Analysis
-
max time kernel
57s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
19-11-2022 03:55
Behavioral task
behavioral1
Sample
3a07bb569447b1b8f600469f51506a6360901ef8238384bbf87f915870feb509.exe
Resource
win7-20220901-en
General
-
Target
3a07bb569447b1b8f600469f51506a6360901ef8238384bbf87f915870feb509.exe
-
Size
350KB
-
MD5
353a4b0d1698da7b5f466e88a888e020
-
SHA1
c813c5bdd0f9d2ce88aa741def158326d9b6f2d6
-
SHA256
3a07bb569447b1b8f600469f51506a6360901ef8238384bbf87f915870feb509
-
SHA512
94246bada64b9895634bab47caf27ad295da50ec048501b3e3b920c94bf268d4a03ff8badeccbb29067fbebb990d77fc2a2cb880fa96656a21c985c391c8a873
-
SSDEEP
6144:AyXu7IEBSsQ9ElMwm60lmqs7MTRGA3h3GVqdppJXEGhBukJF/KAwxFUOWdEmh:A3BdQLL4BE93NGVYZX9BukJlwxSJdEm
Malware Config
Signatures
-
Drops file in Drivers directory 2 IoCs
Processes:
3a07bb569447b1b8f600469f51506a6360901ef8238384bbf87f915870feb509.exedescription ioc process File created C:\Windows\SysWOW64\drivers\129b45a0.sys 3a07bb569447b1b8f600469f51506a6360901ef8238384bbf87f915870feb509.exe File created C:\Windows\SysWOW64\drivers\6e307026.sys 3a07bb569447b1b8f600469f51506a6360901ef8238384bbf87f915870feb509.exe -
Possible privilege escalation attempt 2 IoCs
Processes:
icacls.exetakeown.exepid process 992 icacls.exe 824 takeown.exe -
Sets service image path in registry 2 TTPs 2 IoCs
Processes:
3a07bb569447b1b8f600469f51506a6360901ef8238384bbf87f915870feb509.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\129b45a0\ImagePath = "\\??\\C:\\Windows\\SysWOW64\\drivers\\129b45a0.sys" 3a07bb569447b1b8f600469f51506a6360901ef8238384bbf87f915870feb509.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\6e307026\ImagePath = "\\??\\C:\\Windows\\SysWOW64\\drivers\\6e307026.sys" 3a07bb569447b1b8f600469f51506a6360901ef8238384bbf87f915870feb509.exe -
Processes:
resource yara_rule behavioral1/memory/1672-55-0x0000000001000000-0x000000000112D000-memory.dmp upx behavioral1/memory/1672-60-0x0000000001000000-0x000000000112D000-memory.dmp upx -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 692 cmd.exe -
Modifies file permissions 1 TTPs 2 IoCs
Processes:
takeown.exeicacls.exepid process 824 takeown.exe 992 icacls.exe -
Installs/modifies Browser Helper Object 2 TTPs 4 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
Processes:
3a07bb569447b1b8f600469f51506a6360901ef8238384bbf87f915870feb509.exedescription ioc process Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects 3a07bb569447b1b8f600469f51506a6360901ef8238384bbf87f915870feb509.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF} 3a07bb569447b1b8f600469f51506a6360901ef8238384bbf87f915870feb509.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E} 3a07bb569447b1b8f600469f51506a6360901ef8238384bbf87f915870feb509.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3} 3a07bb569447b1b8f600469f51506a6360901ef8238384bbf87f915870feb509.exe -
Drops file in System32 directory 5 IoCs
Processes:
3a07bb569447b1b8f600469f51506a6360901ef8238384bbf87f915870feb509.exedescription ioc process File opened for modification C:\Windows\SysWOW64\goodsb.dll 3a07bb569447b1b8f600469f51506a6360901ef8238384bbf87f915870feb509.exe File created C:\Windows\SysWOW64\goodsb.dll 3a07bb569447b1b8f600469f51506a6360901ef8238384bbf87f915870feb509.exe File created C:\Windows\SysWOW64\ws2tcpip.dll 3a07bb569447b1b8f600469f51506a6360901ef8238384bbf87f915870feb509.exe File opened for modification C:\Windows\SysWOW64\ws2tcpip.dll 3a07bb569447b1b8f600469f51506a6360901ef8238384bbf87f915870feb509.exe File created C:\Windows\SysWOW64\wshtcpip.dll 3a07bb569447b1b8f600469f51506a6360901ef8238384bbf87f915870feb509.exe -
Modifies registry class 4 IoCs
Processes:
3a07bb569447b1b8f600469f51506a6360901ef8238384bbf87f915870feb509.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\HOOK_ID 3a07bb569447b1b8f600469f51506a6360901ef8238384bbf87f915870feb509.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\HOOK_ID\name = "3a07bb569447b1b8f600469f51506a6360901ef8238384bbf87f915870feb509.exe" 3a07bb569447b1b8f600469f51506a6360901ef8238384bbf87f915870feb509.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\SYS_DLL 3a07bb569447b1b8f600469f51506a6360901ef8238384bbf87f915870feb509.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\SYS_DLL\name = "udeaHGw.dll" 3a07bb569447b1b8f600469f51506a6360901ef8238384bbf87f915870feb509.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
3a07bb569447b1b8f600469f51506a6360901ef8238384bbf87f915870feb509.exepid process 1672 3a07bb569447b1b8f600469f51506a6360901ef8238384bbf87f915870feb509.exe 1672 3a07bb569447b1b8f600469f51506a6360901ef8238384bbf87f915870feb509.exe 1672 3a07bb569447b1b8f600469f51506a6360901ef8238384bbf87f915870feb509.exe 1672 3a07bb569447b1b8f600469f51506a6360901ef8238384bbf87f915870feb509.exe 1672 3a07bb569447b1b8f600469f51506a6360901ef8238384bbf87f915870feb509.exe 1672 3a07bb569447b1b8f600469f51506a6360901ef8238384bbf87f915870feb509.exe 1672 3a07bb569447b1b8f600469f51506a6360901ef8238384bbf87f915870feb509.exe 1672 3a07bb569447b1b8f600469f51506a6360901ef8238384bbf87f915870feb509.exe 1672 3a07bb569447b1b8f600469f51506a6360901ef8238384bbf87f915870feb509.exe 1672 3a07bb569447b1b8f600469f51506a6360901ef8238384bbf87f915870feb509.exe 1672 3a07bb569447b1b8f600469f51506a6360901ef8238384bbf87f915870feb509.exe 1672 3a07bb569447b1b8f600469f51506a6360901ef8238384bbf87f915870feb509.exe 1672 3a07bb569447b1b8f600469f51506a6360901ef8238384bbf87f915870feb509.exe 1672 3a07bb569447b1b8f600469f51506a6360901ef8238384bbf87f915870feb509.exe 1672 3a07bb569447b1b8f600469f51506a6360901ef8238384bbf87f915870feb509.exe 1672 3a07bb569447b1b8f600469f51506a6360901ef8238384bbf87f915870feb509.exe 1672 3a07bb569447b1b8f600469f51506a6360901ef8238384bbf87f915870feb509.exe 1672 3a07bb569447b1b8f600469f51506a6360901ef8238384bbf87f915870feb509.exe 1672 3a07bb569447b1b8f600469f51506a6360901ef8238384bbf87f915870feb509.exe 1672 3a07bb569447b1b8f600469f51506a6360901ef8238384bbf87f915870feb509.exe 1672 3a07bb569447b1b8f600469f51506a6360901ef8238384bbf87f915870feb509.exe 1672 3a07bb569447b1b8f600469f51506a6360901ef8238384bbf87f915870feb509.exe 1672 3a07bb569447b1b8f600469f51506a6360901ef8238384bbf87f915870feb509.exe 1672 3a07bb569447b1b8f600469f51506a6360901ef8238384bbf87f915870feb509.exe 1672 3a07bb569447b1b8f600469f51506a6360901ef8238384bbf87f915870feb509.exe 1672 3a07bb569447b1b8f600469f51506a6360901ef8238384bbf87f915870feb509.exe 1672 3a07bb569447b1b8f600469f51506a6360901ef8238384bbf87f915870feb509.exe 1672 3a07bb569447b1b8f600469f51506a6360901ef8238384bbf87f915870feb509.exe 1672 3a07bb569447b1b8f600469f51506a6360901ef8238384bbf87f915870feb509.exe 1672 3a07bb569447b1b8f600469f51506a6360901ef8238384bbf87f915870feb509.exe 1672 3a07bb569447b1b8f600469f51506a6360901ef8238384bbf87f915870feb509.exe 1672 3a07bb569447b1b8f600469f51506a6360901ef8238384bbf87f915870feb509.exe 1672 3a07bb569447b1b8f600469f51506a6360901ef8238384bbf87f915870feb509.exe 1672 3a07bb569447b1b8f600469f51506a6360901ef8238384bbf87f915870feb509.exe 1672 3a07bb569447b1b8f600469f51506a6360901ef8238384bbf87f915870feb509.exe 1672 3a07bb569447b1b8f600469f51506a6360901ef8238384bbf87f915870feb509.exe 1672 3a07bb569447b1b8f600469f51506a6360901ef8238384bbf87f915870feb509.exe 1672 3a07bb569447b1b8f600469f51506a6360901ef8238384bbf87f915870feb509.exe 1672 3a07bb569447b1b8f600469f51506a6360901ef8238384bbf87f915870feb509.exe 1672 3a07bb569447b1b8f600469f51506a6360901ef8238384bbf87f915870feb509.exe 1672 3a07bb569447b1b8f600469f51506a6360901ef8238384bbf87f915870feb509.exe 1672 3a07bb569447b1b8f600469f51506a6360901ef8238384bbf87f915870feb509.exe 1672 3a07bb569447b1b8f600469f51506a6360901ef8238384bbf87f915870feb509.exe 1672 3a07bb569447b1b8f600469f51506a6360901ef8238384bbf87f915870feb509.exe 1672 3a07bb569447b1b8f600469f51506a6360901ef8238384bbf87f915870feb509.exe 1672 3a07bb569447b1b8f600469f51506a6360901ef8238384bbf87f915870feb509.exe 1672 3a07bb569447b1b8f600469f51506a6360901ef8238384bbf87f915870feb509.exe 1672 3a07bb569447b1b8f600469f51506a6360901ef8238384bbf87f915870feb509.exe 1672 3a07bb569447b1b8f600469f51506a6360901ef8238384bbf87f915870feb509.exe 1672 3a07bb569447b1b8f600469f51506a6360901ef8238384bbf87f915870feb509.exe 1672 3a07bb569447b1b8f600469f51506a6360901ef8238384bbf87f915870feb509.exe 1672 3a07bb569447b1b8f600469f51506a6360901ef8238384bbf87f915870feb509.exe 1672 3a07bb569447b1b8f600469f51506a6360901ef8238384bbf87f915870feb509.exe 1672 3a07bb569447b1b8f600469f51506a6360901ef8238384bbf87f915870feb509.exe 1672 3a07bb569447b1b8f600469f51506a6360901ef8238384bbf87f915870feb509.exe 1672 3a07bb569447b1b8f600469f51506a6360901ef8238384bbf87f915870feb509.exe 1672 3a07bb569447b1b8f600469f51506a6360901ef8238384bbf87f915870feb509.exe 1672 3a07bb569447b1b8f600469f51506a6360901ef8238384bbf87f915870feb509.exe 1672 3a07bb569447b1b8f600469f51506a6360901ef8238384bbf87f915870feb509.exe 1672 3a07bb569447b1b8f600469f51506a6360901ef8238384bbf87f915870feb509.exe 1672 3a07bb569447b1b8f600469f51506a6360901ef8238384bbf87f915870feb509.exe 1672 3a07bb569447b1b8f600469f51506a6360901ef8238384bbf87f915870feb509.exe 1672 3a07bb569447b1b8f600469f51506a6360901ef8238384bbf87f915870feb509.exe 1672 3a07bb569447b1b8f600469f51506a6360901ef8238384bbf87f915870feb509.exe -
Suspicious behavior: LoadsDriver 5 IoCs
Processes:
3a07bb569447b1b8f600469f51506a6360901ef8238384bbf87f915870feb509.exepid process 464 1672 3a07bb569447b1b8f600469f51506a6360901ef8238384bbf87f915870feb509.exe 464 1672 3a07bb569447b1b8f600469f51506a6360901ef8238384bbf87f915870feb509.exe 1672 3a07bb569447b1b8f600469f51506a6360901ef8238384bbf87f915870feb509.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
3a07bb569447b1b8f600469f51506a6360901ef8238384bbf87f915870feb509.exetakeown.exedescription pid process Token: SeDebugPrivilege 1672 3a07bb569447b1b8f600469f51506a6360901ef8238384bbf87f915870feb509.exe Token: SeTakeOwnershipPrivilege 824 takeown.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
3a07bb569447b1b8f600469f51506a6360901ef8238384bbf87f915870feb509.execmd.exedescription pid process target process PID 1672 wrote to memory of 864 1672 3a07bb569447b1b8f600469f51506a6360901ef8238384bbf87f915870feb509.exe cmd.exe PID 1672 wrote to memory of 864 1672 3a07bb569447b1b8f600469f51506a6360901ef8238384bbf87f915870feb509.exe cmd.exe PID 1672 wrote to memory of 864 1672 3a07bb569447b1b8f600469f51506a6360901ef8238384bbf87f915870feb509.exe cmd.exe PID 1672 wrote to memory of 864 1672 3a07bb569447b1b8f600469f51506a6360901ef8238384bbf87f915870feb509.exe cmd.exe PID 864 wrote to memory of 824 864 cmd.exe takeown.exe PID 864 wrote to memory of 824 864 cmd.exe takeown.exe PID 864 wrote to memory of 824 864 cmd.exe takeown.exe PID 864 wrote to memory of 824 864 cmd.exe takeown.exe PID 864 wrote to memory of 992 864 cmd.exe icacls.exe PID 864 wrote to memory of 992 864 cmd.exe icacls.exe PID 864 wrote to memory of 992 864 cmd.exe icacls.exe PID 864 wrote to memory of 992 864 cmd.exe icacls.exe PID 1672 wrote to memory of 692 1672 3a07bb569447b1b8f600469f51506a6360901ef8238384bbf87f915870feb509.exe cmd.exe PID 1672 wrote to memory of 692 1672 3a07bb569447b1b8f600469f51506a6360901ef8238384bbf87f915870feb509.exe cmd.exe PID 1672 wrote to memory of 692 1672 3a07bb569447b1b8f600469f51506a6360901ef8238384bbf87f915870feb509.exe cmd.exe PID 1672 wrote to memory of 692 1672 3a07bb569447b1b8f600469f51506a6360901ef8238384bbf87f915870feb509.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3a07bb569447b1b8f600469f51506a6360901ef8238384bbf87f915870feb509.exe"C:\Users\Admin\AppData\Local\Temp\3a07bb569447b1b8f600469f51506a6360901ef8238384bbf87f915870feb509.exe"1⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Windows\SysWOW64\cmd.execmd.exe /c takeown /f C:\Windows\SysWOW64\wshtcpip.dll && icacls C:\Windows\SysWOW64\wshtcpip.dll /grant administrators:F2⤵
- Suspicious use of WriteProcessMemory
PID:864 -
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\SysWOW64\wshtcpip.dll3⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:824 -
C:\Windows\SysWOW64\icacls.exeicacls C:\Windows\SysWOW64\wshtcpip.dll /grant administrators:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:992 -
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\ahnmove.bat2⤵
- Deletes itself
PID:692
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\ahnmove.batFilesize
181B
MD50e67f9a023c0212874237a1212b77cf1
SHA1ab0b1a813ae173ec43e315fc32f52fd545f50ad2
SHA2563f0dac04dcd6ac21d875d91f42d9bae52be11ec8f7ae9a33d52eac8ba149bb26
SHA5121b4a06b2a1882bae6a2467d8b7420d2dde8cd688e8068acc6c13f50845c1375abb104d9fff88bbbd9121f93eb61e0ee35451a3a5788779f6145251bb3bdd6433
-
memory/692-59-0x0000000000000000-mapping.dmp
-
memory/824-57-0x0000000000000000-mapping.dmp
-
memory/864-56-0x0000000000000000-mapping.dmp
-
memory/992-58-0x0000000000000000-mapping.dmp
-
memory/1672-54-0x0000000075111000-0x0000000075113000-memory.dmpFilesize
8KB
-
memory/1672-55-0x0000000001000000-0x000000000112D000-memory.dmpFilesize
1.2MB
-
memory/1672-60-0x0000000001000000-0x000000000112D000-memory.dmpFilesize
1.2MB