Analysis
-
max time kernel
60s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
07-11-2022 11:17
Static task
static1
Behavioral task
behavioral1
Sample
a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe
Resource
win10v2004-20220901-en
General
-
Target
a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe
-
Size
329KB
-
MD5
0ef82fe8d967a62f5b70ddf2d709ca90
-
SHA1
6ac5337b2c4fae4299c95e3173d16273e6faf11a
-
SHA256
a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0
-
SHA512
774a4aed635dfc4fbaf5c1b26baea1dbe5b59b16bdf561ee3c4d1675f6e16b45fd5c506262ffb052a00003c15ded93ff9b3e1f662dd977ab474835a21265ef04
-
SSDEEP
6144:xqpxvlACym6wGGWFGDwZyoJ3fzBeM6SpktqHQI6mVk8cL3/CzYjsHh:xqjvlA06wLBHAf9eMvHwmVkhL36zYwHh
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
Processes:
a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exedescription ioc process File created C:\Windows\SysWOW64\drivers\09479355.sys a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe -
Possible privilege escalation attempt 4 IoCs
Processes:
takeown.exeicacls.exetakeown.exeicacls.exepid process 1536 takeown.exe 1528 icacls.exe 1344 takeown.exe 940 icacls.exe -
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\09479355\ImagePath = "\\??\\C:\\Windows\\SysWOW64\\drivers\\09479355.sys" a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1008 cmd.exe -
Modifies file permissions 1 TTPs 4 IoCs
Processes:
takeown.exeicacls.exetakeown.exeicacls.exepid process 1536 takeown.exe 1528 icacls.exe 1344 takeown.exe 940 icacls.exe -
Installs/modifies Browser Helper Object 2 TTPs 4 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
Processes:
a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exedescription ioc process Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF} a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E} a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3} a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe -
Maps connected drives based on registry 3 TTPs 3 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe Key value enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe -
Drops file in System32 directory 4 IoCs
Processes:
a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exedescription ioc process File opened for modification C:\Windows\SysWOW64\ws2tcpip.dll a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe File created C:\Windows\SysWOW64\wshtcpip.dll a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe File created C:\Windows\SysWOW64\midimap.dll a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe File created C:\Windows\SysWOW64\ws2tcpip.dll a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe -
Modifies registry class 4 IoCs
Processes:
a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\HOOK_ID\name = "a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe" a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\SYS_DLL a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\SYS_DLL\name = "rewfugws.dll" a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\HOOK_ID a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exepid process 1964 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe 1964 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe 1964 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe 1964 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe 1964 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe 1964 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe 1964 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe 1964 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe 1964 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe 1964 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe 1964 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe 1964 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe 1964 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe 1964 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe 1964 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe 1964 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe 1964 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe 1964 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe 1964 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe 1964 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe 1964 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe 1964 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe 1964 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe 1964 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe 1964 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe 1964 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe 1964 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe 1964 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe 1964 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe 1964 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe 1964 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe 1964 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe 1964 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe 1964 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe 1964 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe 1964 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe 1964 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe 1964 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe 1964 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe 1964 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe 1964 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe 1964 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe 1964 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe 1964 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe 1964 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe 1964 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe 1964 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe 1964 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe 1964 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe 1964 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe 1964 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe 1964 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe 1964 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe 1964 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe 1964 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe 1964 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe 1964 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe 1964 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe 1964 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe 1964 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe 1964 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe 1964 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe 1964 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe 1964 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe -
Suspicious behavior: LoadsDriver 2 IoCs
Processes:
a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exepid process 460 1964 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exetakeown.exetakeown.exedescription pid process Token: SeDebugPrivilege 1964 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe Token: SeTakeOwnershipPrivilege 1536 takeown.exe Token: SeTakeOwnershipPrivilege 1344 takeown.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.execmd.execmd.exedescription pid process target process PID 1964 wrote to memory of 1544 1964 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe cmd.exe PID 1964 wrote to memory of 1544 1964 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe cmd.exe PID 1964 wrote to memory of 1544 1964 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe cmd.exe PID 1964 wrote to memory of 1544 1964 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe cmd.exe PID 1544 wrote to memory of 1536 1544 cmd.exe takeown.exe PID 1544 wrote to memory of 1536 1544 cmd.exe takeown.exe PID 1544 wrote to memory of 1536 1544 cmd.exe takeown.exe PID 1544 wrote to memory of 1536 1544 cmd.exe takeown.exe PID 1544 wrote to memory of 1528 1544 cmd.exe icacls.exe PID 1544 wrote to memory of 1528 1544 cmd.exe icacls.exe PID 1544 wrote to memory of 1528 1544 cmd.exe icacls.exe PID 1544 wrote to memory of 1528 1544 cmd.exe icacls.exe PID 1964 wrote to memory of 432 1964 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe cmd.exe PID 1964 wrote to memory of 432 1964 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe cmd.exe PID 1964 wrote to memory of 432 1964 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe cmd.exe PID 1964 wrote to memory of 432 1964 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe cmd.exe PID 432 wrote to memory of 1344 432 cmd.exe takeown.exe PID 432 wrote to memory of 1344 432 cmd.exe takeown.exe PID 432 wrote to memory of 1344 432 cmd.exe takeown.exe PID 432 wrote to memory of 1344 432 cmd.exe takeown.exe PID 432 wrote to memory of 940 432 cmd.exe icacls.exe PID 432 wrote to memory of 940 432 cmd.exe icacls.exe PID 432 wrote to memory of 940 432 cmd.exe icacls.exe PID 432 wrote to memory of 940 432 cmd.exe icacls.exe PID 1964 wrote to memory of 1008 1964 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe cmd.exe PID 1964 wrote to memory of 1008 1964 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe cmd.exe PID 1964 wrote to memory of 1008 1964 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe cmd.exe PID 1964 wrote to memory of 1008 1964 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe"C:\Users\Admin\AppData\Local\Temp\a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe"1⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Installs/modifies Browser Helper Object
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /c takeown /f C:\Windows\SysWOW64\wshtcpip.dll && icacls C:\Windows\SysWOW64\wshtcpip.dll /grant administrators:F2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\SysWOW64\wshtcpip.dll3⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\icacls.exeicacls C:\Windows\SysWOW64\wshtcpip.dll /grant administrators:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.execmd.exe /c takeown /f C:\Windows\SysWOW64\midimap.dll && icacls C:\Windows\SysWOW64\midimap.dll /grant administrators:F2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\SysWOW64\midimap.dll3⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\icacls.exeicacls C:\Windows\SysWOW64\midimap.dll /grant administrators:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\ahnmove.bat2⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\ahnmove.batFilesize
181B
MD5436b57917ff009c9c375d8a009439824
SHA1131bfda4cc299ce06e355491bfbfe656885d8b1b
SHA256921219d3247c7a126e552c4a64f2b5b88df97d6fb74719898c3f3ca4993da9db
SHA512fde79a02d6903e98cb09d7ab1b66ab6768cbf96e161d20d4034942a6b32943a2e19356f752ba9324f2a3ea06d3735f3ccd002b4f4fca1e6e232daf6478ca41ec
-
memory/432-62-0x0000000000000000-mapping.dmp
-
memory/940-64-0x0000000000000000-mapping.dmp
-
memory/1008-65-0x0000000000000000-mapping.dmp
-
memory/1344-63-0x0000000000000000-mapping.dmp
-
memory/1528-61-0x0000000000000000-mapping.dmp
-
memory/1536-60-0x0000000000000000-mapping.dmp
-
memory/1544-59-0x0000000000000000-mapping.dmp
-
memory/1964-54-0x0000000076411000-0x0000000076413000-memory.dmpFilesize
8KB
-
memory/1964-57-0x0000000001000000-0x0000000001168000-memory.dmpFilesize
1.4MB
-
memory/1964-58-0x0000000000220000-0x0000000000240000-memory.dmpFilesize
128KB
-
memory/1964-56-0x0000000000220000-0x0000000000240000-memory.dmpFilesize
128KB
-
memory/1964-66-0x0000000001000000-0x0000000001168000-memory.dmpFilesize
1.4MB
-
memory/1964-55-0x0000000001000000-0x0000000001168000-memory.dmpFilesize
1.4MB