04ad669279cd5c280141c44909e964ed5.exe
1708	c18ee90d498e93fa17062888949374f04ad669279cd5c280141c44909e964ed5.exe
1708	c18ee90d498e93fa17062888949374f04ad669279cd5c280141c44909e964ed5.exe
1708	c18ee90d498e93fa17062888949374f04ad669279cd5c280141c44909e964ed5.exe
1708	c18ee90d498e93fa17062888949374f04ad669279cd5c280141c44909e964ed5.exe
1708	c18ee90d498e93fa17062888949374f04ad669279cd5c280141c44909e964ed5.exe
1708	c18ee90d498e93fa17062888949374f04ad669279cd5c280141c44909e964ed5.exe
1708	c18ee90d498e93fa17062888949374f04ad669279cd5c280141c44909e964ed5.exe
1708	c18ee90d498e93fa17062888949374f04ad669279cd5c280141c44909e964ed5.exe
1708	c18ee90d498e93fa17062888949374f04ad669279cd5c280141c44909e964ed5.exe
1708	c18ee90d498e93fa17062888949374f04ad669279cd5c280141c44909e964ed5.exe
1708	c18ee90d498e93fa17062888949374f04ad669279cd5c280141c44909e964ed5.exe
1708	c18ee90d498e93fa17062888949374f04ad669279cd5c280141c44909e964ed5.exe
1708	c18ee90d498e93fa17062888949374f04ad669279cd5c280141c44909e964ed5.exe
1708	c18ee90d498e93fa17062888949374f04ad669279cd5c280141c44909e964ed5.exe
1708	c18ee90d498e93fa17062888949374f04ad669279cd5c280141c44909e964ed5.exe
1708	c18ee90d498e93fa17062888949374f04ad669279cd5c280141c44909e964ed5.exe

Suspicious behavior: LoadsDriver 2 IoCs

Processes:

c18ee90d498e93fa17062888949374f04ad669279cd5c280141c44909e964ed5.exe

pid process

464
1708 c18ee90d498e93fa17062888949374f04ad669279cd5c280141c44909e964ed5.exe

pid	process
464
1708	c18ee90d498e93fa17062888949374f04ad669279cd5c280141c44909e964ed5.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

c18ee90d498e93fa17062888949374f04ad669279cd5c280141c44909e964ed5.exetakeown.exetakeown.exe

description	pid	process
Token: SeDebugPrivilege	1708	c18ee90d498e93fa17062888949374f04ad669279cd5c280141c44909e964ed5.exe
Token: SeTakeOwnershipPrivilege	980	takeown.exe
Token: SeTakeOwnershipPrivilege	788	takeown.exe

Suspicious use of WriteProcessMemory 28 IoCs

Processes:

c18ee90d498e93fa17062888949374f04ad669279cd5c280141c44909e964ed5.execmd.execmd.exe

description	pid	process	target process
PID 1708 wrote to memory of 1140	1708	c18ee90d498e93fa17062888949374f04ad669279cd5c280141c44909e964ed5.exe	cmd.exe
PID 1708 wrote to memory of 1140	1708	c18ee90d498e93fa17062888949374f04ad669279cd5c280141c44909e964ed5.exe	cmd.exe
PID 1708 wrote to memory of 1140	1708	c18ee90d498e93fa17062888949374f04ad669279cd5c280141c44909e964ed5.exe	cmd.exe
PID 1708 wrote to memory of 1140	1708	c18ee90d498e93fa17062888949374f04ad669279cd5c280141c44909e964ed5.exe	cmd.exe
PID 1140 wrote to memory of 980	1140	cmd.exe	takeown.exe
PID 1140 wrote to memory of 980	1140	cmd.exe	takeown.exe
PID 1140 wrote to memory of 980	1140	cmd.exe	takeown.exe
PID 1140 wrote to memory of 980	1140	cmd.exe	takeown.exe
PID 1140 wrote to memory of 2024	1140	cmd.exe	icacls.exe
PID 1140 wrote to memory of 2024	1140	cmd.exe	icacls.exe
PID 1140 wrote to memory of 2024	1140	cmd.exe	icacls.exe
PID 1140 wrote to memory of 2024	1140	cmd.exe	icacls.exe
PID 1708 wrote to memory of 604	1708	c18ee90d498e93fa17062888949374f04ad669279cd5c280141c44909e964ed5.exe	cmd.exe
PID 1708 wrote to memory of 604	1708	c18ee90d498e93fa17062888949374f04ad669279cd5c280141c44909e964ed5.exe	cmd.exe
PID 1708 wrote to memory of 604	1708	c18ee90d498e93fa17062888949374f04ad669279cd5c280141c44909e964ed5.exe	cmd.exe
PID 1708 wrote to memory of 604	1708	c18ee90d498e93fa17062888949374f04ad669279cd5c280141c44909e964ed5.exe	cmd.exe
PID 604 wrote to memory of 788	604	cmd.exe	takeown.exe
PID 604 wrote to memory of 788	604	cmd.exe	takeown.exe
PID 604 wrote to memory of 788	604	cmd.exe	takeown.exe
PID 604 wrote to memory of 788	604	cmd.exe	takeown.exe
PID 604 wrote to memory of 1892	604	cmd.exe	icacls.exe
PID 604 wrote to memory of 1892	604	cmd.exe	icacls.exe
PID 604 wrote to memory of 1892	604	cmd.exe	icacls.exe
PID 604 wrote to memory of 1892	604	cmd.exe	icacls.exe
PID 1708 wrote to memory of 1964	1708	c18ee90d498e93fa17062888949374f04ad669279cd5c280141c44909e964ed5.exe	cmd.exe
PID 1708 wrote to memory of 1964	1708	c18ee90d498e93fa17062888949374f04ad669279cd5c280141c44909e964ed5.exe	cmd.exe
PID 1708 wrote to memory of 1964	1708	c18ee90d498e93fa17062888949374f04ad669279cd5c280141c44909e964ed5.exe	cmd.exe
PID 1708 wrote to memory of 1964	1708	c18ee90d498e93fa17062888949374f04ad669279cd5c280141c44909e964ed5.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\c18ee90d498e93fa17062888949374f04ad669279cd5c280141c44909e964ed5.exe
"C:\Users\Admin\AppData\Local\Temp\c18ee90d498e93fa17062888949374f04ad669279cd5c280141c44909e964ed5.exe"
1⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Installs/modifies Browser Helper Object
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1708

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c takeown /f C:\Windows\SysWOW64\wshtcpip.dll && icacls C:\Windows\SysWOW64\wshtcpip.dll /grant administrators:F
2⤵
- Suspicious use of WriteProcessMemory
PID:1140

C:\Windows\SysWOW64\takeown.exe
takeown /f C:\Windows\SysWOW64\wshtcpip.dll
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:980

C:\Windows\SysWOW64\icacls.exe
icacls C:\Windows\SysWOW64\wshtcpip.dll /grant administrators:F
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:2024

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c takeown /f C:\Windows\SysWOW64\midimap.dll && icacls C:\Windows\SysWOW64\midimap.dll /grant administrators:F
2⤵
- Suspicious use of WriteProcessMemory
PID:604

C:\Windows\SysWOW64\takeown.exe
takeown /f C:\Windows\SysWOW64\midimap.dll
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:788

C:\Windows\SysWOW64\icacls.exe
icacls C:\Windows\SysWOW64\midimap.dll /grant administrators:F
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1892

C:\Windows\SysWOW64\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\ahnmove.bat
2⤵
- Deletes itself
PID:1964

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Browser Extensions

1

T1176

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ahnmove.bat
Filesize
181B

MD5
4fafddb9408edf613f85dca18582e080

SHA1
ebdca0ae4b498a00a67990885d7f12ae3e8254b6

SHA256
7d2d9a0d4e2e567184c874ce9967d5e289d4e6ff35c15202152823198ea45d79

SHA512
a42fba7802fe8ab4effbcb4a81aa1316d95d0df98db61475d3d1c749b5b12a25422b8dda2e6a5ff3ed785ebb569a97c639f8ab123659c0f9c43567b04c9bd302

Download Submit
memory/604-61-0x0000000000000000-mapping.dmp

Download
memory/788-62-0x0000000000000000-mapping.dmp

Download
memory/980-59-0x0000000000000000-mapping.dmp

Download
memory/1140-58-0x0000000000000000-mapping.dmp

Download
memory/1708-65-0x0000000001000000-0x000000000116A000-memory.dmp

Filesize
1.4MB

Download
memory/1708-55-0x0000000001000000-0x000000000116A000-memory.dmp

Filesize
1.4MB

Download
memory/1708-56-0x0000000000550000-0x0000000000570000-memory.dmp

Filesize
128KB

Download
memory/1708-57-0x0000000000550000-0x0000000000570000-memory.dmp

Filesize
128KB

Download
memory/1708-54-0x0000000075111000-0x0000000075113000-memory.dmp

Filesize
8KB

Download
memory/1892-63-0x0000000000000000-mapping.dmp

Download
memory/1964-64-0x0000000000000000-mapping.dmp

Download
memory/2024-60-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads