Analysis
-
max time kernel
53s -
max time network
41s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
20-11-2022 04:55
Behavioral task
behavioral1
Sample
d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe
Resource
win7-20221111-en
General
-
Target
d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe
-
Size
350KB
-
MD5
41fd9ad511080c4aaaed93095d3d3b10
-
SHA1
7f4d8dfb8b6c6ef4b9c1802825a7f743961d7606
-
SHA256
d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112
-
SHA512
8e2f013ce932c8a7e275e9804136c10082b6fed359a8408c8d4d78bc0d23b3509ddd50700c9a89c40804fa3ee6d9592064f71af756515651fcc88573e33ab3ab
-
SSDEEP
6144:yyXu7IEBSsQ9ElMwm60lmqs7MTRGA3h3GVqdppJXEGhBukJF/KAwxFUOWdEmh:y3BdQLL4BE93NGVYZX9BukJlwxSJdEm
Malware Config
Signatures
-
Drops file in Drivers directory 2 IoCs
Processes:
d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exedescription ioc process File created C:\Windows\SysWOW64\drivers\72a89918.sys d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe File created C:\Windows\SysWOW64\drivers\0e03ac9e.sys d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe -
Possible privilege escalation attempt 2 IoCs
Processes:
icacls.exetakeown.exepid process 552 icacls.exe 1468 takeown.exe -
Sets service image path in registry 2 TTPs 2 IoCs
Processes:
d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\72a89918\ImagePath = "\\??\\C:\\Windows\\SysWOW64\\drivers\\72a89918.sys" d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\0e03ac9e\ImagePath = "\\??\\C:\\Windows\\SysWOW64\\drivers\\0e03ac9e.sys" d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe -
Processes:
resource yara_rule behavioral1/memory/964-55-0x0000000001000000-0x000000000112D000-memory.dmp upx behavioral1/memory/964-60-0x0000000001000000-0x000000000112D000-memory.dmp upx -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1648 cmd.exe -
Modifies file permissions 1 TTPs 2 IoCs
Processes:
takeown.exeicacls.exepid process 1468 takeown.exe 552 icacls.exe -
Installs/modifies Browser Helper Object 2 TTPs 4 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
Processes:
d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exedescription ioc process Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF} d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E} d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3} d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe -
Drops file in System32 directory 5 IoCs
Processes:
d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exedescription ioc process File created C:\Windows\SysWOW64\ws2tcpip.dll d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe File opened for modification C:\Windows\SysWOW64\ws2tcpip.dll d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe File created C:\Windows\SysWOW64\wshtcpip.dll d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe File opened for modification C:\Windows\SysWOW64\goodsb.dll d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe File created C:\Windows\SysWOW64\goodsb.dll d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe -
Modifies registry class 4 IoCs
Processes:
d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\HOOK_ID\name = "d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe" d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\SYS_DLL d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\SYS_DLL\name = "f8auq7.dll" d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\HOOK_ID d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exepid process 964 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe 964 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe 964 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe 964 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe 964 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe 964 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe 964 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe 964 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe 964 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe 964 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe 964 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe 964 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe 964 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe 964 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe 964 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe 964 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe 964 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe 964 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe 964 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe 964 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe 964 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe 964 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe 964 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe 964 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe 964 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe 964 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe 964 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe 964 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe 964 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe 964 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe 964 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe 964 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe 964 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe 964 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe 964 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe 964 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe 964 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe 964 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe 964 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe 964 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe 964 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe 964 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe 964 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe 964 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe 964 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe 964 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe 964 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe 964 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe 964 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe 964 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe 964 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe 964 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe 964 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe 964 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe 964 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe 964 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe 964 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe 964 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe 964 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe 964 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe 964 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe 964 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe 964 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe 964 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe -
Suspicious behavior: LoadsDriver 5 IoCs
Processes:
d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exepid process 464 964 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe 464 964 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe 964 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exetakeown.exedescription pid process Token: SeDebugPrivilege 964 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe Token: SeTakeOwnershipPrivilege 1468 takeown.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.execmd.exedescription pid process target process PID 964 wrote to memory of 1504 964 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe cmd.exe PID 964 wrote to memory of 1504 964 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe cmd.exe PID 964 wrote to memory of 1504 964 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe cmd.exe PID 964 wrote to memory of 1504 964 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe cmd.exe PID 1504 wrote to memory of 1468 1504 cmd.exe takeown.exe PID 1504 wrote to memory of 1468 1504 cmd.exe takeown.exe PID 1504 wrote to memory of 1468 1504 cmd.exe takeown.exe PID 1504 wrote to memory of 1468 1504 cmd.exe takeown.exe PID 1504 wrote to memory of 552 1504 cmd.exe icacls.exe PID 1504 wrote to memory of 552 1504 cmd.exe icacls.exe PID 1504 wrote to memory of 552 1504 cmd.exe icacls.exe PID 1504 wrote to memory of 552 1504 cmd.exe icacls.exe PID 964 wrote to memory of 1648 964 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe cmd.exe PID 964 wrote to memory of 1648 964 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe cmd.exe PID 964 wrote to memory of 1648 964 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe cmd.exe PID 964 wrote to memory of 1648 964 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe"C:\Users\Admin\AppData\Local\Temp\d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe"1⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /c takeown /f C:\Windows\SysWOW64\wshtcpip.dll && icacls C:\Windows\SysWOW64\wshtcpip.dll /grant administrators:F2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\SysWOW64\wshtcpip.dll3⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\icacls.exeicacls C:\Windows\SysWOW64\wshtcpip.dll /grant administrators:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\ahnmove.bat2⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\ahnmove.batFilesize
181B
MD5a4ac4fb1129c41fc9751e629021f1a8c
SHA1d5e2af78e6ba8dc23c6e60b1a7e2e2a524a401df
SHA256d845982a5fe5ed86802a1b357c5524a1b88afe842bfb85bd32dc6eaea9b7ec99
SHA51208577a7fcfd7b0c27d3e23cd3674fc99bdfcea6f40997cbdf0496638f1feb7ff3fbd68a93d1358d294a4c425624b6b7d9747c5c17fd032953c920ba3329b3b51
-
memory/552-58-0x0000000000000000-mapping.dmp
-
memory/964-54-0x0000000076411000-0x0000000076413000-memory.dmpFilesize
8KB
-
memory/964-55-0x0000000001000000-0x000000000112D000-memory.dmpFilesize
1.2MB
-
memory/964-60-0x0000000001000000-0x000000000112D000-memory.dmpFilesize
1.2MB
-
memory/1468-57-0x0000000000000000-mapping.dmp
-
memory/1504-56-0x0000000000000000-mapping.dmp
-
memory/1648-59-0x0000000000000000-mapping.dmp