Analysis
-
max time kernel
70s -
max time network
133s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
07-11-2022 11:17
Static task
static1
Behavioral task
behavioral1
Sample
a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe
Resource
win10v2004-20220901-en
General
-
Target
a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe
-
Size
329KB
-
MD5
0ef82fe8d967a62f5b70ddf2d709ca90
-
SHA1
6ac5337b2c4fae4299c95e3173d16273e6faf11a
-
SHA256
a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0
-
SHA512
774a4aed635dfc4fbaf5c1b26baea1dbe5b59b16bdf561ee3c4d1675f6e16b45fd5c506262ffb052a00003c15ded93ff9b3e1f662dd977ab474835a21265ef04
-
SSDEEP
6144:xqpxvlACym6wGGWFGDwZyoJ3fzBeM6SpktqHQI6mVk8cL3/CzYjsHh:xqjvlA06wLBHAf9eMvHwmVkhL36zYwHh
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
Processes:
a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exedescription ioc process File created C:\Windows\SysWOW64\drivers\7f9b915d.sys a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe -
Possible privilege escalation attempt 4 IoCs
Processes:
takeown.exeicacls.exetakeown.exeicacls.exepid process 3452 takeown.exe 3916 icacls.exe 3632 takeown.exe 2704 icacls.exe -
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\7f9b915d\ImagePath = "\\??\\C:\\Windows\\SysWOW64\\drivers\\7f9b915d.sys" a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe -
Modifies file permissions 1 TTPs 4 IoCs
Processes:
takeown.exeicacls.exetakeown.exeicacls.exepid process 3632 takeown.exe 2704 icacls.exe 3452 takeown.exe 3916 icacls.exe -
Installs/modifies Browser Helper Object 2 TTPs 3 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
Processes:
a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exedescription ioc process Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA} a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C} a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe -
Maps connected drives based on registry 3 TTPs 3 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe Key value enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe -
Drops file in System32 directory 4 IoCs
Processes:
a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exedescription ioc process File created C:\Windows\SysWOW64\ws2tcpip.dll a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe File opened for modification C:\Windows\SysWOW64\ws2tcpip.dll a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe File created C:\Windows\SysWOW64\wshtcpip.dll a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe File created C:\Windows\SysWOW64\midimap.dll a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe -
Modifies registry class 4 IoCs
Processes:
a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\HOOK_ID a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\HOOK_ID\name = "a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe" a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\SYS_DLL a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\SYS_DLL\name = "bCwJiHU7Ar.dll" a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exepid process 1972 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe 1972 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe 1972 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe 1972 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe 1972 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe 1972 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe 1972 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe 1972 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe 1972 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe 1972 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe 1972 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe 1972 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe 1972 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe 1972 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe 1972 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe 1972 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe 1972 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe 1972 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe 1972 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe 1972 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe 1972 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe 1972 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe 1972 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe 1972 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe 1972 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe 1972 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe 1972 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe 1972 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe 1972 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe 1972 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe 1972 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe 1972 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe 1972 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe 1972 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe 1972 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe 1972 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe 1972 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe 1972 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe 1972 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe 1972 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe 1972 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe 1972 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe 1972 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe 1972 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe 1972 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe 1972 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe 1972 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe 1972 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe 1972 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe 1972 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe 1972 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe 1972 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe 1972 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe 1972 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe 1972 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe 1972 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe 1972 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe 1972 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe 1972 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe 1972 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe 1972 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe 1972 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe 1972 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe 1972 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe -
Suspicious behavior: LoadsDriver 2 IoCs
Processes:
a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exepid process 660 1972 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exetakeown.exetakeown.exedescription pid process Token: SeDebugPrivilege 1972 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe Token: SeTakeOwnershipPrivilege 3632 takeown.exe Token: SeTakeOwnershipPrivilege 3452 takeown.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.execmd.execmd.exedescription pid process target process PID 1972 wrote to memory of 3380 1972 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe cmd.exe PID 1972 wrote to memory of 3380 1972 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe cmd.exe PID 1972 wrote to memory of 3380 1972 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe cmd.exe PID 3380 wrote to memory of 3632 3380 cmd.exe takeown.exe PID 3380 wrote to memory of 3632 3380 cmd.exe takeown.exe PID 3380 wrote to memory of 3632 3380 cmd.exe takeown.exe PID 3380 wrote to memory of 2704 3380 cmd.exe icacls.exe PID 3380 wrote to memory of 2704 3380 cmd.exe icacls.exe PID 3380 wrote to memory of 2704 3380 cmd.exe icacls.exe PID 1972 wrote to memory of 832 1972 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe cmd.exe PID 1972 wrote to memory of 832 1972 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe cmd.exe PID 1972 wrote to memory of 832 1972 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe cmd.exe PID 832 wrote to memory of 3452 832 cmd.exe takeown.exe PID 832 wrote to memory of 3452 832 cmd.exe takeown.exe PID 832 wrote to memory of 3452 832 cmd.exe takeown.exe PID 832 wrote to memory of 3916 832 cmd.exe icacls.exe PID 832 wrote to memory of 3916 832 cmd.exe icacls.exe PID 832 wrote to memory of 3916 832 cmd.exe icacls.exe PID 1972 wrote to memory of 3720 1972 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe cmd.exe PID 1972 wrote to memory of 3720 1972 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe cmd.exe PID 1972 wrote to memory of 3720 1972 a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe"C:\Users\Admin\AppData\Local\Temp\a59f30575426a07fb1f5c019f36974d3079db55f5099e25328277d94df7acab0.exe"1⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Installs/modifies Browser Helper Object
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /c takeown /f C:\Windows\SysWOW64\wshtcpip.dll && icacls C:\Windows\SysWOW64\wshtcpip.dll /grant administrators:F2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\SysWOW64\wshtcpip.dll3⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\icacls.exeicacls C:\Windows\SysWOW64\wshtcpip.dll /grant administrators:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.execmd.exe /c takeown /f C:\Windows\SysWOW64\midimap.dll && icacls C:\Windows\SysWOW64\midimap.dll /grant administrators:F2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\SysWOW64\midimap.dll3⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\icacls.exeicacls C:\Windows\SysWOW64\midimap.dll /grant administrators:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ahnmove.bat2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\ahnmove.batFilesize
181B
MD5436b57917ff009c9c375d8a009439824
SHA1131bfda4cc299ce06e355491bfbfe656885d8b1b
SHA256921219d3247c7a126e552c4a64f2b5b88df97d6fb74719898c3f3ca4993da9db
SHA512fde79a02d6903e98cb09d7ab1b66ab6768cbf96e161d20d4034942a6b32943a2e19356f752ba9324f2a3ea06d3735f3ccd002b4f4fca1e6e232daf6478ca41ec
-
memory/832-139-0x0000000000000000-mapping.dmp
-
memory/1972-133-0x0000000000590000-0x00000000005B0000-memory.dmpFilesize
128KB
-
memory/1972-134-0x0000000001000000-0x0000000001168000-memory.dmpFilesize
1.4MB
-
memory/1972-135-0x0000000000590000-0x00000000005B0000-memory.dmpFilesize
128KB
-
memory/1972-143-0x0000000001000000-0x0000000001168000-memory.dmpFilesize
1.4MB
-
memory/1972-132-0x0000000001000000-0x0000000001168000-memory.dmpFilesize
1.4MB
-
memory/2704-138-0x0000000000000000-mapping.dmp
-
memory/3380-136-0x0000000000000000-mapping.dmp
-
memory/3452-140-0x0000000000000000-mapping.dmp
-
memory/3632-137-0x0000000000000000-mapping.dmp
-
memory/3720-142-0x0000000000000000-mapping.dmp
-
memory/3916-141-0x0000000000000000-mapping.dmp