Analysis
-
max time kernel
143s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
20-11-2022 04:55
Behavioral task
behavioral1
Sample
d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe
Resource
win7-20221111-en
General
-
Target
d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe
-
Size
350KB
-
MD5
41fd9ad511080c4aaaed93095d3d3b10
-
SHA1
7f4d8dfb8b6c6ef4b9c1802825a7f743961d7606
-
SHA256
d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112
-
SHA512
8e2f013ce932c8a7e275e9804136c10082b6fed359a8408c8d4d78bc0d23b3509ddd50700c9a89c40804fa3ee6d9592064f71af756515651fcc88573e33ab3ab
-
SSDEEP
6144:yyXu7IEBSsQ9ElMwm60lmqs7MTRGA3h3GVqdppJXEGhBukJF/KAwxFUOWdEmh:y3BdQLL4BE93NGVYZX9BukJlwxSJdEm
Malware Config
Signatures
-
Drops file in Drivers directory 2 IoCs
Processes:
d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exedescription ioc process File created C:\Windows\SysWOW64\drivers\78c6d838.sys d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe File created C:\Windows\SysWOW64\drivers\046dedbe.sys d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe -
Possible privilege escalation attempt 2 IoCs
Processes:
takeown.exeicacls.exepid process 4832 takeown.exe 3436 icacls.exe -
Sets service image path in registry 2 TTPs 2 IoCs
Processes:
d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\78c6d838\ImagePath = "\\??\\C:\\Windows\\SysWOW64\\drivers\\78c6d838.sys" d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\046dedbe\ImagePath = "\\??\\C:\\Windows\\SysWOW64\\drivers\\046dedbe.sys" d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe -
Processes:
resource yara_rule behavioral2/memory/4988-132-0x0000000001000000-0x000000000112D000-memory.dmp upx behavioral2/memory/4988-133-0x0000000001000000-0x000000000112D000-memory.dmp upx behavioral2/memory/4988-139-0x0000000001000000-0x000000000112D000-memory.dmp upx -
Modifies file permissions 1 TTPs 2 IoCs
Processes:
takeown.exeicacls.exepid process 4832 takeown.exe 3436 icacls.exe -
Installs/modifies Browser Helper Object 2 TTPs 3 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
Processes:
d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exedescription ioc process Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA} d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C} d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe -
Drops file in System32 directory 5 IoCs
Processes:
d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exedescription ioc process File opened for modification C:\Windows\SysWOW64\goodsb.dll d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe File created C:\Windows\SysWOW64\goodsb.dll d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe File created C:\Windows\SysWOW64\ws2tcpip.dll d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe File opened for modification C:\Windows\SysWOW64\ws2tcpip.dll d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe File created C:\Windows\SysWOW64\wshtcpip.dll d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe -
Modifies registry class 4 IoCs
Processes:
d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\HOOK_ID d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\HOOK_ID\name = "d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe" d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\SYS_DLL d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\SYS_DLL\name = "7yhqfghDD.dll" d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exepid process 4988 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe 4988 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe 4988 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe 4988 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe 4988 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe 4988 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe 4988 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe 4988 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe 4988 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe 4988 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe 4988 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe 4988 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe 4988 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe 4988 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe 4988 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe 4988 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe 4988 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe 4988 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe 4988 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe 4988 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe 4988 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe 4988 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe 4988 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe 4988 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe 4988 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe 4988 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe 4988 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe 4988 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe 4988 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe 4988 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe 4988 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe 4988 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe 4988 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe 4988 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe 4988 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe 4988 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe 4988 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe 4988 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe 4988 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe 4988 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe 4988 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe 4988 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe 4988 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe 4988 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe 4988 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe 4988 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe 4988 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe 4988 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe 4988 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe 4988 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe 4988 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe 4988 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe 4988 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe 4988 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe 4988 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe 4988 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe 4988 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe 4988 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe 4988 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe 4988 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe 4988 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe 4988 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe 4988 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe 4988 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe -
Suspicious behavior: LoadsDriver 5 IoCs
Processes:
d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exepid process 660 4988 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe 660 4988 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe 4988 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exetakeown.exedescription pid process Token: SeDebugPrivilege 4988 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe Token: SeTakeOwnershipPrivilege 4832 takeown.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.execmd.exedescription pid process target process PID 4988 wrote to memory of 5052 4988 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe cmd.exe PID 4988 wrote to memory of 5052 4988 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe cmd.exe PID 4988 wrote to memory of 5052 4988 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe cmd.exe PID 5052 wrote to memory of 4832 5052 cmd.exe takeown.exe PID 5052 wrote to memory of 4832 5052 cmd.exe takeown.exe PID 5052 wrote to memory of 4832 5052 cmd.exe takeown.exe PID 5052 wrote to memory of 3436 5052 cmd.exe icacls.exe PID 5052 wrote to memory of 3436 5052 cmd.exe icacls.exe PID 5052 wrote to memory of 3436 5052 cmd.exe icacls.exe PID 4988 wrote to memory of 3964 4988 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe cmd.exe PID 4988 wrote to memory of 3964 4988 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe cmd.exe PID 4988 wrote to memory of 3964 4988 d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe"C:\Users\Admin\AppData\Local\Temp\d22c2be51947e4a6e99a55afcf2459c2934556883fe60a1fd6b37f1885676112.exe"1⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /c takeown /f C:\Windows\SysWOW64\wshtcpip.dll && icacls C:\Windows\SysWOW64\wshtcpip.dll /grant administrators:F2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\SysWOW64\wshtcpip.dll3⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\icacls.exeicacls C:\Windows\SysWOW64\wshtcpip.dll /grant administrators:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ahnmove.bat2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\ahnmove.batFilesize
181B
MD5a4ac4fb1129c41fc9751e629021f1a8c
SHA1d5e2af78e6ba8dc23c6e60b1a7e2e2a524a401df
SHA256d845982a5fe5ed86802a1b357c5524a1b88afe842bfb85bd32dc6eaea9b7ec99
SHA51208577a7fcfd7b0c27d3e23cd3674fc99bdfcea6f40997cbdf0496638f1feb7ff3fbd68a93d1358d294a4c425624b6b7d9747c5c17fd032953c920ba3329b3b51
-
memory/3436-136-0x0000000000000000-mapping.dmp
-
memory/3964-137-0x0000000000000000-mapping.dmp
-
memory/4832-135-0x0000000000000000-mapping.dmp
-
memory/4988-132-0x0000000001000000-0x000000000112D000-memory.dmpFilesize
1.2MB
-
memory/4988-133-0x0000000001000000-0x000000000112D000-memory.dmpFilesize
1.2MB
-
memory/4988-139-0x0000000001000000-0x000000000112D000-memory.dmpFilesize
1.2MB
-
memory/5052-134-0x0000000000000000-mapping.dmp