Analysis
-
max time kernel
62s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
08-11-2022 17:38
Behavioral task
behavioral1
Sample
1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe
Resource
win7-20220812-en
General
-
Target
1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe
-
Size
350KB
-
MD5
01202732d53aa438f714aa18a1969b30
-
SHA1
ae3ffc7b5c00a3288658034586ebeaa848cb9594
-
SHA256
1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a
-
SHA512
057165ccca0fadb21c01f8269018999d2e5d02e2e7d6782da20a1d11afd067e1077895443bd61b53b1e4dd8f3c3717091a5d78c81bb94e5d08763928df5b7622
-
SSDEEP
6144:4yXu7IEBSsQ9ElMwm60lmqs7MTRGA3h3GVqdppJXEGhBukJF/KAwxFUOWdEmh:43BdQLL4BE93NGVYZX9BukJlwxSJdEm
Malware Config
Signatures
-
Drops file in Drivers directory 2 IoCs
Processes:
1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exedescription ioc process File created C:\Windows\SysWOW64\drivers\25b0fa36.sys 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe File created C:\Windows\SysWOW64\drivers\591bcfb0.sys 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe -
Possible privilege escalation attempt 2 IoCs
Processes:
takeown.exeicacls.exepid process 576 takeown.exe 1520 icacls.exe -
Sets service image path in registry 2 TTPs 2 IoCs
Processes:
1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\591bcfb0\ImagePath = "\\??\\C:\\Windows\\SysWOW64\\drivers\\591bcfb0.sys" 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\25b0fa36\ImagePath = "\\??\\C:\\Windows\\SysWOW64\\drivers\\25b0fa36.sys" 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe -
Processes:
resource yara_rule behavioral1/memory/1652-55-0x0000000001000000-0x000000000112D000-memory.dmp upx behavioral1/memory/1652-56-0x0000000001000000-0x000000000112D000-memory.dmp upx behavioral1/memory/1652-61-0x0000000001000000-0x000000000112D000-memory.dmp upx -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 688 cmd.exe -
Modifies file permissions 1 TTPs 2 IoCs
Processes:
takeown.exeicacls.exepid process 576 takeown.exe 1520 icacls.exe -
Installs/modifies Browser Helper Object 2 TTPs 4 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
Processes:
1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exedescription ioc process Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF} 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E} 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3} 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe -
Drops file in System32 directory 5 IoCs
Processes:
1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exedescription ioc process File opened for modification C:\Windows\SysWOW64\goodsb.dll 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe File created C:\Windows\SysWOW64\goodsb.dll 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe File created C:\Windows\SysWOW64\ws2tcpip.dll 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe File opened for modification C:\Windows\SysWOW64\ws2tcpip.dll 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe File created C:\Windows\SysWOW64\wshtcpip.dll 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe -
Modifies registry class 4 IoCs
Processes:
1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\HOOK_ID 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\HOOK_ID\name = "1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe" 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\SYS_DLL 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\SYS_DLL\name = "wtFhwuB.dll" 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exepid process 1652 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe 1652 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe 1652 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe 1652 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe 1652 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe 1652 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe 1652 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe 1652 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe 1652 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe 1652 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe 1652 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe 1652 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe 1652 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe 1652 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe 1652 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe 1652 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe 1652 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe 1652 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe 1652 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe 1652 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe 1652 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe 1652 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe 1652 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe 1652 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe 1652 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe 1652 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe 1652 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe 1652 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe 1652 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe 1652 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe 1652 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe 1652 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe 1652 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe 1652 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe 1652 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe 1652 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe 1652 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe 1652 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe 1652 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe 1652 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe 1652 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe 1652 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe 1652 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe 1652 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe 1652 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe 1652 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe 1652 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe 1652 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe 1652 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe 1652 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe 1652 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe 1652 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe 1652 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe 1652 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe 1652 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe 1652 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe 1652 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe 1652 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe 1652 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe 1652 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe 1652 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe 1652 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe 1652 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe 1652 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe -
Suspicious behavior: LoadsDriver 5 IoCs
Processes:
1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exepid process 464 1652 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe 464 1652 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe 1652 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exetakeown.exedescription pid process Token: SeDebugPrivilege 1652 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe Token: SeTakeOwnershipPrivilege 576 takeown.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.execmd.exedescription pid process target process PID 1652 wrote to memory of 588 1652 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe cmd.exe PID 1652 wrote to memory of 588 1652 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe cmd.exe PID 1652 wrote to memory of 588 1652 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe cmd.exe PID 1652 wrote to memory of 588 1652 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe cmd.exe PID 588 wrote to memory of 576 588 cmd.exe takeown.exe PID 588 wrote to memory of 576 588 cmd.exe takeown.exe PID 588 wrote to memory of 576 588 cmd.exe takeown.exe PID 588 wrote to memory of 576 588 cmd.exe takeown.exe PID 588 wrote to memory of 1520 588 cmd.exe icacls.exe PID 588 wrote to memory of 1520 588 cmd.exe icacls.exe PID 588 wrote to memory of 1520 588 cmd.exe icacls.exe PID 588 wrote to memory of 1520 588 cmd.exe icacls.exe PID 1652 wrote to memory of 688 1652 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe cmd.exe PID 1652 wrote to memory of 688 1652 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe cmd.exe PID 1652 wrote to memory of 688 1652 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe cmd.exe PID 1652 wrote to memory of 688 1652 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe"C:\Users\Admin\AppData\Local\Temp\1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe"1⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /c takeown /f C:\Windows\SysWOW64\wshtcpip.dll && icacls C:\Windows\SysWOW64\wshtcpip.dll /grant administrators:F2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\SysWOW64\wshtcpip.dll3⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\icacls.exeicacls C:\Windows\SysWOW64\wshtcpip.dll /grant administrators:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\ahnmove.bat2⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\ahnmove.batFilesize
181B
MD5747b319ed12e093e199d69450a81db81
SHA1ac77e6c689de008ce7d8dc452b3a6b14a0b7c2ca
SHA256ce771a39885616f1518795be7ea60750be4dd5cdb4d873132f635cdb29a7659c
SHA5122d762c45bc82ba29970d9d87297a9701bc9ed1ef89600c4ffe81a7b0be1091f6b5012f4d07f49a8afb49f96eab14df2842246f3cf5364ff04ca6cb6be16d03ac
-
memory/576-58-0x0000000000000000-mapping.dmp
-
memory/588-57-0x0000000000000000-mapping.dmp
-
memory/688-60-0x0000000000000000-mapping.dmp
-
memory/1520-59-0x0000000000000000-mapping.dmp
-
memory/1652-54-0x0000000076041000-0x0000000076043000-memory.dmpFilesize
8KB
-
memory/1652-55-0x0000000001000000-0x000000000112D000-memory.dmpFilesize
1.2MB
-
memory/1652-56-0x0000000001000000-0x000000000112D000-memory.dmpFilesize
1.2MB
-
memory/1652-61-0x0000000001000000-0x000000000112D000-memory.dmpFilesize
1.2MB