Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
08-11-2022 17:38
Behavioral task
behavioral1
Sample
1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe
Resource
win7-20220812-en
General
-
Target
1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe
-
Size
350KB
-
MD5
01202732d53aa438f714aa18a1969b30
-
SHA1
ae3ffc7b5c00a3288658034586ebeaa848cb9594
-
SHA256
1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a
-
SHA512
057165ccca0fadb21c01f8269018999d2e5d02e2e7d6782da20a1d11afd067e1077895443bd61b53b1e4dd8f3c3717091a5d78c81bb94e5d08763928df5b7622
-
SSDEEP
6144:4yXu7IEBSsQ9ElMwm60lmqs7MTRGA3h3GVqdppJXEGhBukJF/KAwxFUOWdEmh:43BdQLL4BE93NGVYZX9BukJlwxSJdEm
Malware Config
Signatures
-
Drops file in Drivers directory 2 IoCs
Processes:
1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exedescription ioc process File created C:\Windows\SysWOW64\drivers\549fdb3d.sys 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe File created C:\Windows\SysWOW64\drivers\2834eebb.sys 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe -
Possible privilege escalation attempt 2 IoCs
Processes:
icacls.exetakeown.exepid process 2044 icacls.exe 1620 takeown.exe -
Sets service image path in registry 2 TTPs 2 IoCs
Processes:
1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\549fdb3d\ImagePath = "\\??\\C:\\Windows\\SysWOW64\\drivers\\549fdb3d.sys" 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\2834eebb\ImagePath = "\\??\\C:\\Windows\\SysWOW64\\drivers\\2834eebb.sys" 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe -
Processes:
resource yara_rule behavioral2/memory/3708-132-0x0000000001000000-0x000000000112D000-memory.dmp upx behavioral2/memory/3708-133-0x0000000001000000-0x000000000112D000-memory.dmp upx behavioral2/memory/3708-138-0x0000000001000000-0x000000000112D000-memory.dmp upx -
Modifies file permissions 1 TTPs 2 IoCs
Processes:
takeown.exeicacls.exepid process 1620 takeown.exe 2044 icacls.exe -
Installs/modifies Browser Helper Object 2 TTPs 3 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
Processes:
1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exedescription ioc process Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA} 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C} 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe -
Drops file in System32 directory 5 IoCs
Processes:
1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exedescription ioc process File opened for modification C:\Windows\SysWOW64\goodsb.dll 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe File created C:\Windows\SysWOW64\goodsb.dll 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe File created C:\Windows\SysWOW64\ws2tcpip.dll 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe File opened for modification C:\Windows\SysWOW64\ws2tcpip.dll 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe File created C:\Windows\SysWOW64\wshtcpip.dll 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe -
Modifies registry class 4 IoCs
Processes:
1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\HOOK_ID 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\HOOK_ID\name = "1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe" 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\SYS_DLL 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\SYS_DLL\name = "KuRqhuAh.dll" 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exepid process 3708 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe 3708 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe 3708 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe 3708 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe 3708 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe 3708 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe 3708 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe 3708 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe 3708 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe 3708 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe 3708 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe 3708 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe 3708 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe 3708 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe 3708 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe 3708 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe 3708 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe 3708 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe 3708 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe 3708 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe 3708 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe 3708 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe 3708 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe 3708 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe 3708 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe 3708 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe 3708 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe 3708 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe 3708 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe 3708 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe 3708 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe 3708 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe 3708 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe 3708 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe 3708 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe 3708 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe 3708 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe 3708 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe 3708 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe 3708 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe 3708 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe 3708 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe 3708 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe 3708 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe 3708 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe 3708 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe 3708 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe 3708 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe 3708 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe 3708 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe 3708 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe 3708 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe 3708 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe 3708 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe 3708 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe 3708 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe 3708 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe 3708 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe 3708 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe 3708 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe 3708 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe 3708 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe 3708 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe 3708 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe -
Suspicious behavior: LoadsDriver 5 IoCs
Processes:
1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exepid process 656 3708 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe 656 3708 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe 3708 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exetakeown.exedescription pid process Token: SeDebugPrivilege 3708 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe Token: SeTakeOwnershipPrivilege 1620 takeown.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.execmd.exedescription pid process target process PID 3708 wrote to memory of 4668 3708 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe cmd.exe PID 3708 wrote to memory of 4668 3708 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe cmd.exe PID 3708 wrote to memory of 4668 3708 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe cmd.exe PID 4668 wrote to memory of 1620 4668 cmd.exe takeown.exe PID 4668 wrote to memory of 1620 4668 cmd.exe takeown.exe PID 4668 wrote to memory of 1620 4668 cmd.exe takeown.exe PID 4668 wrote to memory of 2044 4668 cmd.exe icacls.exe PID 4668 wrote to memory of 2044 4668 cmd.exe icacls.exe PID 4668 wrote to memory of 2044 4668 cmd.exe icacls.exe PID 3708 wrote to memory of 3444 3708 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe cmd.exe PID 3708 wrote to memory of 3444 3708 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe cmd.exe PID 3708 wrote to memory of 3444 3708 1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe"C:\Users\Admin\AppData\Local\Temp\1771f7813d53060da8bb77c990aa9f98604f2dc8c74ebcebb1e2400f5c516a6a.exe"1⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /c takeown /f C:\Windows\SysWOW64\wshtcpip.dll && icacls C:\Windows\SysWOW64\wshtcpip.dll /grant administrators:F2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\SysWOW64\wshtcpip.dll3⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\icacls.exeicacls C:\Windows\SysWOW64\wshtcpip.dll /grant administrators:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ahnmove.bat2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\ahnmove.batFilesize
181B
MD5747b319ed12e093e199d69450a81db81
SHA1ac77e6c689de008ce7d8dc452b3a6b14a0b7c2ca
SHA256ce771a39885616f1518795be7ea60750be4dd5cdb4d873132f635cdb29a7659c
SHA5122d762c45bc82ba29970d9d87297a9701bc9ed1ef89600c4ffe81a7b0be1091f6b5012f4d07f49a8afb49f96eab14df2842246f3cf5364ff04ca6cb6be16d03ac
-
memory/1620-135-0x0000000000000000-mapping.dmp
-
memory/2044-136-0x0000000000000000-mapping.dmp
-
memory/3444-137-0x0000000000000000-mapping.dmp
-
memory/3708-132-0x0000000001000000-0x000000000112D000-memory.dmpFilesize
1.2MB
-
memory/3708-133-0x0000000001000000-0x000000000112D000-memory.dmpFilesize
1.2MB
-
memory/3708-138-0x0000000001000000-0x000000000112D000-memory.dmpFilesize
1.2MB
-
memory/4668-134-0x0000000000000000-mapping.dmp