Analysis
-
max time kernel
151s -
max time network
169s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
07-11-2022 05:29
Behavioral task
behavioral1
Sample
8c54d33760b49b49093fdf0ef70a7bf39b36ae89121a47c7cf245e6781c7db33.exe
Resource
win7-20220812-en
General
-
Target
8c54d33760b49b49093fdf0ef70a7bf39b36ae89121a47c7cf245e6781c7db33.exe
-
Size
350KB
-
MD5
0d253b3abddfb2b204fa5d30131d5f50
-
SHA1
e213a198af40e48cc7ebdb76a23602c14546e60d
-
SHA256
8c54d33760b49b49093fdf0ef70a7bf39b36ae89121a47c7cf245e6781c7db33
-
SHA512
d2f04138c8acbb35a89b19ab8bdcb35390c7cd20b66882a8910c0673d94423756d16b56dd3d76e6ed9e964534e6f8adca14a575c224b92529502586926452b34
-
SSDEEP
6144:TyXu7IEBSsQ9ElMwm60lmqs7MTRGA3h3GVqdppJXEGhBukJF/KAwxFUOWdEmh:T3BdQLL4BE93NGVYZX9BukJlwxSJdEm
Malware Config
Signatures
-
Drops file in Drivers directory 2 IoCs
Processes:
8c54d33760b49b49093fdf0ef70a7bf39b36ae89121a47c7cf245e6781c7db33.exedescription ioc process File created C:\Windows\SysWOW64\drivers\0f9dfb75.sys 8c54d33760b49b49093fdf0ef70a7bf39b36ae89121a47c7cf245e6781c7db33.exe File created C:\Windows\SysWOW64\drivers\7336cef3.sys 8c54d33760b49b49093fdf0ef70a7bf39b36ae89121a47c7cf245e6781c7db33.exe -
Possible privilege escalation attempt 2 IoCs
Processes:
takeown.exeicacls.exepid process 3436 takeown.exe 1052 icacls.exe -
Sets service image path in registry 2 TTPs 2 IoCs
Processes:
8c54d33760b49b49093fdf0ef70a7bf39b36ae89121a47c7cf245e6781c7db33.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\0f9dfb75\ImagePath = "\\??\\C:\\Windows\\SysWOW64\\drivers\\0f9dfb75.sys" 8c54d33760b49b49093fdf0ef70a7bf39b36ae89121a47c7cf245e6781c7db33.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\7336cef3\ImagePath = "\\??\\C:\\Windows\\SysWOW64\\drivers\\7336cef3.sys" 8c54d33760b49b49093fdf0ef70a7bf39b36ae89121a47c7cf245e6781c7db33.exe -
Processes:
resource yara_rule behavioral2/memory/3976-132-0x0000000001000000-0x000000000112D000-memory.dmp upx behavioral2/memory/3976-133-0x0000000001000000-0x000000000112D000-memory.dmp upx behavioral2/memory/3976-138-0x0000000001000000-0x000000000112D000-memory.dmp upx -
Modifies file permissions 1 TTPs 2 IoCs
Processes:
takeown.exeicacls.exepid process 3436 takeown.exe 1052 icacls.exe -
Installs/modifies Browser Helper Object 2 TTPs 3 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
Processes:
8c54d33760b49b49093fdf0ef70a7bf39b36ae89121a47c7cf245e6781c7db33.exedescription ioc process Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA} 8c54d33760b49b49093fdf0ef70a7bf39b36ae89121a47c7cf245e6781c7db33.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C} 8c54d33760b49b49093fdf0ef70a7bf39b36ae89121a47c7cf245e6781c7db33.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects 8c54d33760b49b49093fdf0ef70a7bf39b36ae89121a47c7cf245e6781c7db33.exe -
Drops file in System32 directory 5 IoCs
Processes:
8c54d33760b49b49093fdf0ef70a7bf39b36ae89121a47c7cf245e6781c7db33.exedescription ioc process File opened for modification C:\Windows\SysWOW64\ws2tcpip.dll 8c54d33760b49b49093fdf0ef70a7bf39b36ae89121a47c7cf245e6781c7db33.exe File created C:\Windows\SysWOW64\wshtcpip.dll 8c54d33760b49b49093fdf0ef70a7bf39b36ae89121a47c7cf245e6781c7db33.exe File opened for modification C:\Windows\SysWOW64\goodsb.dll 8c54d33760b49b49093fdf0ef70a7bf39b36ae89121a47c7cf245e6781c7db33.exe File created C:\Windows\SysWOW64\goodsb.dll 8c54d33760b49b49093fdf0ef70a7bf39b36ae89121a47c7cf245e6781c7db33.exe File created C:\Windows\SysWOW64\ws2tcpip.dll 8c54d33760b49b49093fdf0ef70a7bf39b36ae89121a47c7cf245e6781c7db33.exe -
Modifies registry class 4 IoCs
Processes:
8c54d33760b49b49093fdf0ef70a7bf39b36ae89121a47c7cf245e6781c7db33.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\HOOK_ID 8c54d33760b49b49093fdf0ef70a7bf39b36ae89121a47c7cf245e6781c7db33.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\HOOK_ID\name = "8c54d33760b49b49093fdf0ef70a7bf39b36ae89121a47c7cf245e6781c7db33.exe" 8c54d33760b49b49093fdf0ef70a7bf39b36ae89121a47c7cf245e6781c7db33.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\SYS_DLL 8c54d33760b49b49093fdf0ef70a7bf39b36ae89121a47c7cf245e6781c7db33.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\SYS_DLL\name = "uffu.dll" 8c54d33760b49b49093fdf0ef70a7bf39b36ae89121a47c7cf245e6781c7db33.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
8c54d33760b49b49093fdf0ef70a7bf39b36ae89121a47c7cf245e6781c7db33.exepid process 3976 8c54d33760b49b49093fdf0ef70a7bf39b36ae89121a47c7cf245e6781c7db33.exe 3976 8c54d33760b49b49093fdf0ef70a7bf39b36ae89121a47c7cf245e6781c7db33.exe 3976 8c54d33760b49b49093fdf0ef70a7bf39b36ae89121a47c7cf245e6781c7db33.exe 3976 8c54d33760b49b49093fdf0ef70a7bf39b36ae89121a47c7cf245e6781c7db33.exe 3976 8c54d33760b49b49093fdf0ef70a7bf39b36ae89121a47c7cf245e6781c7db33.exe 3976 8c54d33760b49b49093fdf0ef70a7bf39b36ae89121a47c7cf245e6781c7db33.exe 3976 8c54d33760b49b49093fdf0ef70a7bf39b36ae89121a47c7cf245e6781c7db33.exe 3976 8c54d33760b49b49093fdf0ef70a7bf39b36ae89121a47c7cf245e6781c7db33.exe 3976 8c54d33760b49b49093fdf0ef70a7bf39b36ae89121a47c7cf245e6781c7db33.exe 3976 8c54d33760b49b49093fdf0ef70a7bf39b36ae89121a47c7cf245e6781c7db33.exe 3976 8c54d33760b49b49093fdf0ef70a7bf39b36ae89121a47c7cf245e6781c7db33.exe 3976 8c54d33760b49b49093fdf0ef70a7bf39b36ae89121a47c7cf245e6781c7db33.exe 3976 8c54d33760b49b49093fdf0ef70a7bf39b36ae89121a47c7cf245e6781c7db33.exe 3976 8c54d33760b49b49093fdf0ef70a7bf39b36ae89121a47c7cf245e6781c7db33.exe 3976 8c54d33760b49b49093fdf0ef70a7bf39b36ae89121a47c7cf245e6781c7db33.exe 3976 8c54d33760b49b49093fdf0ef70a7bf39b36ae89121a47c7cf245e6781c7db33.exe 3976 8c54d33760b49b49093fdf0ef70a7bf39b36ae89121a47c7cf245e6781c7db33.exe 3976 8c54d33760b49b49093fdf0ef70a7bf39b36ae89121a47c7cf245e6781c7db33.exe 3976 8c54d33760b49b49093fdf0ef70a7bf39b36ae89121a47c7cf245e6781c7db33.exe 3976 8c54d33760b49b49093fdf0ef70a7bf39b36ae89121a47c7cf245e6781c7db33.exe 3976 8c54d33760b49b49093fdf0ef70a7bf39b36ae89121a47c7cf245e6781c7db33.exe 3976 8c54d33760b49b49093fdf0ef70a7bf39b36ae89121a47c7cf245e6781c7db33.exe 3976 8c54d33760b49b49093fdf0ef70a7bf39b36ae89121a47c7cf245e6781c7db33.exe 3976 8c54d33760b49b49093fdf0ef70a7bf39b36ae89121a47c7cf245e6781c7db33.exe 3976 8c54d33760b49b49093fdf0ef70a7bf39b36ae89121a47c7cf245e6781c7db33.exe 3976 8c54d33760b49b49093fdf0ef70a7bf39b36ae89121a47c7cf245e6781c7db33.exe 3976 8c54d33760b49b49093fdf0ef70a7bf39b36ae89121a47c7cf245e6781c7db33.exe 3976 8c54d33760b49b49093fdf0ef70a7bf39b36ae89121a47c7cf245e6781c7db33.exe 3976 8c54d33760b49b49093fdf0ef70a7bf39b36ae89121a47c7cf245e6781c7db33.exe 3976 8c54d33760b49b49093fdf0ef70a7bf39b36ae89121a47c7cf245e6781c7db33.exe 3976 8c54d33760b49b49093fdf0ef70a7bf39b36ae89121a47c7cf245e6781c7db33.exe 3976 8c54d33760b49b49093fdf0ef70a7bf39b36ae89121a47c7cf245e6781c7db33.exe 3976 8c54d33760b49b49093fdf0ef70a7bf39b36ae89121a47c7cf245e6781c7db33.exe 3976 8c54d33760b49b49093fdf0ef70a7bf39b36ae89121a47c7cf245e6781c7db33.exe 3976 8c54d33760b49b49093fdf0ef70a7bf39b36ae89121a47c7cf245e6781c7db33.exe 3976 8c54d33760b49b49093fdf0ef70a7bf39b36ae89121a47c7cf245e6781c7db33.exe 3976 8c54d33760b49b49093fdf0ef70a7bf39b36ae89121a47c7cf245e6781c7db33.exe 3976 8c54d33760b49b49093fdf0ef70a7bf39b36ae89121a47c7cf245e6781c7db33.exe 3976 8c54d33760b49b49093fdf0ef70a7bf39b36ae89121a47c7cf245e6781c7db33.exe 3976 8c54d33760b49b49093fdf0ef70a7bf39b36ae89121a47c7cf245e6781c7db33.exe 3976 8c54d33760b49b49093fdf0ef70a7bf39b36ae89121a47c7cf245e6781c7db33.exe 3976 8c54d33760b49b49093fdf0ef70a7bf39b36ae89121a47c7cf245e6781c7db33.exe 3976 8c54d33760b49b49093fdf0ef70a7bf39b36ae89121a47c7cf245e6781c7db33.exe 3976 8c54d33760b49b49093fdf0ef70a7bf39b36ae89121a47c7cf245e6781c7db33.exe 3976 8c54d33760b49b49093fdf0ef70a7bf39b36ae89121a47c7cf245e6781c7db33.exe 3976 8c54d33760b49b49093fdf0ef70a7bf39b36ae89121a47c7cf245e6781c7db33.exe 3976 8c54d33760b49b49093fdf0ef70a7bf39b36ae89121a47c7cf245e6781c7db33.exe 3976 8c54d33760b49b49093fdf0ef70a7bf39b36ae89121a47c7cf245e6781c7db33.exe 3976 8c54d33760b49b49093fdf0ef70a7bf39b36ae89121a47c7cf245e6781c7db33.exe 3976 8c54d33760b49b49093fdf0ef70a7bf39b36ae89121a47c7cf245e6781c7db33.exe 3976 8c54d33760b49b49093fdf0ef70a7bf39b36ae89121a47c7cf245e6781c7db33.exe 3976 8c54d33760b49b49093fdf0ef70a7bf39b36ae89121a47c7cf245e6781c7db33.exe 3976 8c54d33760b49b49093fdf0ef70a7bf39b36ae89121a47c7cf245e6781c7db33.exe 3976 8c54d33760b49b49093fdf0ef70a7bf39b36ae89121a47c7cf245e6781c7db33.exe 3976 8c54d33760b49b49093fdf0ef70a7bf39b36ae89121a47c7cf245e6781c7db33.exe 3976 8c54d33760b49b49093fdf0ef70a7bf39b36ae89121a47c7cf245e6781c7db33.exe 3976 8c54d33760b49b49093fdf0ef70a7bf39b36ae89121a47c7cf245e6781c7db33.exe 3976 8c54d33760b49b49093fdf0ef70a7bf39b36ae89121a47c7cf245e6781c7db33.exe 3976 8c54d33760b49b49093fdf0ef70a7bf39b36ae89121a47c7cf245e6781c7db33.exe 3976 8c54d33760b49b49093fdf0ef70a7bf39b36ae89121a47c7cf245e6781c7db33.exe 3976 8c54d33760b49b49093fdf0ef70a7bf39b36ae89121a47c7cf245e6781c7db33.exe 3976 8c54d33760b49b49093fdf0ef70a7bf39b36ae89121a47c7cf245e6781c7db33.exe 3976 8c54d33760b49b49093fdf0ef70a7bf39b36ae89121a47c7cf245e6781c7db33.exe 3976 8c54d33760b49b49093fdf0ef70a7bf39b36ae89121a47c7cf245e6781c7db33.exe -
Suspicious behavior: LoadsDriver 5 IoCs
Processes:
8c54d33760b49b49093fdf0ef70a7bf39b36ae89121a47c7cf245e6781c7db33.exepid process 648 3976 8c54d33760b49b49093fdf0ef70a7bf39b36ae89121a47c7cf245e6781c7db33.exe 648 3976 8c54d33760b49b49093fdf0ef70a7bf39b36ae89121a47c7cf245e6781c7db33.exe 3976 8c54d33760b49b49093fdf0ef70a7bf39b36ae89121a47c7cf245e6781c7db33.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
8c54d33760b49b49093fdf0ef70a7bf39b36ae89121a47c7cf245e6781c7db33.exetakeown.exedescription pid process Token: SeDebugPrivilege 3976 8c54d33760b49b49093fdf0ef70a7bf39b36ae89121a47c7cf245e6781c7db33.exe Token: SeTakeOwnershipPrivilege 3436 takeown.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
8c54d33760b49b49093fdf0ef70a7bf39b36ae89121a47c7cf245e6781c7db33.execmd.exedescription pid process target process PID 3976 wrote to memory of 3408 3976 8c54d33760b49b49093fdf0ef70a7bf39b36ae89121a47c7cf245e6781c7db33.exe cmd.exe PID 3976 wrote to memory of 3408 3976 8c54d33760b49b49093fdf0ef70a7bf39b36ae89121a47c7cf245e6781c7db33.exe cmd.exe PID 3976 wrote to memory of 3408 3976 8c54d33760b49b49093fdf0ef70a7bf39b36ae89121a47c7cf245e6781c7db33.exe cmd.exe PID 3408 wrote to memory of 3436 3408 cmd.exe takeown.exe PID 3408 wrote to memory of 3436 3408 cmd.exe takeown.exe PID 3408 wrote to memory of 3436 3408 cmd.exe takeown.exe PID 3408 wrote to memory of 1052 3408 cmd.exe icacls.exe PID 3408 wrote to memory of 1052 3408 cmd.exe icacls.exe PID 3408 wrote to memory of 1052 3408 cmd.exe icacls.exe PID 3976 wrote to memory of 4872 3976 8c54d33760b49b49093fdf0ef70a7bf39b36ae89121a47c7cf245e6781c7db33.exe cmd.exe PID 3976 wrote to memory of 4872 3976 8c54d33760b49b49093fdf0ef70a7bf39b36ae89121a47c7cf245e6781c7db33.exe cmd.exe PID 3976 wrote to memory of 4872 3976 8c54d33760b49b49093fdf0ef70a7bf39b36ae89121a47c7cf245e6781c7db33.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8c54d33760b49b49093fdf0ef70a7bf39b36ae89121a47c7cf245e6781c7db33.exe"C:\Users\Admin\AppData\Local\Temp\8c54d33760b49b49093fdf0ef70a7bf39b36ae89121a47c7cf245e6781c7db33.exe"1⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /c takeown /f C:\Windows\SysWOW64\wshtcpip.dll && icacls C:\Windows\SysWOW64\wshtcpip.dll /grant administrators:F2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\SysWOW64\wshtcpip.dll3⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\icacls.exeicacls C:\Windows\SysWOW64\wshtcpip.dll /grant administrators:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ahnmove.bat2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\ahnmove.batFilesize
181B
MD5b654b10364177010de2c2fb5110ee08d
SHA1fe58357b93fefa8b474c81574fca29fc5690e4c5
SHA256cd8788c72ef74e116327fe773ab26048d8baed26db0d3c3f8025d88e32bc6a13
SHA512840d3ab8c907bb188c8b0232d7c1c41b86fa204a4f0652dd551d06f02e2cc359cd01e7edc35d60028076c036737e3c1739a1da404877f7242a7c496370267e81
-
memory/1052-136-0x0000000000000000-mapping.dmp
-
memory/3408-134-0x0000000000000000-mapping.dmp
-
memory/3436-135-0x0000000000000000-mapping.dmp
-
memory/3976-132-0x0000000001000000-0x000000000112D000-memory.dmpFilesize
1.2MB
-
memory/3976-133-0x0000000001000000-0x000000000112D000-memory.dmpFilesize
1.2MB
-
memory/3976-138-0x0000000001000000-0x000000000112D000-memory.dmpFilesize
1.2MB
-
memory/4872-137-0x0000000000000000-mapping.dmp