a477ea187d43cea91a5bcfb5e2d6609d192c29b0f8dc2979a2096986bba88192

General

Target

a477ea187d43cea91a5bcfb5e2d6609d192c29b0f8dc2979a2096986bba88192.exe
Size

350KB
MD5

0d1afcba9798b04f1f8cb790f01a3300
SHA1

fa57ea84af2a380c493d30830118c80e8f2bbc09
SHA256

a477ea187d43cea91a5bcfb5e2d6609d192c29b0f8dc2979a2096986bba88192
SHA512

6eefa29448c6c1ae2139088be9e08d3c82f362f2aba5efbcb273109104eb5b7623dec71edc5b26e07717a8b12aa69a5610353b9da3d1c126ee1d685cdcc095f0
SSDEEP

6144:gyXu7IEBSsQ9ElMwm60lmqs7MTRGA3h3GVqdppJXEGhBukJF/KAwxFUOWdEmh:g3BdQLL4BE93NGVYZX9BukJlwxSJdEm

Score

8^/10

adware discovery exploit persistence stealer upx

Malware Config

Signatures

Drops file in Drivers directory 2 IoCs

Processes:

a477ea187d43cea91a5bcfb5e2d6609d192c29b0f8dc2979a2096986bba88192.exe

description	ioc	process
File created	C:\Windows\SysWOW64\drivers\61442c14.sys	a477ea187d43cea91a5bcfb5e2d6609d192c29b0f8dc2979a2096986bba88192.exe
File created	C:\Windows\SysWOW64\drivers\1def1992.sys	a477ea187d43cea91a5bcfb5e2d6609d192c29b0f8dc2979a2096986bba88192.exe

Possible privilege escalation attempt 2 IoCs
exploit

Processes:

takeown.exeicacls.exe

pid process

2368 takeown.exe
4524 icacls.exe

pid	process
2368	takeown.exe
4524	icacls.exe

Sets service image path in registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

a477ea187d43cea91a5bcfb5e2d6609d192c29b0f8dc2979a2096986bba88192.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\61442c14\ImagePath = "\\??\\C:\\Windows\\SysWOW64\\drivers\\61442c14.sys"	a477ea187d43cea91a5bcfb5e2d6609d192c29b0f8dc2979a2096986bba88192.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\1def1992\ImagePath = "\\??\\C:\\Windows\\SysWOW64\\drivers\\1def1992.sys"	a477ea187d43cea91a5bcfb5e2d6609d192c29b0f8dc2979a2096986bba88192.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/4784-132-0x0000000001000000-0x000000000112D000-memory.dmp	upx
behavioral2/memory/4784-133-0x0000000001000000-0x000000000112D000-memory.dmp	upx
behavioral2/memory/4784-138-0x0000000001000000-0x000000000112D000-memory.dmp	upx

Modifies file permissions 1 TTPs 2 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

takeown.exeicacls.exe

pid process

2368 takeown.exe
4524 icacls.exe

pid	process
2368	takeown.exe
4524	icacls.exe

Installs/modifies Browser Helper Object 2 TTPs 3 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

Processes:

a477ea187d43cea91a5bcfb5e2d6609d192c29b0f8dc2979a2096986bba88192.exe

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}	a477ea187d43cea91a5bcfb5e2d6609d192c29b0f8dc2979a2096986bba88192.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}	a477ea187d43cea91a5bcfb5e2d6609d192c29b0f8dc2979a2096986bba88192.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	a477ea187d43cea91a5bcfb5e2d6609d192c29b0f8dc2979a2096986bba88192.exe

Drops file in System32 directory 5 IoCs

Processes:

a477ea187d43cea91a5bcfb5e2d6609d192c29b0f8dc2979a2096986bba88192.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\goodsb.dll	a477ea187d43cea91a5bcfb5e2d6609d192c29b0f8dc2979a2096986bba88192.exe
File created	C:\Windows\SysWOW64\goodsb.dll	a477ea187d43cea91a5bcfb5e2d6609d192c29b0f8dc2979a2096986bba88192.exe
File created	C:\Windows\SysWOW64\ws2tcpip.dll	a477ea187d43cea91a5bcfb5e2d6609d192c29b0f8dc2979a2096986bba88192.exe
File opened for modification	C:\Windows\SysWOW64\ws2tcpip.dll	a477ea187d43cea91a5bcfb5e2d6609d192c29b0f8dc2979a2096986bba88192.exe
File created	C:\Windows\SysWOW64\wshtcpip.dll	a477ea187d43cea91a5bcfb5e2d6609d192c29b0f8dc2979a2096986bba88192.exe

Modifies registry class 4 IoCs

Processes:

a477ea187d43cea91a5bcfb5e2d6609d192c29b0f8dc2979a2096986bba88192.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\HOOK_ID\name = "a477ea187d43cea91a5bcfb5e2d6609d192c29b0f8dc2979a2096986bba88192.exe"	a477ea187d43cea91a5bcfb5e2d6609d192c29b0f8dc2979a2096986bba88192.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\SYS_DLL	a477ea187d43cea91a5bcfb5e2d6609d192c29b0f8dc2979a2096986bba88192.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\SYS_DLL\name = "RqjJdpkHi.dll"	a477ea187d43cea91a5bcfb5e2d6609d192c29b0f8dc2979a2096986bba88192.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\HOOK_ID	a477ea187d43cea91a5bcfb5e2d6609d192c29b0f8dc2979a2096986bba88192.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

a477ea187d43cea91a5bcfb5e2d6609d192c29b0f8dc2979a2096986bba88192.exe

pid	process
4784	a477ea187d43cea91a5bcfb5e2d6609d192c29b0f8dc2979a2096986bba88192.exe
4784	a477ea187d43cea91a5bcfb5e2d6609d192c29b0f8dc2979a2096986bba88192.exe
4784	a477ea187d43cea91a5bcfb5e2d6609d192c29b0f8dc2979a2096986bba88192.exe
4784	a477ea187d43cea91a5bcfb5e2d6609d192c29b0f8dc2979a2096986bba88192.exe
4784	a477ea187d43cea91a5bcfb5e2d6609d192c29b0f8dc2979a2096986bba88192.exe
4784	a477ea187d43cea91a5bcfb5e2d6609d192c29b0f8dc2979a2096986bba88192.exe
4784	a477ea187d43cea91a5bcfb5e2d6609d192c29b0f8dc2979a2096986bba88192.exe
4784	a477ea187d43cea91a5bcfb5e2d6609d192c29b0f8dc2979a2096986bba88192.exe
4784	a477ea187d43cea91a5bcfb5e2d6609d192c29b0f8dc2979a2096986bba88192.exe
4784	a477ea187d43cea91a5bcfb5e2d6609d192c29b0f8dc2979a2096986bba88192.exe
4784	a477ea187d43cea91a5bcfb5e2d6609d192c29b0f8dc2979a2096986bba88192.exe
4784	a477ea187d43cea91a5bcfb5e2d6609d192c29b0f8dc2979a2096986bba88192.exe
4784	a477ea187d43cea91a5bcfb5e2d6609d192c29b0f8dc2979a2096986bba88192.exe
4784	a477ea187d43cea91a5bcfb5e2d6609d192c29b0f8dc2979a2096986bba88192.exe
4784	a477ea187d43cea91a5bcfb5e2d6609d192c29b0f8dc2979a2096986bba88192.exe
4784	a477ea187d43cea91a5bcfb5e2d6609d192c29b0f8dc2979a2096986bba88192.exe
4784	a477ea187d43cea91a5bcfb5e2d6609d192c29b0f8dc2979a2096986bba88192.exe
4784	a477ea187d43cea91a5bcfb5e2d6609d192c29b0f8dc2979a2096986bba88192.exe
4784	a477ea187d43cea91a5bcfb5e2d6609d192c29b0f8dc2979a2096986bba88192.exe
4784	a477ea187d43cea91a5bcfb5e2d6609d192c29b0f8dc2979a2096986bba88192.exe
4784	a477ea187d43cea91a5bcfb5e2d6609d192c29b0f8dc2979a2096986bba88192.exe
4784	a477ea187d43cea91a5bcfb5e2d6609d192c29b0f8dc2979a2096986bba88192.exe
4784	a477ea187d43cea91a5bcfb5e2d6609d192c29b0f8dc2979a2096986bba88192.exe
4784	a477ea187d43cea91a5bcfb5e2d6609d192c29b0f8dc2979a2096986bba88192.exe
4784	a477ea187d43cea91a5bcfb5e2d6609d192c29b0f8dc2979a2096986bba88192.exe
4784	a477ea187d43cea91a5bcfb5e2d6609d192c29b0f8dc2979a2096986bba88192.exe
4784	a477ea187d43cea91a5bcfb5e2d6609d192c29b0f8dc2979a2096986bba88192.exe
4784	a477ea187d43cea91a5bcfb5e2d6609d192c29b0f8dc2979a2096986bba88192.exe
4784	a477ea187d43cea91a5bcfb5e2d6609d192c29b0f8dc2979a2096986bba88192.exe
4784	a477ea187d43cea91a5bcfb5e2d6609d192c29b0f8dc2979a2096986bba88192.exe
4784	a477ea187d43cea91a5bcfb5e2d6609d192c29b0f8dc2979a2096986bba88192.exe
4784	a477ea187d43cea91a5bcfb5e2d6609d192c29b0f8dc2979a2096986bba88192.exe
4784	a477ea187d43cea91a5bcfb5e2d6609d192c29b0f8dc2979a2096986bba88192.exe
4784	a477ea187d43cea91a5bcfb5e2d6609d192c29b0f8dc2979a2096986bba88192.exe
4784	a477ea187d43cea91a5bcfb5e2d6609d192c29b0f8dc2979a2096986bba88192.exe
4784	a477ea187d43cea91a5bcfb5e2d6609d192c29b0f8dc2979a2096986bba88192.exe
4784	a477ea187d43cea91a5bcfb5e2d6609d192c29b0f8dc2979a2096986bba88192.exe
4784	a477ea187d43cea91a5bcfb5e2d6609d192c29b0f8dc2979a2096986bba88192.exe
4784	a477ea187d43cea91a5bcfb5e2d6609d192c29b0f8dc2979a2096986bba88192.exe
4784	a477ea187d43cea91a5bcfb5e2d6609d192c29b0f8dc2979a2096986bba88192.exe
4784	a477ea187d43cea91a5bcfb5e2d6609d192c29b0f8dc2979a2096986bba88192.exe
4784	a477ea187d43cea91a5bcfb5e2d6609d192c29b0f8dc2979a2096986bba88192.exe
4784	a477ea187d43cea91a5bcfb5e2d6609d192c29b0f8dc2979a2096986bba88192.exe
4784	a477ea187d43cea91a5bcfb5e2d6609d192c29b0f8dc2979a2096986bba88192.exe
4784	a477ea187d43cea91a5bcfb5e2d6609d192c29b0f8dc2979a2096986bba88192.exe
4784	a477ea187d43cea91a5bcfb5e2d6609d192c29b0f8dc2979a2096986bba88192.exe
4784	a477ea187d43cea91a5bcfb5e2d6609d192c29b0f8dc2979a2096986bba88192.exe
4784	a477ea187d43cea91a5bcfb5e2d6609d192c29b0f8dc2979a2096986bba88192.exe
4784	a477ea187d43cea91a5bcfb5e2d6609d192c29b0f8dc2979a2096986bba88192.exe
4784	a477ea187d43cea91a5bcfb5e2d6609d192c29b0f8dc2979a2096986bba88192.exe
4784	a477ea187d43cea91a5bcfb5e2d6609d192c29b0f8dc2979a2096986bba88192.exe
4784	a477ea187d43cea91a5bcfb5e2d6609d192c29b0f8dc2979a2096986bba88192.exe
4784	a477ea187d43cea91a5bcfb5e2d6609d192c29b0f8dc2979a2096986bba88192.exe
4784	a477ea187d43cea91a5bcfb5e2d6609d192c29b0f8dc2979a2096986bba88192.exe
4784	a477ea187d43cea91a5bcfb5e2d6609d192c29b0f8dc2979a2096986bba88192.exe
4784	a477ea187d43cea91a5bcfb5e2d6609d192c29b0f8dc2979a2096986bba88192.exe
4784	a477ea187d43cea91a5bcfb5e2d6609d192c29b0f8dc2979a2096986bba88192.exe
4784	a477ea187d43cea91a5bcfb5e2d6609d192c29b0f8dc2979a2096986bba88192.exe
4784	a477ea187d43cea91a5bcfb5e2d6609d192c29b0f8dc2979a2096986bba88192.exe
4784	a477ea187d43cea91a5bcfb5e2d6609d192c29b0f8dc2979a2096986bba88192.exe
4784	a477ea187d43cea91a5bcfb5e2d6609d192c29b0f8dc2979a2096986bba88192.exe
4784	a477ea187d43cea91a5bcfb5e2d6609d192c29b0f8dc2979a2096986bba88192.exe
4784	a477ea187d43cea91a5bcfb5e2d6609d192c29b0f8dc2979a2096986bba88192.exe
4784	a477ea187d43cea91a5bcfb5e2d6609d192c29b0f8dc2979a2096986bba88192.exe

Suspicious behavior: LoadsDriver 5 IoCs

Processes:

a477ea187d43cea91a5bcfb5e2d6609d192c29b0f8dc2979a2096986bba88192.exe

pid	process
648
4784	a477ea187d43cea91a5bcfb5e2d6609d192c29b0f8dc2979a2096986bba88192.exe
648
4784	a477ea187d43cea91a5bcfb5e2d6609d192c29b0f8dc2979a2096986bba88192.exe
4784	a477ea187d43cea91a5bcfb5e2d6609d192c29b0f8dc2979a2096986bba88192.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

a477ea187d43cea91a5bcfb5e2d6609d192c29b0f8dc2979a2096986bba88192.exetakeown.exe

description	pid	process
Token: SeDebugPrivilege	4784	a477ea187d43cea91a5bcfb5e2d6609d192c29b0f8dc2979a2096986bba88192.exe
Token: SeTakeOwnershipPrivilege	2368	takeown.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

a477ea187d43cea91a5bcfb5e2d6609d192c29b0f8dc2979a2096986bba88192.execmd.exe

description	pid	process	target process
PID 4784 wrote to memory of 1904	4784	a477ea187d43cea91a5bcfb5e2d6609d192c29b0f8dc2979a2096986bba88192.exe	cmd.exe
PID 4784 wrote to memory of 1904	4784	a477ea187d43cea91a5bcfb5e2d6609d192c29b0f8dc2979a2096986bba88192.exe	cmd.exe
PID 4784 wrote to memory of 1904	4784	a477ea187d43cea91a5bcfb5e2d6609d192c29b0f8dc2979a2096986bba88192.exe	cmd.exe
PID 1904 wrote to memory of 2368	1904	cmd.exe	takeown.exe
PID 1904 wrote to memory of 2368	1904	cmd.exe	takeown.exe
PID 1904 wrote to memory of 2368	1904	cmd.exe	takeown.exe
PID 1904 wrote to memory of 4524	1904	cmd.exe	icacls.exe
PID 1904 wrote to memory of 4524	1904	cmd.exe	icacls.exe
PID 1904 wrote to memory of 4524	1904	cmd.exe	icacls.exe
PID 4784 wrote to memory of 2488	4784	a477ea187d43cea91a5bcfb5e2d6609d192c29b0f8dc2979a2096986bba88192.exe	cmd.exe
PID 4784 wrote to memory of 2488	4784	a477ea187d43cea91a5bcfb5e2d6609d192c29b0f8dc2979a2096986bba88192.exe	cmd.exe
PID 4784 wrote to memory of 2488	4784	a477ea187d43cea91a5bcfb5e2d6609d192c29b0f8dc2979a2096986bba88192.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\a477ea187d43cea91a5bcfb5e2d6609d192c29b0f8dc2979a2096986bba88192.exe
"C:\Users\Admin\AppData\Local\Temp\a477ea187d43cea91a5bcfb5e2d6609d192c29b0f8dc2979a2096986bba88192.exe"
1⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4784
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c takeown /f C:\Windows\SysWOW64\wshtcpip.dll && icacls C:\Windows\SysWOW64\wshtcpip.dll /grant administrators:F
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1904
- - C:\Windows\SysWOW64\takeown.exe
    takeown /f C:\Windows\SysWOW64\wshtcpip.dll
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:2368
- - C:\Windows\SysWOW64\icacls.exe
    icacls C:\Windows\SysWOW64\wshtcpip.dll /grant administrators:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4524
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ahnmove.bat
  2⤵
  PID:2488

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Browser Extensions

1

T1176

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ahnmove.bat

Filesize
181B

MD5
c951a3fe039aae120705d7b2f4309f51

SHA1
ae1a6c806813300217af9deacee87786b74a62b2

SHA256
a048318e37035649c55a3a7d8ae31899bbcdca8ce1b11d4b5a3581c7007e0563

SHA512
ab1e4b7a167b24eda8a36ec6c2522925c3b88d3c5e7e0ef665b280e3cfd634227d333c1ba0e70ab0370f9aea1f6c8d346c6743f2604e5dd261dd5dc1edffc6b9

Download Submit
memory/1904-134-0x0000000000000000-mapping.dmp

Download
memory/2368-135-0x0000000000000000-mapping.dmp

Download
memory/2488-137-0x0000000000000000-mapping.dmp

Download
memory/4524-136-0x0000000000000000-mapping.dmp

Download
memory/4784-132-0x0000000001000000-0x000000000112D000-memory.dmp

Filesize
1.2MB

Download
memory/4784-133-0x0000000001000000-0x000000000112D000-memory.dmp

Filesize
1.2MB

Download
memory/4784-138-0x0000000001000000-0x000000000112D000-memory.dmp

Filesize
1.2MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads