Analysis
-
max time kernel
112s -
max time network
105s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
08-11-2022 17:38
Behavioral task
behavioral1
Sample
22f14d3b7e98c275e741acbf55b840cb9b572296e2518bd7eeba12d98dbc4654.exe
Resource
win7-20220812-en
General
-
Target
22f14d3b7e98c275e741acbf55b840cb9b572296e2518bd7eeba12d98dbc4654.exe
-
Size
350KB
-
MD5
0834c751f3ef78c0447990a4b34065e0
-
SHA1
9ebef84b1a1a0b6b565a24a0c7d64fb20099ac84
-
SHA256
22f14d3b7e98c275e741acbf55b840cb9b572296e2518bd7eeba12d98dbc4654
-
SHA512
09ff13c28917d3cc57e0cfb1d379cea958c429ba422f3a5fefea31ed1e42fe8c66ffc32849b4f6d77734be245a3f03616ce697292aff53317d75a8eaaa08bbfb
-
SSDEEP
6144:ftyXu7IEBSsQ9ElMwm60lmqs7MTRGA3h3GVqdppJXEGhBukJF/KAwxFUOWdEmh:ft3BdQLL4BE93NGVYZX9BukJlwxSJdEm
Malware Config
Signatures
-
Drops file in Drivers directory 2 IoCs
Processes:
22f14d3b7e98c275e741acbf55b840cb9b572296e2518bd7eeba12d98dbc4654.exedescription ioc process File created C:\Windows\SysWOW64\drivers\014c4dcb.sys 22f14d3b7e98c275e741acbf55b840cb9b572296e2518bd7eeba12d98dbc4654.exe File created C:\Windows\SysWOW64\drivers\7de7784d.sys 22f14d3b7e98c275e741acbf55b840cb9b572296e2518bd7eeba12d98dbc4654.exe -
Possible privilege escalation attempt 2 IoCs
Processes:
takeown.exeicacls.exepid process 1268 takeown.exe 1152 icacls.exe -
Sets service image path in registry 2 TTPs 2 IoCs
Processes:
22f14d3b7e98c275e741acbf55b840cb9b572296e2518bd7eeba12d98dbc4654.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\014c4dcb\ImagePath = "\\??\\C:\\Windows\\SysWOW64\\drivers\\014c4dcb.sys" 22f14d3b7e98c275e741acbf55b840cb9b572296e2518bd7eeba12d98dbc4654.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\7de7784d\ImagePath = "\\??\\C:\\Windows\\SysWOW64\\drivers\\7de7784d.sys" 22f14d3b7e98c275e741acbf55b840cb9b572296e2518bd7eeba12d98dbc4654.exe -
Processes:
resource yara_rule behavioral1/memory/1752-55-0x0000000001000000-0x000000000112D000-memory.dmp upx behavioral1/memory/1752-56-0x0000000001000000-0x000000000112D000-memory.dmp upx behavioral1/memory/1752-61-0x0000000001000000-0x000000000112D000-memory.dmp upx -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1356 cmd.exe -
Modifies file permissions 1 TTPs 2 IoCs
Processes:
takeown.exeicacls.exepid process 1268 takeown.exe 1152 icacls.exe -
Installs/modifies Browser Helper Object 2 TTPs 4 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
Processes:
22f14d3b7e98c275e741acbf55b840cb9b572296e2518bd7eeba12d98dbc4654.exedescription ioc process Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF} 22f14d3b7e98c275e741acbf55b840cb9b572296e2518bd7eeba12d98dbc4654.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E} 22f14d3b7e98c275e741acbf55b840cb9b572296e2518bd7eeba12d98dbc4654.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3} 22f14d3b7e98c275e741acbf55b840cb9b572296e2518bd7eeba12d98dbc4654.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects 22f14d3b7e98c275e741acbf55b840cb9b572296e2518bd7eeba12d98dbc4654.exe -
Drops file in System32 directory 5 IoCs
Processes:
22f14d3b7e98c275e741acbf55b840cb9b572296e2518bd7eeba12d98dbc4654.exedescription ioc process File opened for modification C:\Windows\SysWOW64\goodsb.dll 22f14d3b7e98c275e741acbf55b840cb9b572296e2518bd7eeba12d98dbc4654.exe File created C:\Windows\SysWOW64\goodsb.dll 22f14d3b7e98c275e741acbf55b840cb9b572296e2518bd7eeba12d98dbc4654.exe File created C:\Windows\SysWOW64\ws2tcpip.dll 22f14d3b7e98c275e741acbf55b840cb9b572296e2518bd7eeba12d98dbc4654.exe File opened for modification C:\Windows\SysWOW64\ws2tcpip.dll 22f14d3b7e98c275e741acbf55b840cb9b572296e2518bd7eeba12d98dbc4654.exe File created C:\Windows\SysWOW64\wshtcpip.dll 22f14d3b7e98c275e741acbf55b840cb9b572296e2518bd7eeba12d98dbc4654.exe -
Modifies registry class 4 IoCs
Processes:
22f14d3b7e98c275e741acbf55b840cb9b572296e2518bd7eeba12d98dbc4654.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\HOOK_ID 22f14d3b7e98c275e741acbf55b840cb9b572296e2518bd7eeba12d98dbc4654.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\HOOK_ID\name = "22f14d3b7e98c275e741acbf55b840cb9b572296e2518bd7eeba12d98dbc4654.exe" 22f14d3b7e98c275e741acbf55b840cb9b572296e2518bd7eeba12d98dbc4654.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\SYS_DLL 22f14d3b7e98c275e741acbf55b840cb9b572296e2518bd7eeba12d98dbc4654.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\SYS_DLL\name = "Tir.dll" 22f14d3b7e98c275e741acbf55b840cb9b572296e2518bd7eeba12d98dbc4654.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
22f14d3b7e98c275e741acbf55b840cb9b572296e2518bd7eeba12d98dbc4654.exepid process 1752 22f14d3b7e98c275e741acbf55b840cb9b572296e2518bd7eeba12d98dbc4654.exe 1752 22f14d3b7e98c275e741acbf55b840cb9b572296e2518bd7eeba12d98dbc4654.exe 1752 22f14d3b7e98c275e741acbf55b840cb9b572296e2518bd7eeba12d98dbc4654.exe 1752 22f14d3b7e98c275e741acbf55b840cb9b572296e2518bd7eeba12d98dbc4654.exe 1752 22f14d3b7e98c275e741acbf55b840cb9b572296e2518bd7eeba12d98dbc4654.exe 1752 22f14d3b7e98c275e741acbf55b840cb9b572296e2518bd7eeba12d98dbc4654.exe 1752 22f14d3b7e98c275e741acbf55b840cb9b572296e2518bd7eeba12d98dbc4654.exe 1752 22f14d3b7e98c275e741acbf55b840cb9b572296e2518bd7eeba12d98dbc4654.exe 1752 22f14d3b7e98c275e741acbf55b840cb9b572296e2518bd7eeba12d98dbc4654.exe 1752 22f14d3b7e98c275e741acbf55b840cb9b572296e2518bd7eeba12d98dbc4654.exe 1752 22f14d3b7e98c275e741acbf55b840cb9b572296e2518bd7eeba12d98dbc4654.exe 1752 22f14d3b7e98c275e741acbf55b840cb9b572296e2518bd7eeba12d98dbc4654.exe 1752 22f14d3b7e98c275e741acbf55b840cb9b572296e2518bd7eeba12d98dbc4654.exe 1752 22f14d3b7e98c275e741acbf55b840cb9b572296e2518bd7eeba12d98dbc4654.exe 1752 22f14d3b7e98c275e741acbf55b840cb9b572296e2518bd7eeba12d98dbc4654.exe 1752 22f14d3b7e98c275e741acbf55b840cb9b572296e2518bd7eeba12d98dbc4654.exe 1752 22f14d3b7e98c275e741acbf55b840cb9b572296e2518bd7eeba12d98dbc4654.exe 1752 22f14d3b7e98c275e741acbf55b840cb9b572296e2518bd7eeba12d98dbc4654.exe 1752 22f14d3b7e98c275e741acbf55b840cb9b572296e2518bd7eeba12d98dbc4654.exe 1752 22f14d3b7e98c275e741acbf55b840cb9b572296e2518bd7eeba12d98dbc4654.exe 1752 22f14d3b7e98c275e741acbf55b840cb9b572296e2518bd7eeba12d98dbc4654.exe 1752 22f14d3b7e98c275e741acbf55b840cb9b572296e2518bd7eeba12d98dbc4654.exe 1752 22f14d3b7e98c275e741acbf55b840cb9b572296e2518bd7eeba12d98dbc4654.exe 1752 22f14d3b7e98c275e741acbf55b840cb9b572296e2518bd7eeba12d98dbc4654.exe 1752 22f14d3b7e98c275e741acbf55b840cb9b572296e2518bd7eeba12d98dbc4654.exe 1752 22f14d3b7e98c275e741acbf55b840cb9b572296e2518bd7eeba12d98dbc4654.exe 1752 22f14d3b7e98c275e741acbf55b840cb9b572296e2518bd7eeba12d98dbc4654.exe 1752 22f14d3b7e98c275e741acbf55b840cb9b572296e2518bd7eeba12d98dbc4654.exe 1752 22f14d3b7e98c275e741acbf55b840cb9b572296e2518bd7eeba12d98dbc4654.exe 1752 22f14d3b7e98c275e741acbf55b840cb9b572296e2518bd7eeba12d98dbc4654.exe 1752 22f14d3b7e98c275e741acbf55b840cb9b572296e2518bd7eeba12d98dbc4654.exe 1752 22f14d3b7e98c275e741acbf55b840cb9b572296e2518bd7eeba12d98dbc4654.exe 1752 22f14d3b7e98c275e741acbf55b840cb9b572296e2518bd7eeba12d98dbc4654.exe 1752 22f14d3b7e98c275e741acbf55b840cb9b572296e2518bd7eeba12d98dbc4654.exe 1752 22f14d3b7e98c275e741acbf55b840cb9b572296e2518bd7eeba12d98dbc4654.exe 1752 22f14d3b7e98c275e741acbf55b840cb9b572296e2518bd7eeba12d98dbc4654.exe 1752 22f14d3b7e98c275e741acbf55b840cb9b572296e2518bd7eeba12d98dbc4654.exe 1752 22f14d3b7e98c275e741acbf55b840cb9b572296e2518bd7eeba12d98dbc4654.exe 1752 22f14d3b7e98c275e741acbf55b840cb9b572296e2518bd7eeba12d98dbc4654.exe 1752 22f14d3b7e98c275e741acbf55b840cb9b572296e2518bd7eeba12d98dbc4654.exe 1752 22f14d3b7e98c275e741acbf55b840cb9b572296e2518bd7eeba12d98dbc4654.exe 1752 22f14d3b7e98c275e741acbf55b840cb9b572296e2518bd7eeba12d98dbc4654.exe 1752 22f14d3b7e98c275e741acbf55b840cb9b572296e2518bd7eeba12d98dbc4654.exe 1752 22f14d3b7e98c275e741acbf55b840cb9b572296e2518bd7eeba12d98dbc4654.exe 1752 22f14d3b7e98c275e741acbf55b840cb9b572296e2518bd7eeba12d98dbc4654.exe 1752 22f14d3b7e98c275e741acbf55b840cb9b572296e2518bd7eeba12d98dbc4654.exe 1752 22f14d3b7e98c275e741acbf55b840cb9b572296e2518bd7eeba12d98dbc4654.exe 1752 22f14d3b7e98c275e741acbf55b840cb9b572296e2518bd7eeba12d98dbc4654.exe 1752 22f14d3b7e98c275e741acbf55b840cb9b572296e2518bd7eeba12d98dbc4654.exe 1752 22f14d3b7e98c275e741acbf55b840cb9b572296e2518bd7eeba12d98dbc4654.exe 1752 22f14d3b7e98c275e741acbf55b840cb9b572296e2518bd7eeba12d98dbc4654.exe 1752 22f14d3b7e98c275e741acbf55b840cb9b572296e2518bd7eeba12d98dbc4654.exe 1752 22f14d3b7e98c275e741acbf55b840cb9b572296e2518bd7eeba12d98dbc4654.exe 1752 22f14d3b7e98c275e741acbf55b840cb9b572296e2518bd7eeba12d98dbc4654.exe 1752 22f14d3b7e98c275e741acbf55b840cb9b572296e2518bd7eeba12d98dbc4654.exe 1752 22f14d3b7e98c275e741acbf55b840cb9b572296e2518bd7eeba12d98dbc4654.exe 1752 22f14d3b7e98c275e741acbf55b840cb9b572296e2518bd7eeba12d98dbc4654.exe 1752 22f14d3b7e98c275e741acbf55b840cb9b572296e2518bd7eeba12d98dbc4654.exe 1752 22f14d3b7e98c275e741acbf55b840cb9b572296e2518bd7eeba12d98dbc4654.exe 1752 22f14d3b7e98c275e741acbf55b840cb9b572296e2518bd7eeba12d98dbc4654.exe 1752 22f14d3b7e98c275e741acbf55b840cb9b572296e2518bd7eeba12d98dbc4654.exe 1752 22f14d3b7e98c275e741acbf55b840cb9b572296e2518bd7eeba12d98dbc4654.exe 1752 22f14d3b7e98c275e741acbf55b840cb9b572296e2518bd7eeba12d98dbc4654.exe 1752 22f14d3b7e98c275e741acbf55b840cb9b572296e2518bd7eeba12d98dbc4654.exe -
Suspicious behavior: LoadsDriver 5 IoCs
Processes:
22f14d3b7e98c275e741acbf55b840cb9b572296e2518bd7eeba12d98dbc4654.exepid process 464 1752 22f14d3b7e98c275e741acbf55b840cb9b572296e2518bd7eeba12d98dbc4654.exe 464 1752 22f14d3b7e98c275e741acbf55b840cb9b572296e2518bd7eeba12d98dbc4654.exe 1752 22f14d3b7e98c275e741acbf55b840cb9b572296e2518bd7eeba12d98dbc4654.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
22f14d3b7e98c275e741acbf55b840cb9b572296e2518bd7eeba12d98dbc4654.exetakeown.exedescription pid process Token: SeDebugPrivilege 1752 22f14d3b7e98c275e741acbf55b840cb9b572296e2518bd7eeba12d98dbc4654.exe Token: SeTakeOwnershipPrivilege 1268 takeown.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
22f14d3b7e98c275e741acbf55b840cb9b572296e2518bd7eeba12d98dbc4654.execmd.exedescription pid process target process PID 1752 wrote to memory of 268 1752 22f14d3b7e98c275e741acbf55b840cb9b572296e2518bd7eeba12d98dbc4654.exe cmd.exe PID 1752 wrote to memory of 268 1752 22f14d3b7e98c275e741acbf55b840cb9b572296e2518bd7eeba12d98dbc4654.exe cmd.exe PID 1752 wrote to memory of 268 1752 22f14d3b7e98c275e741acbf55b840cb9b572296e2518bd7eeba12d98dbc4654.exe cmd.exe PID 1752 wrote to memory of 268 1752 22f14d3b7e98c275e741acbf55b840cb9b572296e2518bd7eeba12d98dbc4654.exe cmd.exe PID 268 wrote to memory of 1268 268 cmd.exe takeown.exe PID 268 wrote to memory of 1268 268 cmd.exe takeown.exe PID 268 wrote to memory of 1268 268 cmd.exe takeown.exe PID 268 wrote to memory of 1268 268 cmd.exe takeown.exe PID 268 wrote to memory of 1152 268 cmd.exe icacls.exe PID 268 wrote to memory of 1152 268 cmd.exe icacls.exe PID 268 wrote to memory of 1152 268 cmd.exe icacls.exe PID 268 wrote to memory of 1152 268 cmd.exe icacls.exe PID 1752 wrote to memory of 1356 1752 22f14d3b7e98c275e741acbf55b840cb9b572296e2518bd7eeba12d98dbc4654.exe cmd.exe PID 1752 wrote to memory of 1356 1752 22f14d3b7e98c275e741acbf55b840cb9b572296e2518bd7eeba12d98dbc4654.exe cmd.exe PID 1752 wrote to memory of 1356 1752 22f14d3b7e98c275e741acbf55b840cb9b572296e2518bd7eeba12d98dbc4654.exe cmd.exe PID 1752 wrote to memory of 1356 1752 22f14d3b7e98c275e741acbf55b840cb9b572296e2518bd7eeba12d98dbc4654.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\22f14d3b7e98c275e741acbf55b840cb9b572296e2518bd7eeba12d98dbc4654.exe"C:\Users\Admin\AppData\Local\Temp\22f14d3b7e98c275e741acbf55b840cb9b572296e2518bd7eeba12d98dbc4654.exe"1⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /c takeown /f C:\Windows\SysWOW64\wshtcpip.dll && icacls C:\Windows\SysWOW64\wshtcpip.dll /grant administrators:F2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\SysWOW64\wshtcpip.dll3⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\icacls.exeicacls C:\Windows\SysWOW64\wshtcpip.dll /grant administrators:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\ahnmove.bat2⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\ahnmove.batFilesize
181B
MD5bf4f0814a82ed8e9505a5ae2bda25093
SHA19445aa7467aa213684acb489fa2b49f85a85f8f3
SHA25683b1ebc89995cf1a17b1031014ad3f2f273cc374b006d73aff3389edc334c0ff
SHA512f60e118691888d05fb604cd26cc4ce568a2a8eefdebea5eb25eb94aaca249e1dd0cb8952e5b8c2d76366e28295360a2be437c0abb5465d6ec93fc76e51484d7a
-
memory/268-57-0x0000000000000000-mapping.dmp
-
memory/1152-59-0x0000000000000000-mapping.dmp
-
memory/1268-58-0x0000000000000000-mapping.dmp
-
memory/1356-60-0x0000000000000000-mapping.dmp
-
memory/1752-54-0x0000000075931000-0x0000000075933000-memory.dmpFilesize
8KB
-
memory/1752-55-0x0000000001000000-0x000000000112D000-memory.dmpFilesize
1.2MB
-
memory/1752-56-0x0000000001000000-0x000000000112D000-memory.dmpFilesize
1.2MB
-
memory/1752-61-0x0000000001000000-0x000000000112D000-memory.dmpFilesize
1.2MB