25538f92187a715a0b529d649baf4b2e32b50a6d43171d63c05135767f23eece

General

Target

25538f92187a715a0b529d649baf4b2e32b50a6d43171d63c05135767f23eece.exe
Size

328KB
MD5

0e07c9d7250a78436faaeeaa37d7c490
SHA1

2f5454baad432a8d3675e711e05482081343161d
SHA256

25538f92187a715a0b529d649baf4b2e32b50a6d43171d63c05135767f23eece
SHA512

7bd6e3b497cb900fb139d1c623d117b58b8939dca39d49a51aa79e2ccab37cd24f7f851df28e07eef8aa42adef026222a372c732506a4bd4d6357df6135f5442
SSDEEP

6144:hyWOeLm+tkxoGQvT+W4+HMc+MEGRQ6saHSMf3z0AzbLUG50Tpm+MmvbWdlL0d5aU:hCemx0vN3HKGi6sYjJLUGGtedud5tr7

Score

8^/10

adware discovery exploit persistence stealer

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

25538f92187a715a0b529d649baf4b2e32b50a6d43171d63c05135767f23eece.exe

description ioc process

File created C:\Windows\SysWOW64\drivers\284761f5.sys 25538f92187a715a0b529d649baf4b2e32b50a6d43171d63c05135767f23eece.exe
Possible privilege escalation attempt 4 IoCs
exploit

Processes:

takeown.exeicacls.exetakeown.exeicacls.exe

pid process

4288 takeown.exe
4480 icacls.exe
3816 takeown.exe
2012 icacls.exe

description	ioc	process
File created	C:\Windows\SysWOW64\drivers\284761f5.sys	25538f92187a715a0b529d649baf4b2e32b50a6d43171d63c05135767f23eece.exe

pid	process
4288	takeown.exe
4480	icacls.exe
3816	takeown.exe
2012	icacls.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

25538f92187a715a0b529d649baf4b2e32b50a6d43171d63c05135767f23eece.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\284761f5\ImagePath = "\\??\\C:\\Windows\\SysWOW64\\drivers\\284761f5.sys"	25538f92187a715a0b529d649baf4b2e32b50a6d43171d63c05135767f23eece.exe

Modifies file permissions 1 TTPs 4 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exetakeown.exeicacls.exetakeown.exe

pid process

4480 icacls.exe
3816 takeown.exe
2012 icacls.exe
4288 takeown.exe

pid	process
4480	icacls.exe
3816	takeown.exe
2012	icacls.exe
4288	takeown.exe

Installs/modifies Browser Helper Object 2 TTPs 3 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

Processes:

25538f92187a715a0b529d649baf4b2e32b50a6d43171d63c05135767f23eece.exe

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}	25538f92187a715a0b529d649baf4b2e32b50a6d43171d63c05135767f23eece.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}	25538f92187a715a0b529d649baf4b2e32b50a6d43171d63c05135767f23eece.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	25538f92187a715a0b529d649baf4b2e32b50a6d43171d63c05135767f23eece.exe

Maps connected drives based on registry 3 TTPs 3 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

25538f92187a715a0b529d649baf4b2e32b50a6d43171d63c05135767f23eece.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	25538f92187a715a0b529d649baf4b2e32b50a6d43171d63c05135767f23eece.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	25538f92187a715a0b529d649baf4b2e32b50a6d43171d63c05135767f23eece.exe
Key value enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	25538f92187a715a0b529d649baf4b2e32b50a6d43171d63c05135767f23eece.exe

Drops file in System32 directory 4 IoCs

Processes:

25538f92187a715a0b529d649baf4b2e32b50a6d43171d63c05135767f23eece.exe

description	ioc	process
File created	C:\Windows\SysWOW64\ws2tcpip.dll	25538f92187a715a0b529d649baf4b2e32b50a6d43171d63c05135767f23eece.exe
File opened for modification	C:\Windows\SysWOW64\ws2tcpip.dll	25538f92187a715a0b529d649baf4b2e32b50a6d43171d63c05135767f23eece.exe
File created	C:\Windows\SysWOW64\wshtcpip.dll	25538f92187a715a0b529d649baf4b2e32b50a6d43171d63c05135767f23eece.exe
File created	C:\Windows\SysWOW64\midimap.dll	25538f92187a715a0b529d649baf4b2e32b50a6d43171d63c05135767f23eece.exe

Modifies registry class 4 IoCs

Processes:

25538f92187a715a0b529d649baf4b2e32b50a6d43171d63c05135767f23eece.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\HOOK_ID	25538f92187a715a0b529d649baf4b2e32b50a6d43171d63c05135767f23eece.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\HOOK_ID\name = "25538f92187a715a0b529d649baf4b2e32b50a6d43171d63c05135767f23eece.exe"	25538f92187a715a0b529d649baf4b2e32b50a6d43171d63c05135767f23eece.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\SYS_DLL	25538f92187a715a0b529d649baf4b2e32b50a6d43171d63c05135767f23eece.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\SYS_DLL\name = "hYwD.dll"	25538f92187a715a0b529d649baf4b2e32b50a6d43171d63c05135767f23eece.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

25538f92187a715a0b529d649baf4b2e32b50a6d43171d63c05135767f23eece.exe

pid	process
2200	25538f92187a715a0b529d649baf4b2e32b50a6d43171d63c05135767f23eece.exe
2200	25538f92187a715a0b529d649baf4b2e32b50a6d43171d63c05135767f23eece.exe
2200	25538f92187a715a0b529d649baf4b2e32b50a6d43171d63c05135767f23eece.exe
2200	25538f92187a715a0b529d649baf4b2e32b50a6d43171d63c05135767f23eece.exe
2200	25538f92187a715a0b529d649baf4b2e32b50a6d43171d63c05135767f23eece.exe
2200	25538f92187a715a0b529d649baf4b2e32b50a6d43171d63c05135767f23eece.exe
2200	25538f92187a715a0b529d649baf4b2e32b50a6d43171d63c05135767f23eece.exe
2200	25538f92187a715a0b529d649baf4b2e32b50a6d43171d63c05135767f23eece.exe
2200	25538f92187a715a0b529d649baf4b2e32b50a6d43171d63c05135767f23eece.exe
2200	25538f92187a715a0b529d649baf4b2e32b50a6d43171d63c05135767f23eece.exe
2200	25538f92187a715a0b529d649baf4b2e32b50a6d43171d63c05135767f23eece.exe
2200	25538f92187a715a0b529d649baf4b2e32b50a6d43171d63c05135767f23eece.exe
2200	25538f92187a715a0b529d649baf4b2e32b50a6d43171d63c05135767f23eece.exe
2200	25538f92187a715a0b529d649baf4b2e32b50a6d43171d63c05135767f23eece.exe
2200	25538f92187a715a0b529d649baf4b2e32b50a6d43171d63c05135767f23eece.exe
2200	25538f92187a715a0b529d649baf4b2e32b50a6d43171d63c05135767f23eece.exe
2200	25538f92187a715a0b529d649baf4b2e32b50a6d43171d63c05135767f23eece.exe
2200	25538f92187a715a0b529d649baf4b2e32b50a6d43171d63c05135767f23eece.exe
2200	25538f92187a715a0b529d649baf4b2e32b50a6d43171d63c05135767f23eece.exe
2200	25538f92187a715a0b529d649baf4b2e32b50a6d43171d63c05135767f23eece.exe
2200	25538f92187a715a0b529d649baf4b2e32b50a6d43171d63c05135767f23eece.exe
2200	25538f92187a715a0b529d649baf4b2e32b50a6d43171d63c05135767f23eece.exe
2200	25538f92187a715a0b529d649baf4b2e32b50a6d43171d63c05135767f23eece.exe
2200	25538f92187a715a0b529d649baf4b2e32b50a6d43171d63c05135767f23eece.exe
2200	25538f92187a715a0b529d649baf4b2e32b50a6d43171d63c05135767f23eece.exe
2200	25538f92187a715a0b529d649baf4b2e32b50a6d43171d63c05135767f23eece.exe
2200	25538f92187a715a0b529d649baf4b2e32b50a6d43171d63c05135767f23eece.exe
2200	25538f92187a715a0b529d649baf4b2e32b50a6d43171d63c05135767f23eece.exe
2200	25538f92187a715a0b529d649baf4b2e32b50a6d43171d63c05135767f23eece.exe
2200	25538f92187a715a0b529d649baf4b2e32b50a6d43171d63c05135767f23eece.exe
2200	25538f92187a715a0b529d649baf4b2e32b50a6d43171d63c05135767f23eece.exe
2200	25538f92187a715a0b529d649baf4b2e32b50a6d43171d63c05135767f23eece.exe
2200	25538f92187a715a0b529d649baf4b2e32b50a6d43171d63c05135767f23eece.exe
2200	25538f92187a715a0b529d649baf4b2e32b50a6d43171d63c05135767f23eece.exe
2200	25538f92187a715a0b529d649baf4b2e32b50a6d43171d63c05135767f23eece.exe
2200	25538f92187a715a0b529d649baf4b2e32b50a6d43171d63c05135767f23eece.exe
2200	25538f92187a715a0b529d649baf4b2e32b50a6d43171d63c05135767f23eece.exe
2200	25538f92187a715a0b529d649baf4b2e32b50a6d43171d63c05135767f23eece.exe
2200	25538f92187a715a0b529d649baf4b2e32b50a6d43171d63c05135767f23eece.exe
2200	25538f92187a715a0b529d649baf4b2e32b50a6d43171d63c05135767f23eece.exe
2200	25538f92187a715a0b529d649baf4b2e32b50a6d43171d63c05135767f23eece.exe
2200	25538f92187a715a0b529d649baf4b2e32b50a6d43171d63c05135767f23eece.exe
2200	25538f92187a715a0b529d649baf4b2e32b50a6d43171d63c05135767f23eece.exe
2200	25538f92187a715a0b529d649baf4b2e32b50a6d43171d63c05135767f23eece.exe
2200	25538f92187a715a0b529d649baf4b2e32b50a6d43171d63c05135767f23eece.exe
2200	25538f92187a715a0b529d649baf4b2e32b50a6d43171d63c05135767f23eece.exe
2200	25538f92187a715a0b529d649baf4b2e32b50a6d43171d63c05135767f23eece.exe
2200	25538f92187a715a0b529d649baf4b2e32b50a6d43171d63c05135767f23eece.exe
2200	25538f92187a715a0b529d649baf4b2e32b50a6d43171d63c05135767f23eece.exe
2200	25538f92187a715a0b529d649baf4b2e32b50a6d43171d63c05135767f23eece.exe
2200	25538f92187a715a0b529d649baf4b2e32b50a6d43171d63c05135767f23eece.exe
2200	25538f92187a715a0b529d649baf4b2e32b50a6d43171d63c05135767f23eece.exe
2200	25538f92187a715a0b529d649baf4b2e32b50a6d43171d63c05135767f23eece.exe
2200	25538f92187a715a0b529d649baf4b2e32b50a6d43171d63c05135767f23eece.exe
2200	25538f92187a715a0b529d649baf4b2e32b50a6d43171d63c05135767f23eece.exe
2200	25538f92187a715a0b529d649baf4b2e32b50a6d43171d63c05135767f23eece.exe
2200	25538f92187a715a0b529d649baf4b2e32b50a6d43171d63c05135767f23eece.exe
2200	25538f92187a715a0b529d649baf4b2e32b50a6d43171d63c05135767f23eece.exe
2200	25538f92187a715a0b529d649baf4b2e32b50a6d43171d63c05135767f23eece.exe
2200	25538f92187a715a0b529d649baf4b2e32b50a6d43171d63c05135767f23eece.exe
2200	25538f92187a715a0b529d649baf4b2e32b50a6d43171d63c05135767f23eece.exe
2200	25538f92187a715a0b529d649baf4b2e32b50a6d43171d63c05135767f23eece.exe
2200	25538f92187a715a0b529d649baf4b2e32b50a6d43171d63c05135767f23eece.exe
2200	25538f92187a715a0b529d649baf4b2e32b50a6d43171d63c05135767f23eece.exe

Suspicious behavior: LoadsDriver 2 IoCs

Processes:

25538f92187a715a0b529d649baf4b2e32b50a6d43171d63c05135767f23eece.exe

pid process

632
2200 25538f92187a715a0b529d649baf4b2e32b50a6d43171d63c05135767f23eece.exe

pid	process
632
2200	25538f92187a715a0b529d649baf4b2e32b50a6d43171d63c05135767f23eece.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

25538f92187a715a0b529d649baf4b2e32b50a6d43171d63c05135767f23eece.exetakeown.exetakeown.exe

description	pid	process
Token: SeDebugPrivilege	2200	25538f92187a715a0b529d649baf4b2e32b50a6d43171d63c05135767f23eece.exe
Token: SeTakeOwnershipPrivilege	3816	takeown.exe
Token: SeTakeOwnershipPrivilege	4288	takeown.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

25538f92187a715a0b529d649baf4b2e32b50a6d43171d63c05135767f23eece.execmd.execmd.exe

description	pid	process	target process
PID 2200 wrote to memory of 3656	2200	25538f92187a715a0b529d649baf4b2e32b50a6d43171d63c05135767f23eece.exe	cmd.exe
PID 2200 wrote to memory of 3656	2200	25538f92187a715a0b529d649baf4b2e32b50a6d43171d63c05135767f23eece.exe	cmd.exe
PID 2200 wrote to memory of 3656	2200	25538f92187a715a0b529d649baf4b2e32b50a6d43171d63c05135767f23eece.exe	cmd.exe
PID 3656 wrote to memory of 3816	3656	cmd.exe	takeown.exe
PID 3656 wrote to memory of 3816	3656	cmd.exe	takeown.exe
PID 3656 wrote to memory of 3816	3656	cmd.exe	takeown.exe
PID 3656 wrote to memory of 2012	3656	cmd.exe	icacls.exe
PID 3656 wrote to memory of 2012	3656	cmd.exe	icacls.exe
PID 3656 wrote to memory of 2012	3656	cmd.exe	icacls.exe
PID 2200 wrote to memory of 4728	2200	25538f92187a715a0b529d649baf4b2e32b50a6d43171d63c05135767f23eece.exe	cmd.exe
PID 2200 wrote to memory of 4728	2200	25538f92187a715a0b529d649baf4b2e32b50a6d43171d63c05135767f23eece.exe	cmd.exe
PID 2200 wrote to memory of 4728	2200	25538f92187a715a0b529d649baf4b2e32b50a6d43171d63c05135767f23eece.exe	cmd.exe
PID 4728 wrote to memory of 4288	4728	cmd.exe	takeown.exe
PID 4728 wrote to memory of 4288	4728	cmd.exe	takeown.exe
PID 4728 wrote to memory of 4288	4728	cmd.exe	takeown.exe
PID 4728 wrote to memory of 4480	4728	cmd.exe	icacls.exe
PID 4728 wrote to memory of 4480	4728	cmd.exe	icacls.exe
PID 4728 wrote to memory of 4480	4728	cmd.exe	icacls.exe
PID 2200 wrote to memory of 4936	2200	25538f92187a715a0b529d649baf4b2e32b50a6d43171d63c05135767f23eece.exe	cmd.exe
PID 2200 wrote to memory of 4936	2200	25538f92187a715a0b529d649baf4b2e32b50a6d43171d63c05135767f23eece.exe	cmd.exe
PID 2200 wrote to memory of 4936	2200	25538f92187a715a0b529d649baf4b2e32b50a6d43171d63c05135767f23eece.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\25538f92187a715a0b529d649baf4b2e32b50a6d43171d63c05135767f23eece.exe
"C:\Users\Admin\AppData\Local\Temp\25538f92187a715a0b529d649baf4b2e32b50a6d43171d63c05135767f23eece.exe"
1⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Installs/modifies Browser Helper Object
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2200

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c takeown /f C:\Windows\SysWOW64\wshtcpip.dll && icacls C:\Windows\SysWOW64\wshtcpip.dll /grant administrators:F
2⤵
- Suspicious use of WriteProcessMemory
PID:3656

C:\Windows\SysWOW64\takeown.exe
takeown /f C:\Windows\SysWOW64\wshtcpip.dll
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:3816

C:\Windows\SysWOW64\icacls.exe
icacls C:\Windows\SysWOW64\wshtcpip.dll /grant administrators:F
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:2012

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c takeown /f C:\Windows\SysWOW64\midimap.dll && icacls C:\Windows\SysWOW64\midimap.dll /grant administrators:F
2⤵
- Suspicious use of WriteProcessMemory
PID:4728

C:\Windows\SysWOW64\takeown.exe
takeown /f C:\Windows\SysWOW64\midimap.dll
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:4288

C:\Windows\SysWOW64\icacls.exe
icacls C:\Windows\SysWOW64\midimap.dll /grant administrators:F
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:4480

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ahnmove.bat
2⤵
PID:4936

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Browser Extensions

1

T1176

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ahnmove.bat
Filesize
181B

MD5
6033a893343f9947570212d958cd9ae9

SHA1
3c8668511e54eed8d9d9e6c7fb35ea97e0f2bd39

SHA256
9da0da3647c60dad1ed774537fa1ba51fb1a51d2bb634e3f35e237285f573913

SHA512
3132e77877549c3d998bdc865999a7c901ee10ec0e879f44099586645d1aae9a64c8574e2fa335a6bd021d9cec3b41118d1dd62e697b20388dc3bac1a3047644

Download Submit
memory/2012-138-0x0000000000000000-mapping.dmp

Download
memory/2200-135-0x0000000000690000-0x00000000006B0000-memory.dmp

Filesize
128KB

Download
memory/2200-132-0x0000000001000000-0x000000000116A000-memory.dmp

Filesize
1.4MB

Download
memory/2200-134-0x0000000001000000-0x000000000116A000-memory.dmp

Filesize
1.4MB

Download
memory/2200-143-0x0000000001000000-0x000000000116A000-memory.dmp

Filesize
1.4MB

Download
memory/2200-133-0x0000000000690000-0x00000000006B0000-memory.dmp

Filesize
128KB

Download
memory/3656-136-0x0000000000000000-mapping.dmp

Download
memory/3816-137-0x0000000000000000-mapping.dmp

Download
memory/4288-140-0x0000000000000000-mapping.dmp

Download
memory/4480-141-0x0000000000000000-mapping.dmp

Download
memory/4728-139-0x0000000000000000-mapping.dmp

Download
memory/4936-142-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads