b369791eee111afa5b07cec049e3afd2d295fbc61ff07fbe407d99caabb6c305

General

Target

b369791eee111afa5b07cec049e3afd2d295fbc61ff07fbe407d99caabb6c305.exe
Size

328KB
MD5

0d0030b0598af711e214918c0fa326d0
SHA1

1d61899abd6307c7b55649e650665bde1a3a4929
SHA256

b369791eee111afa5b07cec049e3afd2d295fbc61ff07fbe407d99caabb6c305
SHA512

15dccc2f9e4ec066c089acc575d5a4d8b947a7c1d0c359a308c877747503f6f97691886cf5f32c6c4bb5bcd92d6be3a8dd3757ce1adc25502e8d63b75f5eaecd
SSDEEP

6144:DyWOeLm+tkxoGQvT+W4+HMc+MEGRQ6saHSMf3z0AzbLUG50Tpm+MmvbWdlL0d5aU:DCemx0vN3HKGi6sYjJLUGGtedud5tr7

Score

8^/10

adware discovery exploit persistence stealer

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

b369791eee111afa5b07cec049e3afd2d295fbc61ff07fbe407d99caabb6c305.exe

description ioc process

File created C:\Windows\SysWOW64\drivers\13045441.sys b369791eee111afa5b07cec049e3afd2d295fbc61ff07fbe407d99caabb6c305.exe
Possible privilege escalation attempt 4 IoCs
exploit

Processes:

takeown.exeicacls.exetakeown.exeicacls.exe

pid process

1776 takeown.exe
772 icacls.exe
588 takeown.exe
768 icacls.exe

description	ioc	process
File created	C:\Windows\SysWOW64\drivers\13045441.sys	b369791eee111afa5b07cec049e3afd2d295fbc61ff07fbe407d99caabb6c305.exe

pid	process
1776	takeown.exe
772	icacls.exe
588	takeown.exe
768	icacls.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

b369791eee111afa5b07cec049e3afd2d295fbc61ff07fbe407d99caabb6c305.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\13045441\ImagePath = "\\??\\C:\\Windows\\SysWOW64\\drivers\\13045441.sys"	b369791eee111afa5b07cec049e3afd2d295fbc61ff07fbe407d99caabb6c305.exe

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1412 cmd.exe
Modifies file permissions 1 TTPs 4 IoCs
discovery

File Permissions Modification
T1222

Processes:

icacls.exetakeown.exeicacls.exetakeown.exe

pid process

768 icacls.exe
1776 takeown.exe
772 icacls.exe
588 takeown.exe

pid	process
1412	cmd.exe

pid	process
768	icacls.exe
1776	takeown.exe
772	icacls.exe
588	takeown.exe

Installs/modifies Browser Helper Object 2 TTPs 4 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

Processes:

b369791eee111afa5b07cec049e3afd2d295fbc61ff07fbe407d99caabb6c305.exe

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}	b369791eee111afa5b07cec049e3afd2d295fbc61ff07fbe407d99caabb6c305.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects	b369791eee111afa5b07cec049e3afd2d295fbc61ff07fbe407d99caabb6c305.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}	b369791eee111afa5b07cec049e3afd2d295fbc61ff07fbe407d99caabb6c305.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}	b369791eee111afa5b07cec049e3afd2d295fbc61ff07fbe407d99caabb6c305.exe

Maps connected drives based on registry 3 TTPs 3 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

b369791eee111afa5b07cec049e3afd2d295fbc61ff07fbe407d99caabb6c305.exe

description	ioc	process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	b369791eee111afa5b07cec049e3afd2d295fbc61ff07fbe407d99caabb6c305.exe
Key value enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	b369791eee111afa5b07cec049e3afd2d295fbc61ff07fbe407d99caabb6c305.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	b369791eee111afa5b07cec049e3afd2d295fbc61ff07fbe407d99caabb6c305.exe

Drops file in System32 directory 4 IoCs

Processes:

b369791eee111afa5b07cec049e3afd2d295fbc61ff07fbe407d99caabb6c305.exe

description	ioc	process
File created	C:\Windows\SysWOW64\ws2tcpip.dll	b369791eee111afa5b07cec049e3afd2d295fbc61ff07fbe407d99caabb6c305.exe
File opened for modification	C:\Windows\SysWOW64\ws2tcpip.dll	b369791eee111afa5b07cec049e3afd2d295fbc61ff07fbe407d99caabb6c305.exe
File created	C:\Windows\SysWOW64\wshtcpip.dll	b369791eee111afa5b07cec049e3afd2d295fbc61ff07fbe407d99caabb6c305.exe
File created	C:\Windows\SysWOW64\midimap.dll	b369791eee111afa5b07cec049e3afd2d295fbc61ff07fbe407d99caabb6c305.exe

Modifies registry class 4 IoCs

Processes:

b369791eee111afa5b07cec049e3afd2d295fbc61ff07fbe407d99caabb6c305.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\HOOK_ID\name = "b369791eee111afa5b07cec049e3afd2d295fbc61ff07fbe407d99caabb6c305.exe"	b369791eee111afa5b07cec049e3afd2d295fbc61ff07fbe407d99caabb6c305.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\SYS_DLL	b369791eee111afa5b07cec049e3afd2d295fbc61ff07fbe407d99caabb6c305.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\SYS_DLL\name = "yHq5wyrf.dll"	b369791eee111afa5b07cec049e3afd2d295fbc61ff07fbe407d99caabb6c305.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\HOOK_ID	b369791eee111afa5b07cec049e3afd2d295fbc61ff07fbe407d99caabb6c305.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

b369791eee111afa5b07cec049e3afd2d295fbc61ff07fbe407d99caabb6c305.exe

pid	process
912	b369791eee111afa5b07cec049e3afd2d295fbc61ff07fbe407d99caabb6c305.exe
912	b369791eee111afa5b07cec049e3afd2d295fbc61ff07fbe407d99caabb6c305.exe
912	b369791eee111afa5b07cec049e3afd2d295fbc61ff07fbe407d99caabb6c305.exe
912	b369791eee111afa5b07cec049e3afd2d295fbc61ff07fbe407d99caabb6c305.exe
912	b369791eee111afa5b07cec049e3afd2d295fbc61ff07fbe407d99caabb6c305.exe
912	b369791eee111afa5b07cec049e3afd2d295fbc61ff07fbe407d99caabb6c305.exe
912	b369791eee111afa5b07cec049e3afd2d295fbc61ff07fbe407d99caabb6c305.exe
912	b369791eee111afa5b07cec049e3afd2d295fbc61ff07fbe407d99caabb6c305.exe
912	b369791eee111afa5b07cec049e3afd2d295fbc61ff07fbe407d99caabb6c305.exe
912	b369791eee111afa5b07cec049e3afd2d295fbc61ff07fbe407d99caabb6c305.exe
912	b369791eee111afa5b07cec049e3afd2d295fbc61ff07fbe407d99caabb6c305.exe
912	b369791eee111afa5b07cec049e3afd2d295fbc61ff07fbe407d99caabb6c305.exe
912	b369791eee111afa5b07cec049e3afd2d295fbc61ff07fbe407d99caabb6c305.exe
912	b369791eee111afa5b07cec049e3afd2d295fbc61ff07fbe407d99caabb6c305.exe
912	b369791eee111afa5b07cec049e3afd2d295fbc61ff07fbe407d99caabb6c305.exe
912	b369791eee111afa5b07cec049e3afd2d295fbc61ff07fbe407d99caabb6c305.exe
912	b369791eee111afa5b07cec049e3afd2d295fbc61ff07fbe407d99caabb6c305.exe
912	b369791eee111afa5b07cec049e3afd2d295fbc61ff07fbe407d99caabb6c305.exe
912	b369791eee111afa5b07cec049e3afd2d295fbc61ff07fbe407d99caabb6c305.exe
912	b369791eee111afa5b07cec049e3afd2d295fbc61ff07fbe407d99caabb6c305.exe
912	b369791eee111afa5b07cec049e3afd2d295fbc61ff07fbe407d99caabb6c305.exe
912	b369791eee111afa5b07cec049e3afd2d295fbc61ff07fbe407d99caabb6c305.exe
912	b369791eee111afa5b07cec049e3afd2d295fbc61ff07fbe407d99caabb6c305.exe
912	b369791eee111afa5b07cec049e3afd2d295fbc61ff07fbe407d99caabb6c305.exe
912	b369791eee111afa5b07cec049e3afd2d295fbc61ff07fbe407d99caabb6c305.exe
912	b369791eee111afa5b07cec049e3afd2d295fbc61ff07fbe407d99caabb6c305.exe
912	b369791eee111afa5b07cec049e3afd2d295fbc61ff07fbe407d99caabb6c305.exe
912	b369791eee111afa5b07cec049e3afd2d295fbc61ff07fbe407d99caabb6c305.exe
912	b369791eee111afa5b07cec049e3afd2d295fbc61ff07fbe407d99caabb6c305.exe
912	b369791eee111afa5b07cec049e3afd2d295fbc61ff07fbe407d99caabb6c305.exe
912	b369791eee111afa5b07cec049e3afd2d295fbc61ff07fbe407d99caabb6c305.exe
912	b369791eee111afa5b07cec049e3afd2d295fbc61ff07fbe407d99caabb6c305.exe
912	b369791eee111afa5b07cec049e3afd2d295fbc61ff07fbe407d99caabb6c305.exe
912	b369791eee111afa5b07cec049e3afd2d295fbc61ff07fbe407d99caabb6c305.exe
912	b369791eee111afa5b07cec049e3afd2d295fbc61ff07fbe407d99caabb6c305.exe
912	b369791eee111afa5b07cec049e3afd2d295fbc61ff07fbe407d99caabb6c305.exe
912	b369791eee111afa5b07cec049e3afd2d295fbc61ff07fbe407d99caabb6c305.exe
912	b369791eee111afa5b07cec049e3afd2d295fbc61ff07fbe407d99caabb6c305.exe
912	b369791eee111afa5b07cec049e3afd2d295fbc61ff07fbe407d99caabb6c305.exe
912	b369791eee111afa5b07cec049e3afd2d295fbc61ff07fbe407d99caabb6c305.exe
912	b369791eee111afa5b07cec049e3afd2d295fbc61ff07fbe407d99caabb6c305.exe
912	b369791eee111afa5b07cec049e3afd2d295fbc61ff07fbe407d99caabb6c305.exe
912	b369791eee111afa5b07cec049e3afd2d295fbc61ff07fbe407d99caabb6c305.exe
912	b369791eee111afa5b07cec049e3afd2d295fbc61ff07fbe407d99caabb6c305.exe
912	b369791eee111afa5b07cec049e3afd2d295fbc61ff07fbe407d99caabb6c305.exe
912	b369791eee111afa5b07cec049e3afd2d295fbc61ff07fbe407d99caabb6c305.exe
912	b369791eee111afa5b07cec049e3afd2d295fbc61ff07fbe407d99caabb6c305.exe
912	b369791eee111afa5b07cec049e3afd2d295fbc61ff07fbe407d99caabb6c305.exe
912	b369791eee111afa5b07cec049e3afd2d295fbc61ff07fbe407d99caabb6c305.exe
912	b369791eee111afa5b07cec049e3afd2d295fbc61ff07fbe407d99caabb6c305.exe
912	b369791eee111afa5b07cec049e3afd2d295fbc61ff07fbe407d99caabb6c305.exe
912	b369791eee111afa5b07cec049e3afd2d295fbc61ff07fbe407d99caabb6c305.exe
912	b369791eee111afa5b07cec049e3afd2d295fbc61ff07fbe407d99caabb6c305.exe
912	b369791eee111afa5b07cec049e3afd2d295fbc61ff07fbe407d99caabb6c305.exe
912	b369791eee111afa5b07cec049e3afd2d295fbc61ff07fbe407d99caabb6c305.exe
912	b369791eee111afa5b07cec049e3afd2d295fbc61ff07fbe407d99caabb6c305.exe
912	b369791eee111afa5b07cec049e3afd2d295fbc61ff07fbe407d99caabb6c305.exe
912	b369791eee111afa5b07cec049e3afd2d295fbc61ff07fbe407d99caabb6c305.exe
912	b369791eee111afa5b07cec049e3afd2d295fbc61ff07fbe407d99caabb6c305.exe
912	b369791eee111afa5b07cec049e3afd2d295fbc61ff07fbe407d99caabb6c305.exe
912	b369791eee111afa5b07cec049e3afd2d295fbc61ff07fbe407d99caabb6c305.exe
912	b369791eee111afa5b07cec049e3afd2d295fbc61ff07fbe407d99caabb6c305.exe
912	b369791eee111afa5b07cec049e3afd2d295fbc61ff07fbe407d99caabb6c305.exe
912	b369791eee111afa5b07cec049e3afd2d295fbc61ff07fbe407d99caabb6c305.exe

Suspicious behavior: LoadsDriver 2 IoCs

Processes:

b369791eee111afa5b07cec049e3afd2d295fbc61ff07fbe407d99caabb6c305.exe

pid process

464
912 b369791eee111afa5b07cec049e3afd2d295fbc61ff07fbe407d99caabb6c305.exe

pid	process
464
912	b369791eee111afa5b07cec049e3afd2d295fbc61ff07fbe407d99caabb6c305.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

b369791eee111afa5b07cec049e3afd2d295fbc61ff07fbe407d99caabb6c305.exetakeown.exetakeown.exe

description	pid	process
Token: SeDebugPrivilege	912	b369791eee111afa5b07cec049e3afd2d295fbc61ff07fbe407d99caabb6c305.exe
Token: SeTakeOwnershipPrivilege	588	takeown.exe
Token: SeTakeOwnershipPrivilege	1776	takeown.exe

Suspicious use of WriteProcessMemory 28 IoCs

Processes:

b369791eee111afa5b07cec049e3afd2d295fbc61ff07fbe407d99caabb6c305.execmd.execmd.exe

description	pid	process	target process
PID 912 wrote to memory of 436	912	b369791eee111afa5b07cec049e3afd2d295fbc61ff07fbe407d99caabb6c305.exe	cmd.exe
PID 912 wrote to memory of 436	912	b369791eee111afa5b07cec049e3afd2d295fbc61ff07fbe407d99caabb6c305.exe	cmd.exe
PID 912 wrote to memory of 436	912	b369791eee111afa5b07cec049e3afd2d295fbc61ff07fbe407d99caabb6c305.exe	cmd.exe
PID 912 wrote to memory of 436	912	b369791eee111afa5b07cec049e3afd2d295fbc61ff07fbe407d99caabb6c305.exe	cmd.exe
PID 436 wrote to memory of 588	436	cmd.exe	takeown.exe
PID 436 wrote to memory of 588	436	cmd.exe	takeown.exe
PID 436 wrote to memory of 588	436	cmd.exe	takeown.exe
PID 436 wrote to memory of 588	436	cmd.exe	takeown.exe
PID 436 wrote to memory of 768	436	cmd.exe	icacls.exe
PID 436 wrote to memory of 768	436	cmd.exe	icacls.exe
PID 436 wrote to memory of 768	436	cmd.exe	icacls.exe
PID 436 wrote to memory of 768	436	cmd.exe	icacls.exe
PID 912 wrote to memory of 828	912	b369791eee111afa5b07cec049e3afd2d295fbc61ff07fbe407d99caabb6c305.exe	cmd.exe
PID 912 wrote to memory of 828	912	b369791eee111afa5b07cec049e3afd2d295fbc61ff07fbe407d99caabb6c305.exe	cmd.exe
PID 912 wrote to memory of 828	912	b369791eee111afa5b07cec049e3afd2d295fbc61ff07fbe407d99caabb6c305.exe	cmd.exe
PID 912 wrote to memory of 828	912	b369791eee111afa5b07cec049e3afd2d295fbc61ff07fbe407d99caabb6c305.exe	cmd.exe
PID 828 wrote to memory of 1776	828	cmd.exe	takeown.exe
PID 828 wrote to memory of 1776	828	cmd.exe	takeown.exe
PID 828 wrote to memory of 1776	828	cmd.exe	takeown.exe
PID 828 wrote to memory of 1776	828	cmd.exe	takeown.exe
PID 828 wrote to memory of 772	828	cmd.exe	icacls.exe
PID 828 wrote to memory of 772	828	cmd.exe	icacls.exe
PID 828 wrote to memory of 772	828	cmd.exe	icacls.exe
PID 828 wrote to memory of 772	828	cmd.exe	icacls.exe
PID 912 wrote to memory of 1412	912	b369791eee111afa5b07cec049e3afd2d295fbc61ff07fbe407d99caabb6c305.exe	cmd.exe
PID 912 wrote to memory of 1412	912	b369791eee111afa5b07cec049e3afd2d295fbc61ff07fbe407d99caabb6c305.exe	cmd.exe
PID 912 wrote to memory of 1412	912	b369791eee111afa5b07cec049e3afd2d295fbc61ff07fbe407d99caabb6c305.exe	cmd.exe
PID 912 wrote to memory of 1412	912	b369791eee111afa5b07cec049e3afd2d295fbc61ff07fbe407d99caabb6c305.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\b369791eee111afa5b07cec049e3afd2d295fbc61ff07fbe407d99caabb6c305.exe
"C:\Users\Admin\AppData\Local\Temp\b369791eee111afa5b07cec049e3afd2d295fbc61ff07fbe407d99caabb6c305.exe"
1⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Installs/modifies Browser Helper Object
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:912

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c takeown /f C:\Windows\SysWOW64\wshtcpip.dll && icacls C:\Windows\SysWOW64\wshtcpip.dll /grant administrators:F
2⤵
- Suspicious use of WriteProcessMemory
PID:436

C:\Windows\SysWOW64\takeown.exe
takeown /f C:\Windows\SysWOW64\wshtcpip.dll
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:588

C:\Windows\SysWOW64\icacls.exe
icacls C:\Windows\SysWOW64\wshtcpip.dll /grant administrators:F
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:768

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c takeown /f C:\Windows\SysWOW64\midimap.dll && icacls C:\Windows\SysWOW64\midimap.dll /grant administrators:F
2⤵
- Suspicious use of WriteProcessMemory
PID:828

C:\Windows\SysWOW64\takeown.exe
takeown /f C:\Windows\SysWOW64\midimap.dll
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:1776

C:\Windows\SysWOW64\icacls.exe
icacls C:\Windows\SysWOW64\midimap.dll /grant administrators:F
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:772

C:\Windows\SysWOW64\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\ahnmove.bat
2⤵
- Deletes itself
PID:1412

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Browser Extensions

1

T1176

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

File Permissions Modification

1

T1222

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ahnmove.bat
Filesize
181B

MD5
5219be1ecf452d06f1348c1f4e01f2de

SHA1
8d27e8d22eef31d1acf920f4bf3dd97d7bc31f6a

SHA256
ba8882f67de33372b4cd766f5213e19d32be61fa1ffdb9580cc4452c6bf27034

SHA512
bf5a76ff5690a51edc72b27e3a01414bdbb38a8ac23ce69c01e0b03e6c54ef3779c46bb74968e2a295e7b70deff41be6f98d436f911512b1da4bfea8fd757d58

Download Submit
memory/436-59-0x0000000000000000-mapping.dmp

Download
memory/588-60-0x0000000000000000-mapping.dmp

Download
memory/768-61-0x0000000000000000-mapping.dmp

Download
memory/772-64-0x0000000000000000-mapping.dmp

Download
memory/828-62-0x0000000000000000-mapping.dmp

Download
memory/912-57-0x0000000001000000-0x000000000116A000-memory.dmp

Filesize
1.4MB

Download
memory/912-58-0x0000000000220000-0x0000000000240000-memory.dmp

Filesize
128KB

Download
memory/912-54-0x00000000751A1000-0x00000000751A3000-memory.dmp

Filesize
8KB

Download
memory/912-56-0x0000000000220000-0x0000000000240000-memory.dmp

Filesize
128KB

Download
memory/912-66-0x0000000001000000-0x000000000116A000-memory.dmp

Filesize
1.4MB

Download
memory/912-55-0x0000000001000000-0x000000000116A000-memory.dmp

Filesize
1.4MB

Download
memory/1412-65-0x0000000000000000-mapping.dmp

Download
memory/1776-63-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads