Analysis
-
max time kernel
110s -
max time network
102s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
08-11-2022 17:38
Behavioral task
behavioral1
Sample
3d1b5cf3fe48023f8de5a3cc00e978a4caadb50d1ee5316d4e065d9773285981.exe
Resource
win7-20220812-en
General
-
Target
3d1b5cf3fe48023f8de5a3cc00e978a4caadb50d1ee5316d4e065d9773285981.exe
-
Size
350KB
-
MD5
020bff1e60f35caa632b9967043d4ab0
-
SHA1
60614686aa19453fb10c4aaf92ede5ce297ec551
-
SHA256
3d1b5cf3fe48023f8de5a3cc00e978a4caadb50d1ee5316d4e065d9773285981
-
SHA512
d01185a301da38fde22cbfdadf6afb7af526961a3cca523f4a5814e49937bf478725fc31ce36d93ba29940ca5b376b5c8eb0920a3698bff6093e67504a8bac6b
-
SSDEEP
6144:oyXu7IEBSsQ9ElMwm60lmqs7MTRGA3h3GVqdppJXEGhBukJF/KAwxFUOWdEmh:o3BdQLL4BE93NGVYZX9BukJlwxSJdEm
Malware Config
Signatures
-
Drops file in Drivers directory 2 IoCs
Processes:
3d1b5cf3fe48023f8de5a3cc00e978a4caadb50d1ee5316d4e065d9773285981.exedescription ioc process File created C:\Windows\SysWOW64\drivers\4b94a641.sys 3d1b5cf3fe48023f8de5a3cc00e978a4caadb50d1ee5316d4e065d9773285981.exe File created C:\Windows\SysWOW64\drivers\373f93c7.sys 3d1b5cf3fe48023f8de5a3cc00e978a4caadb50d1ee5316d4e065d9773285981.exe -
Possible privilege escalation attempt 2 IoCs
Processes:
takeown.exeicacls.exepid process 1512 takeown.exe 1808 icacls.exe -
Sets service image path in registry 2 TTPs 2 IoCs
Processes:
3d1b5cf3fe48023f8de5a3cc00e978a4caadb50d1ee5316d4e065d9773285981.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\4b94a641\ImagePath = "\\??\\C:\\Windows\\SysWOW64\\drivers\\4b94a641.sys" 3d1b5cf3fe48023f8de5a3cc00e978a4caadb50d1ee5316d4e065d9773285981.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\373f93c7\ImagePath = "\\??\\C:\\Windows\\SysWOW64\\drivers\\373f93c7.sys" 3d1b5cf3fe48023f8de5a3cc00e978a4caadb50d1ee5316d4e065d9773285981.exe -
Processes:
resource yara_rule behavioral1/memory/1456-54-0x0000000001000000-0x000000000112D000-memory.dmp upx behavioral1/memory/1456-56-0x0000000001000000-0x000000000112D000-memory.dmp upx behavioral1/memory/1456-61-0x0000000001000000-0x000000000112D000-memory.dmp upx -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1372 cmd.exe -
Modifies file permissions 1 TTPs 2 IoCs
Processes:
takeown.exeicacls.exepid process 1512 takeown.exe 1808 icacls.exe -
Installs/modifies Browser Helper Object 2 TTPs 4 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
Processes:
3d1b5cf3fe48023f8de5a3cc00e978a4caadb50d1ee5316d4e065d9773285981.exedescription ioc process Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF} 3d1b5cf3fe48023f8de5a3cc00e978a4caadb50d1ee5316d4e065d9773285981.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E} 3d1b5cf3fe48023f8de5a3cc00e978a4caadb50d1ee5316d4e065d9773285981.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3} 3d1b5cf3fe48023f8de5a3cc00e978a4caadb50d1ee5316d4e065d9773285981.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects 3d1b5cf3fe48023f8de5a3cc00e978a4caadb50d1ee5316d4e065d9773285981.exe -
Drops file in System32 directory 5 IoCs
Processes:
3d1b5cf3fe48023f8de5a3cc00e978a4caadb50d1ee5316d4e065d9773285981.exedescription ioc process File opened for modification C:\Windows\SysWOW64\goodsb.dll 3d1b5cf3fe48023f8de5a3cc00e978a4caadb50d1ee5316d4e065d9773285981.exe File created C:\Windows\SysWOW64\goodsb.dll 3d1b5cf3fe48023f8de5a3cc00e978a4caadb50d1ee5316d4e065d9773285981.exe File created C:\Windows\SysWOW64\ws2tcpip.dll 3d1b5cf3fe48023f8de5a3cc00e978a4caadb50d1ee5316d4e065d9773285981.exe File opened for modification C:\Windows\SysWOW64\ws2tcpip.dll 3d1b5cf3fe48023f8de5a3cc00e978a4caadb50d1ee5316d4e065d9773285981.exe File created C:\Windows\SysWOW64\wshtcpip.dll 3d1b5cf3fe48023f8de5a3cc00e978a4caadb50d1ee5316d4e065d9773285981.exe -
Modifies registry class 4 IoCs
Processes:
3d1b5cf3fe48023f8de5a3cc00e978a4caadb50d1ee5316d4e065d9773285981.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\HOOK_ID 3d1b5cf3fe48023f8de5a3cc00e978a4caadb50d1ee5316d4e065d9773285981.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\HOOK_ID\name = "3d1b5cf3fe48023f8de5a3cc00e978a4caadb50d1ee5316d4e065d9773285981.exe" 3d1b5cf3fe48023f8de5a3cc00e978a4caadb50d1ee5316d4e065d9773285981.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\SYS_DLL 3d1b5cf3fe48023f8de5a3cc00e978a4caadb50d1ee5316d4e065d9773285981.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\SYS_DLL\name = "UgYwge.dll" 3d1b5cf3fe48023f8de5a3cc00e978a4caadb50d1ee5316d4e065d9773285981.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
3d1b5cf3fe48023f8de5a3cc00e978a4caadb50d1ee5316d4e065d9773285981.exepid process 1456 3d1b5cf3fe48023f8de5a3cc00e978a4caadb50d1ee5316d4e065d9773285981.exe 1456 3d1b5cf3fe48023f8de5a3cc00e978a4caadb50d1ee5316d4e065d9773285981.exe 1456 3d1b5cf3fe48023f8de5a3cc00e978a4caadb50d1ee5316d4e065d9773285981.exe 1456 3d1b5cf3fe48023f8de5a3cc00e978a4caadb50d1ee5316d4e065d9773285981.exe 1456 3d1b5cf3fe48023f8de5a3cc00e978a4caadb50d1ee5316d4e065d9773285981.exe 1456 3d1b5cf3fe48023f8de5a3cc00e978a4caadb50d1ee5316d4e065d9773285981.exe 1456 3d1b5cf3fe48023f8de5a3cc00e978a4caadb50d1ee5316d4e065d9773285981.exe 1456 3d1b5cf3fe48023f8de5a3cc00e978a4caadb50d1ee5316d4e065d9773285981.exe 1456 3d1b5cf3fe48023f8de5a3cc00e978a4caadb50d1ee5316d4e065d9773285981.exe 1456 3d1b5cf3fe48023f8de5a3cc00e978a4caadb50d1ee5316d4e065d9773285981.exe 1456 3d1b5cf3fe48023f8de5a3cc00e978a4caadb50d1ee5316d4e065d9773285981.exe 1456 3d1b5cf3fe48023f8de5a3cc00e978a4caadb50d1ee5316d4e065d9773285981.exe 1456 3d1b5cf3fe48023f8de5a3cc00e978a4caadb50d1ee5316d4e065d9773285981.exe 1456 3d1b5cf3fe48023f8de5a3cc00e978a4caadb50d1ee5316d4e065d9773285981.exe 1456 3d1b5cf3fe48023f8de5a3cc00e978a4caadb50d1ee5316d4e065d9773285981.exe 1456 3d1b5cf3fe48023f8de5a3cc00e978a4caadb50d1ee5316d4e065d9773285981.exe 1456 3d1b5cf3fe48023f8de5a3cc00e978a4caadb50d1ee5316d4e065d9773285981.exe 1456 3d1b5cf3fe48023f8de5a3cc00e978a4caadb50d1ee5316d4e065d9773285981.exe 1456 3d1b5cf3fe48023f8de5a3cc00e978a4caadb50d1ee5316d4e065d9773285981.exe 1456 3d1b5cf3fe48023f8de5a3cc00e978a4caadb50d1ee5316d4e065d9773285981.exe 1456 3d1b5cf3fe48023f8de5a3cc00e978a4caadb50d1ee5316d4e065d9773285981.exe 1456 3d1b5cf3fe48023f8de5a3cc00e978a4caadb50d1ee5316d4e065d9773285981.exe 1456 3d1b5cf3fe48023f8de5a3cc00e978a4caadb50d1ee5316d4e065d9773285981.exe 1456 3d1b5cf3fe48023f8de5a3cc00e978a4caadb50d1ee5316d4e065d9773285981.exe 1456 3d1b5cf3fe48023f8de5a3cc00e978a4caadb50d1ee5316d4e065d9773285981.exe 1456 3d1b5cf3fe48023f8de5a3cc00e978a4caadb50d1ee5316d4e065d9773285981.exe 1456 3d1b5cf3fe48023f8de5a3cc00e978a4caadb50d1ee5316d4e065d9773285981.exe 1456 3d1b5cf3fe48023f8de5a3cc00e978a4caadb50d1ee5316d4e065d9773285981.exe 1456 3d1b5cf3fe48023f8de5a3cc00e978a4caadb50d1ee5316d4e065d9773285981.exe 1456 3d1b5cf3fe48023f8de5a3cc00e978a4caadb50d1ee5316d4e065d9773285981.exe 1456 3d1b5cf3fe48023f8de5a3cc00e978a4caadb50d1ee5316d4e065d9773285981.exe 1456 3d1b5cf3fe48023f8de5a3cc00e978a4caadb50d1ee5316d4e065d9773285981.exe 1456 3d1b5cf3fe48023f8de5a3cc00e978a4caadb50d1ee5316d4e065d9773285981.exe 1456 3d1b5cf3fe48023f8de5a3cc00e978a4caadb50d1ee5316d4e065d9773285981.exe 1456 3d1b5cf3fe48023f8de5a3cc00e978a4caadb50d1ee5316d4e065d9773285981.exe 1456 3d1b5cf3fe48023f8de5a3cc00e978a4caadb50d1ee5316d4e065d9773285981.exe 1456 3d1b5cf3fe48023f8de5a3cc00e978a4caadb50d1ee5316d4e065d9773285981.exe 1456 3d1b5cf3fe48023f8de5a3cc00e978a4caadb50d1ee5316d4e065d9773285981.exe 1456 3d1b5cf3fe48023f8de5a3cc00e978a4caadb50d1ee5316d4e065d9773285981.exe 1456 3d1b5cf3fe48023f8de5a3cc00e978a4caadb50d1ee5316d4e065d9773285981.exe 1456 3d1b5cf3fe48023f8de5a3cc00e978a4caadb50d1ee5316d4e065d9773285981.exe 1456 3d1b5cf3fe48023f8de5a3cc00e978a4caadb50d1ee5316d4e065d9773285981.exe 1456 3d1b5cf3fe48023f8de5a3cc00e978a4caadb50d1ee5316d4e065d9773285981.exe 1456 3d1b5cf3fe48023f8de5a3cc00e978a4caadb50d1ee5316d4e065d9773285981.exe 1456 3d1b5cf3fe48023f8de5a3cc00e978a4caadb50d1ee5316d4e065d9773285981.exe 1456 3d1b5cf3fe48023f8de5a3cc00e978a4caadb50d1ee5316d4e065d9773285981.exe 1456 3d1b5cf3fe48023f8de5a3cc00e978a4caadb50d1ee5316d4e065d9773285981.exe 1456 3d1b5cf3fe48023f8de5a3cc00e978a4caadb50d1ee5316d4e065d9773285981.exe 1456 3d1b5cf3fe48023f8de5a3cc00e978a4caadb50d1ee5316d4e065d9773285981.exe 1456 3d1b5cf3fe48023f8de5a3cc00e978a4caadb50d1ee5316d4e065d9773285981.exe 1456 3d1b5cf3fe48023f8de5a3cc00e978a4caadb50d1ee5316d4e065d9773285981.exe 1456 3d1b5cf3fe48023f8de5a3cc00e978a4caadb50d1ee5316d4e065d9773285981.exe 1456 3d1b5cf3fe48023f8de5a3cc00e978a4caadb50d1ee5316d4e065d9773285981.exe 1456 3d1b5cf3fe48023f8de5a3cc00e978a4caadb50d1ee5316d4e065d9773285981.exe 1456 3d1b5cf3fe48023f8de5a3cc00e978a4caadb50d1ee5316d4e065d9773285981.exe 1456 3d1b5cf3fe48023f8de5a3cc00e978a4caadb50d1ee5316d4e065d9773285981.exe 1456 3d1b5cf3fe48023f8de5a3cc00e978a4caadb50d1ee5316d4e065d9773285981.exe 1456 3d1b5cf3fe48023f8de5a3cc00e978a4caadb50d1ee5316d4e065d9773285981.exe 1456 3d1b5cf3fe48023f8de5a3cc00e978a4caadb50d1ee5316d4e065d9773285981.exe 1456 3d1b5cf3fe48023f8de5a3cc00e978a4caadb50d1ee5316d4e065d9773285981.exe 1456 3d1b5cf3fe48023f8de5a3cc00e978a4caadb50d1ee5316d4e065d9773285981.exe 1456 3d1b5cf3fe48023f8de5a3cc00e978a4caadb50d1ee5316d4e065d9773285981.exe 1456 3d1b5cf3fe48023f8de5a3cc00e978a4caadb50d1ee5316d4e065d9773285981.exe 1456 3d1b5cf3fe48023f8de5a3cc00e978a4caadb50d1ee5316d4e065d9773285981.exe -
Suspicious behavior: LoadsDriver 5 IoCs
Processes:
3d1b5cf3fe48023f8de5a3cc00e978a4caadb50d1ee5316d4e065d9773285981.exepid process 464 1456 3d1b5cf3fe48023f8de5a3cc00e978a4caadb50d1ee5316d4e065d9773285981.exe 464 1456 3d1b5cf3fe48023f8de5a3cc00e978a4caadb50d1ee5316d4e065d9773285981.exe 1456 3d1b5cf3fe48023f8de5a3cc00e978a4caadb50d1ee5316d4e065d9773285981.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
3d1b5cf3fe48023f8de5a3cc00e978a4caadb50d1ee5316d4e065d9773285981.exetakeown.exedescription pid process Token: SeDebugPrivilege 1456 3d1b5cf3fe48023f8de5a3cc00e978a4caadb50d1ee5316d4e065d9773285981.exe Token: SeTakeOwnershipPrivilege 1512 takeown.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
3d1b5cf3fe48023f8de5a3cc00e978a4caadb50d1ee5316d4e065d9773285981.execmd.exedescription pid process target process PID 1456 wrote to memory of 1976 1456 3d1b5cf3fe48023f8de5a3cc00e978a4caadb50d1ee5316d4e065d9773285981.exe cmd.exe PID 1456 wrote to memory of 1976 1456 3d1b5cf3fe48023f8de5a3cc00e978a4caadb50d1ee5316d4e065d9773285981.exe cmd.exe PID 1456 wrote to memory of 1976 1456 3d1b5cf3fe48023f8de5a3cc00e978a4caadb50d1ee5316d4e065d9773285981.exe cmd.exe PID 1456 wrote to memory of 1976 1456 3d1b5cf3fe48023f8de5a3cc00e978a4caadb50d1ee5316d4e065d9773285981.exe cmd.exe PID 1976 wrote to memory of 1512 1976 cmd.exe takeown.exe PID 1976 wrote to memory of 1512 1976 cmd.exe takeown.exe PID 1976 wrote to memory of 1512 1976 cmd.exe takeown.exe PID 1976 wrote to memory of 1512 1976 cmd.exe takeown.exe PID 1976 wrote to memory of 1808 1976 cmd.exe icacls.exe PID 1976 wrote to memory of 1808 1976 cmd.exe icacls.exe PID 1976 wrote to memory of 1808 1976 cmd.exe icacls.exe PID 1976 wrote to memory of 1808 1976 cmd.exe icacls.exe PID 1456 wrote to memory of 1372 1456 3d1b5cf3fe48023f8de5a3cc00e978a4caadb50d1ee5316d4e065d9773285981.exe cmd.exe PID 1456 wrote to memory of 1372 1456 3d1b5cf3fe48023f8de5a3cc00e978a4caadb50d1ee5316d4e065d9773285981.exe cmd.exe PID 1456 wrote to memory of 1372 1456 3d1b5cf3fe48023f8de5a3cc00e978a4caadb50d1ee5316d4e065d9773285981.exe cmd.exe PID 1456 wrote to memory of 1372 1456 3d1b5cf3fe48023f8de5a3cc00e978a4caadb50d1ee5316d4e065d9773285981.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3d1b5cf3fe48023f8de5a3cc00e978a4caadb50d1ee5316d4e065d9773285981.exe"C:\Users\Admin\AppData\Local\Temp\3d1b5cf3fe48023f8de5a3cc00e978a4caadb50d1ee5316d4e065d9773285981.exe"1⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\Windows\SysWOW64\cmd.execmd.exe /c takeown /f C:\Windows\SysWOW64\wshtcpip.dll && icacls C:\Windows\SysWOW64\wshtcpip.dll /grant administrators:F2⤵
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\SysWOW64\wshtcpip.dll3⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:1512 -
C:\Windows\SysWOW64\icacls.exeicacls C:\Windows\SysWOW64\wshtcpip.dll /grant administrators:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1808 -
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\ahnmove.bat2⤵
- Deletes itself
PID:1372
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\ahnmove.batFilesize
181B
MD51e26c2768c08071530652530daa0559e
SHA166612b356d1b1389371fed83c0c87b484eed97d3
SHA256cde0f802f7a2e17e6c35e03d15b87102c7e4a0f73f8f647f2c0b77835f49b983
SHA512d42bafacddd2acfd06091852027181d4164e1dba5a73dff9cd7c68603c497db7ad1ab5c36e453796d09175b2c37c043ebc3d359ef0e73034eb7e08afaa3e022f
-
memory/1372-60-0x0000000000000000-mapping.dmp
-
memory/1456-54-0x0000000001000000-0x000000000112D000-memory.dmpFilesize
1.2MB
-
memory/1456-55-0x0000000075021000-0x0000000075023000-memory.dmpFilesize
8KB
-
memory/1456-56-0x0000000001000000-0x000000000112D000-memory.dmpFilesize
1.2MB
-
memory/1456-61-0x0000000001000000-0x000000000112D000-memory.dmpFilesize
1.2MB
-
memory/1512-58-0x0000000000000000-mapping.dmp
-
memory/1808-59-0x0000000000000000-mapping.dmp
-
memory/1976-57-0x0000000000000000-mapping.dmp