5e0534239f04a03e7a86a9230c77753ac3a87c1b5f36eb82faa8cf55846f0cfb

General

Target

5e0534239f04a03e7a86a9230c77753ac3a87c1b5f36eb82faa8cf55846f0cfb.exe
Size

329KB
MD5

0a3d897064bc8e8f8ead808689a7ef80
SHA1

6532f8bfe1d1fbcabbc146d5f84d64dd68301c94
SHA256

5e0534239f04a03e7a86a9230c77753ac3a87c1b5f36eb82faa8cf55846f0cfb
SHA512

434fc32a74537205cd6de0aeaf82678e9dcc137dec87fa320386bd4d84d76576ee9c0d8526b3fc560aaea91990b02d1e97b1c8160250c6c7badbf5fdd716748b
SSDEEP

6144:YqpxvlACym6wGGWFGDwZyoJ3fzBeM6SpktqHQI6mVk8cL3/CzYjsHh:YqjvlA06wLBHAf9eMvHwmVkhL36zYwHh

Score

8^/10

adware discovery exploit persistence stealer

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

5e0534239f04a03e7a86a9230c77753ac3a87c1b5f36eb82faa8cf55846f0cfb.exe

description ioc process

File created C:\Windows\SysWOW64\drivers\3257f1f8.sys 5e0534239f04a03e7a86a9230c77753ac3a87c1b5f36eb82faa8cf55846f0cfb.exe
Possible privilege escalation attempt 4 IoCs
exploit

Processes:

icacls.exetakeown.exeicacls.exetakeown.exe

pid process

1060 icacls.exe
4932 takeown.exe
4648 icacls.exe
3016 takeown.exe

description	ioc	process
File created	C:\Windows\SysWOW64\drivers\3257f1f8.sys	5e0534239f04a03e7a86a9230c77753ac3a87c1b5f36eb82faa8cf55846f0cfb.exe

pid	process
1060	icacls.exe
4932	takeown.exe
4648	icacls.exe
3016	takeown.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

5e0534239f04a03e7a86a9230c77753ac3a87c1b5f36eb82faa8cf55846f0cfb.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\3257f1f8\ImagePath = "\\??\\C:\\Windows\\SysWOW64\\drivers\\3257f1f8.sys"	5e0534239f04a03e7a86a9230c77753ac3a87c1b5f36eb82faa8cf55846f0cfb.exe

Modifies file permissions 1 TTPs 4 IoCs
discovery

File Permissions Modification
T1222

Processes:

takeown.exeicacls.exetakeown.exeicacls.exe

pid process

4932 takeown.exe
4648 icacls.exe
3016 takeown.exe
1060 icacls.exe

pid	process
4932	takeown.exe
4648	icacls.exe
3016	takeown.exe
1060	icacls.exe

Installs/modifies Browser Helper Object 2 TTPs 3 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

Processes:

5e0534239f04a03e7a86a9230c77753ac3a87c1b5f36eb82faa8cf55846f0cfb.exe

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	5e0534239f04a03e7a86a9230c77753ac3a87c1b5f36eb82faa8cf55846f0cfb.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}	5e0534239f04a03e7a86a9230c77753ac3a87c1b5f36eb82faa8cf55846f0cfb.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}	5e0534239f04a03e7a86a9230c77753ac3a87c1b5f36eb82faa8cf55846f0cfb.exe

Maps connected drives based on registry 3 TTPs 3 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

5e0534239f04a03e7a86a9230c77753ac3a87c1b5f36eb82faa8cf55846f0cfb.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	5e0534239f04a03e7a86a9230c77753ac3a87c1b5f36eb82faa8cf55846f0cfb.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	5e0534239f04a03e7a86a9230c77753ac3a87c1b5f36eb82faa8cf55846f0cfb.exe
Key value enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	5e0534239f04a03e7a86a9230c77753ac3a87c1b5f36eb82faa8cf55846f0cfb.exe

Drops file in System32 directory 4 IoCs

Processes:

5e0534239f04a03e7a86a9230c77753ac3a87c1b5f36eb82faa8cf55846f0cfb.exe

description	ioc	process
File created	C:\Windows\SysWOW64\ws2tcpip.dll	5e0534239f04a03e7a86a9230c77753ac3a87c1b5f36eb82faa8cf55846f0cfb.exe
File opened for modification	C:\Windows\SysWOW64\ws2tcpip.dll	5e0534239f04a03e7a86a9230c77753ac3a87c1b5f36eb82faa8cf55846f0cfb.exe
File created	C:\Windows\SysWOW64\wshtcpip.dll	5e0534239f04a03e7a86a9230c77753ac3a87c1b5f36eb82faa8cf55846f0cfb.exe
File created	C:\Windows\SysWOW64\midimap.dll	5e0534239f04a03e7a86a9230c77753ac3a87c1b5f36eb82faa8cf55846f0cfb.exe

Modifies registry class 4 IoCs

Processes:

5e0534239f04a03e7a86a9230c77753ac3a87c1b5f36eb82faa8cf55846f0cfb.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\SYS_DLL\name = "qeyqi3Gh.dll"	5e0534239f04a03e7a86a9230c77753ac3a87c1b5f36eb82faa8cf55846f0cfb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\HOOK_ID	5e0534239f04a03e7a86a9230c77753ac3a87c1b5f36eb82faa8cf55846f0cfb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\HOOK_ID\name = "5e0534239f04a03e7a86a9230c77753ac3a87c1b5f36eb82faa8cf55846f0cfb.exe"	5e0534239f04a03e7a86a9230c77753ac3a87c1b5f36eb82faa8cf55846f0cfb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\SYS_DLL	5e0534239f04a03e7a86a9230c77753ac3a87c1b5f36eb82faa8cf55846f0cfb.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

5e0534239f04a03e7a86a9230c77753ac3a87c1b5f36eb82faa8cf55846f0cfb.exe

pid	process
4988	5e0534239f04a03e7a86a9230c77753ac3a87c1b5f36eb82faa8cf55846f0cfb.exe
4988	5e0534239f04a03e7a86a9230c77753ac3a87c1b5f36eb82faa8cf55846f0cfb.exe
4988	5e0534239f04a03e7a86a9230c77753ac3a87c1b5f36eb82faa8cf55846f0cfb.exe
4988	5e0534239f04a03e7a86a9230c77753ac3a87c1b5f36eb82faa8cf55846f0cfb.exe
4988	5e0534239f04a03e7a86a9230c77753ac3a87c1b5f36eb82faa8cf55846f0cfb.exe
4988	5e0534239f04a03e7a86a9230c77753ac3a87c1b5f36eb82faa8cf55846f0cfb.exe
4988	5e0534239f04a03e7a86a9230c77753ac3a87c1b5f36eb82faa8cf55846f0cfb.exe
4988	5e0534239f04a03e7a86a9230c77753ac3a87c1b5f36eb82faa8cf55846f0cfb.exe
4988	5e0534239f04a03e7a86a9230c77753ac3a87c1b5f36eb82faa8cf55846f0cfb.exe
4988	5e0534239f04a03e7a86a9230c77753ac3a87c1b5f36eb82faa8cf55846f0cfb.exe
4988	5e0534239f04a03e7a86a9230c77753ac3a87c1b5f36eb82faa8cf55846f0cfb.exe
4988	5e0534239f04a03e7a86a9230c77753ac3a87c1b5f36eb82faa8cf55846f0cfb.exe
4988	5e0534239f04a03e7a86a9230c77753ac3a87c1b5f36eb82faa8cf55846f0cfb.exe
4988	5e0534239f04a03e7a86a9230c77753ac3a87c1b5f36eb82faa8cf55846f0cfb.exe
4988	5e0534239f04a03e7a86a9230c77753ac3a87c1b5f36eb82faa8cf55846f0cfb.exe
4988	5e0534239f04a03e7a86a9230c77753ac3a87c1b5f36eb82faa8cf55846f0cfb.exe
4988	5e0534239f04a03e7a86a9230c77753ac3a87c1b5f36eb82faa8cf55846f0cfb.exe
4988	5e0534239f04a03e7a86a9230c77753ac3a87c1b5f36eb82faa8cf55846f0cfb.exe
4988	5e0534239f04a03e7a86a9230c77753ac3a87c1b5f36eb82faa8cf55846f0cfb.exe
4988	5e0534239f04a03e7a86a9230c77753ac3a87c1b5f36eb82faa8cf55846f0cfb.exe
4988	5e0534239f04a03e7a86a9230c77753ac3a87c1b5f36eb82faa8cf55846f0cfb.exe
4988	5e0534239f04a03e7a86a9230c77753ac3a87c1b5f36eb82faa8cf55846f0cfb.exe
4988	5e0534239f04a03e7a86a9230c77753ac3a87c1b5f36eb82faa8cf55846f0cfb.exe
4988	5e0534239f04a03e7a86a9230c77753ac3a87c1b5f36eb82faa8cf55846f0cfb.exe
4988	5e0534239f04a03e7a86a9230c77753ac3a87c1b5f36eb82faa8cf55846f0cfb.exe
4988	5e0534239f04a03e7a86a9230c77753ac3a87c1b5f36eb82faa8cf55846f0cfb.exe
4988	5e0534239f04a03e7a86a9230c77753ac3a87c1b5f36eb82faa8cf55846f0cfb.exe
4988	5e0534239f04a03e7a86a9230c77753ac3a87c1b5f36eb82faa8cf55846f0cfb.exe
4988	5e0534239f04a03e7a86a9230c77753ac3a87c1b5f36eb82faa8cf55846f0cfb.exe
4988	5e0534239f04a03e7a86a9230c77753ac3a87c1b5f36eb82faa8cf55846f0cfb.exe
4988	5e0534239f04a03e7a86a9230c77753ac3a87c1b5f36eb82faa8cf55846f0cfb.exe
4988	5e0534239f04a03e7a86a9230c77753ac3a87c1b5f36eb82faa8cf55846f0cfb.exe
4988	5e0534239f04a03e7a86a9230c77753ac3a87c1b5f36eb82faa8cf55846f0cfb.exe
4988	5e0534239f04a03e7a86a9230c77753ac3a87c1b5f36eb82faa8cf55846f0cfb.exe
4988	5e0534239f04a03e7a86a9230c77753ac3a87c1b5f36eb82faa8cf55846f0cfb.exe
4988	5e0534239f04a03e7a86a9230c77753ac3a87c1b5f36eb82faa8cf55846f0cfb.exe
4988	5e0534239f04a03e7a86a9230c77753ac3a87c1b5f36eb82faa8cf55846f0cfb.exe
4988	5e0534239f04a03e7a86a9230c77753ac3a87c1b5f36eb82faa8cf55846f0cfb.exe
4988	5e0534239f04a03e7a86a9230c77753ac3a87c1b5f36eb82faa8cf55846f0cfb.exe
4988	5e0534239f04a03e7a86a9230c77753ac3a87c1b5f36eb82faa8cf55846f0cfb.exe
4988	5e0534239f04a03e7a86a9230c77753ac3a87c1b5f36eb82faa8cf55846f0cfb.exe
4988	5e0534239f04a03e7a86a9230c77753ac3a87c1b5f36eb82faa8cf55846f0cfb.exe
4988	5e0534239f04a03e7a86a9230c77753ac3a87c1b5f36eb82faa8cf55846f0cfb.exe
4988	5e0534239f04a03e7a86a9230c77753ac3a87c1b5f36eb82faa8cf55846f0cfb.exe
4988	5e0534239f04a03e7a86a9230c77753ac3a87c1b5f36eb82faa8cf55846f0cfb.exe
4988	5e0534239f04a03e7a86a9230c77753ac3a87c1b5f36eb82faa8cf55846f0cfb.exe
4988	5e0534239f04a03e7a86a9230c77753ac3a87c1b5f36eb82faa8cf55846f0cfb.exe
4988	5e0534239f04a03e7a86a9230c77753ac3a87c1b5f36eb82faa8cf55846f0cfb.exe
4988	5e0534239f04a03e7a86a9230c77753ac3a87c1b5f36eb82faa8cf55846f0cfb.exe
4988	5e0534239f04a03e7a86a9230c77753ac3a87c1b5f36eb82faa8cf55846f0cfb.exe
4988	5e0534239f04a03e7a86a9230c77753ac3a87c1b5f36eb82faa8cf55846f0cfb.exe
4988	5e0534239f04a03e7a86a9230c77753ac3a87c1b5f36eb82faa8cf55846f0cfb.exe
4988	5e0534239f04a03e7a86a9230c77753ac3a87c1b5f36eb82faa8cf55846f0cfb.exe
4988	5e0534239f04a03e7a86a9230c77753ac3a87c1b5f36eb82faa8cf55846f0cfb.exe
4988	5e0534239f04a03e7a86a9230c77753ac3a87c1b5f36eb82faa8cf55846f0cfb.exe
4988	5e0534239f04a03e7a86a9230c77753ac3a87c1b5f36eb82faa8cf55846f0cfb.exe
4988	5e0534239f04a03e7a86a9230c77753ac3a87c1b5f36eb82faa8cf55846f0cfb.exe
4988	5e0534239f04a03e7a86a9230c77753ac3a87c1b5f36eb82faa8cf55846f0cfb.exe
4988	5e0534239f04a03e7a86a9230c77753ac3a87c1b5f36eb82faa8cf55846f0cfb.exe
4988	5e0534239f04a03e7a86a9230c77753ac3a87c1b5f36eb82faa8cf55846f0cfb.exe
4988	5e0534239f04a03e7a86a9230c77753ac3a87c1b5f36eb82faa8cf55846f0cfb.exe
4988	5e0534239f04a03e7a86a9230c77753ac3a87c1b5f36eb82faa8cf55846f0cfb.exe
4988	5e0534239f04a03e7a86a9230c77753ac3a87c1b5f36eb82faa8cf55846f0cfb.exe
4988	5e0534239f04a03e7a86a9230c77753ac3a87c1b5f36eb82faa8cf55846f0cfb.exe

Suspicious behavior: LoadsDriver 2 IoCs

Processes:

5e0534239f04a03e7a86a9230c77753ac3a87c1b5f36eb82faa8cf55846f0cfb.exe

pid process

660
4988 5e0534239f04a03e7a86a9230c77753ac3a87c1b5f36eb82faa8cf55846f0cfb.exe

pid	process
660
4988	5e0534239f04a03e7a86a9230c77753ac3a87c1b5f36eb82faa8cf55846f0cfb.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

5e0534239f04a03e7a86a9230c77753ac3a87c1b5f36eb82faa8cf55846f0cfb.exetakeown.exetakeown.exe

description	pid	process
Token: SeDebugPrivilege	4988	5e0534239f04a03e7a86a9230c77753ac3a87c1b5f36eb82faa8cf55846f0cfb.exe
Token: SeTakeOwnershipPrivilege	4932	takeown.exe
Token: SeTakeOwnershipPrivilege	3016	takeown.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

5e0534239f04a03e7a86a9230c77753ac3a87c1b5f36eb82faa8cf55846f0cfb.execmd.execmd.exe

description	pid	process	target process
PID 4988 wrote to memory of 3124	4988	5e0534239f04a03e7a86a9230c77753ac3a87c1b5f36eb82faa8cf55846f0cfb.exe	cmd.exe
PID 4988 wrote to memory of 3124	4988	5e0534239f04a03e7a86a9230c77753ac3a87c1b5f36eb82faa8cf55846f0cfb.exe	cmd.exe
PID 4988 wrote to memory of 3124	4988	5e0534239f04a03e7a86a9230c77753ac3a87c1b5f36eb82faa8cf55846f0cfb.exe	cmd.exe
PID 3124 wrote to memory of 4932	3124	cmd.exe	takeown.exe
PID 3124 wrote to memory of 4932	3124	cmd.exe	takeown.exe
PID 3124 wrote to memory of 4932	3124	cmd.exe	takeown.exe
PID 3124 wrote to memory of 4648	3124	cmd.exe	icacls.exe
PID 3124 wrote to memory of 4648	3124	cmd.exe	icacls.exe
PID 3124 wrote to memory of 4648	3124	cmd.exe	icacls.exe
PID 4988 wrote to memory of 4584	4988	5e0534239f04a03e7a86a9230c77753ac3a87c1b5f36eb82faa8cf55846f0cfb.exe	cmd.exe
PID 4988 wrote to memory of 4584	4988	5e0534239f04a03e7a86a9230c77753ac3a87c1b5f36eb82faa8cf55846f0cfb.exe	cmd.exe
PID 4988 wrote to memory of 4584	4988	5e0534239f04a03e7a86a9230c77753ac3a87c1b5f36eb82faa8cf55846f0cfb.exe	cmd.exe
PID 4584 wrote to memory of 3016	4584	cmd.exe	takeown.exe
PID 4584 wrote to memory of 3016	4584	cmd.exe	takeown.exe
PID 4584 wrote to memory of 3016	4584	cmd.exe	takeown.exe
PID 4584 wrote to memory of 1060	4584	cmd.exe	icacls.exe
PID 4584 wrote to memory of 1060	4584	cmd.exe	icacls.exe
PID 4584 wrote to memory of 1060	4584	cmd.exe	icacls.exe
PID 4988 wrote to memory of 2140	4988	5e0534239f04a03e7a86a9230c77753ac3a87c1b5f36eb82faa8cf55846f0cfb.exe	cmd.exe
PID 4988 wrote to memory of 2140	4988	5e0534239f04a03e7a86a9230c77753ac3a87c1b5f36eb82faa8cf55846f0cfb.exe	cmd.exe
PID 4988 wrote to memory of 2140	4988	5e0534239f04a03e7a86a9230c77753ac3a87c1b5f36eb82faa8cf55846f0cfb.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\5e0534239f04a03e7a86a9230c77753ac3a87c1b5f36eb82faa8cf55846f0cfb.exe
"C:\Users\Admin\AppData\Local\Temp\5e0534239f04a03e7a86a9230c77753ac3a87c1b5f36eb82faa8cf55846f0cfb.exe"
1⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Installs/modifies Browser Helper Object
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4988

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c takeown /f C:\Windows\SysWOW64\wshtcpip.dll && icacls C:\Windows\SysWOW64\wshtcpip.dll /grant administrators:F
2⤵
- Suspicious use of WriteProcessMemory
PID:3124

C:\Windows\SysWOW64\takeown.exe
takeown /f C:\Windows\SysWOW64\wshtcpip.dll
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:4932

C:\Windows\SysWOW64\icacls.exe
icacls C:\Windows\SysWOW64\wshtcpip.dll /grant administrators:F
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:4648

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c takeown /f C:\Windows\SysWOW64\midimap.dll && icacls C:\Windows\SysWOW64\midimap.dll /grant administrators:F
2⤵
- Suspicious use of WriteProcessMemory
PID:4584

C:\Windows\SysWOW64\takeown.exe
takeown /f C:\Windows\SysWOW64\midimap.dll
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:3016

C:\Windows\SysWOW64\icacls.exe
icacls C:\Windows\SysWOW64\midimap.dll /grant administrators:F
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1060

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ahnmove.bat
2⤵
PID:2140

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Browser Extensions

1

T1176

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

File Permissions Modification

1

T1222

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ahnmove.bat
Filesize
181B

MD5
69dc86098b55f2d298250d14088f017f

SHA1
e945938c90cedaa580b85306666f96d9211a316d

SHA256
ece1a44f77f1ea604929c6a7ca120341114447342784090ce7e62cc4ce121c44

SHA512
254baab5f6e4849de7608c987630aa1339c4ab65d211e816b7d44e0c9bc2d58541a0d49380174f36d7c79d940049a5e4f2769d1d9d85b20934ef870c21ebd779

Download Submit
memory/1060-141-0x0000000000000000-mapping.dmp

Download
memory/2140-142-0x0000000000000000-mapping.dmp

Download
memory/3016-140-0x0000000000000000-mapping.dmp

Download
memory/3124-136-0x0000000000000000-mapping.dmp

Download
memory/4584-139-0x0000000000000000-mapping.dmp

Download
memory/4648-138-0x0000000000000000-mapping.dmp

Download
memory/4932-137-0x0000000000000000-mapping.dmp

Download
memory/4988-132-0x0000000001000000-0x0000000001168000-memory.dmp

Filesize
1.4MB

Download
memory/4988-135-0x0000000000650000-0x0000000000670000-memory.dmp

Filesize
128KB

Download
memory/4988-134-0x0000000001000000-0x0000000001168000-memory.dmp

Filesize
1.4MB

Download
memory/4988-143-0x0000000001000000-0x0000000001168000-memory.dmp

Filesize
1.4MB

Download
memory/4988-133-0x0000000000650000-0x0000000000670000-memory.dmp

Filesize
128KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads