6b0779c26c858893b465a597c9601adb98515cb437cb11582d39116c4e598608

General

Target

6b0779c26c858893b465a597c9601adb98515cb437cb11582d39116c4e598608.exe
Size

350KB
MD5

40bc8153b39b1e4a540e84199f88af70
SHA1

03aac859a49f7ab2619d364434ff47fef8575d47
SHA256

6b0779c26c858893b465a597c9601adb98515cb437cb11582d39116c4e598608
SHA512

836d1c87ef743bff940b53abdc2815575cd30565fac032611134fcdc30519c1f2b59ea42bcdd3cd753b61c31d41e3df2cf32110d5462bd524ed055b6e6a52239
SSDEEP

6144:ayXu7IEBSsQ9ElMwm60lmqs7MTRGA3h3GVqdppJXEGhBukJF/KAwxFUOWdEmh:a3BdQLL4BE93NGVYZX9BukJlwxSJdEm

Score

8^/10

adware discovery exploit persistence stealer upx

Malware Config

Signatures

Drops file in Drivers directory 2 IoCs

Processes:

6b0779c26c858893b465a597c9601adb98515cb437cb11582d39116c4e598608.exe

description	ioc	process
File created	C:\Windows\SysWOW64\drivers\58b1e03f.sys	6b0779c26c858893b465a597c9601adb98515cb437cb11582d39116c4e598608.exe
File created	C:\Windows\SysWOW64\drivers\241ad5b9.sys	6b0779c26c858893b465a597c9601adb98515cb437cb11582d39116c4e598608.exe

Possible privilege escalation attempt 2 IoCs
exploit

Processes:

takeown.exeicacls.exe

pid process

876 takeown.exe
900 icacls.exe

pid	process
876	takeown.exe
900	icacls.exe

Sets service image path in registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

6b0779c26c858893b465a597c9601adb98515cb437cb11582d39116c4e598608.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\58b1e03f\ImagePath = "\\??\\C:\\Windows\\SysWOW64\\drivers\\58b1e03f.sys"	6b0779c26c858893b465a597c9601adb98515cb437cb11582d39116c4e598608.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\241ad5b9\ImagePath = "\\??\\C:\\Windows\\SysWOW64\\drivers\\241ad5b9.sys"	6b0779c26c858893b465a597c9601adb98515cb437cb11582d39116c4e598608.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/4180-132-0x0000000001000000-0x000000000112D000-memory.dmp	upx
behavioral2/memory/4180-138-0x0000000001000000-0x000000000112D000-memory.dmp	upx

Modifies file permissions 1 TTPs 2 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exetakeown.exe

pid process

900 icacls.exe
876 takeown.exe

pid	process
900	icacls.exe
876	takeown.exe

Installs/modifies Browser Helper Object 2 TTPs 3 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

Processes:

6b0779c26c858893b465a597c9601adb98515cb437cb11582d39116c4e598608.exe

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}	6b0779c26c858893b465a597c9601adb98515cb437cb11582d39116c4e598608.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}	6b0779c26c858893b465a597c9601adb98515cb437cb11582d39116c4e598608.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	6b0779c26c858893b465a597c9601adb98515cb437cb11582d39116c4e598608.exe

Drops file in System32 directory 5 IoCs

Processes:

6b0779c26c858893b465a597c9601adb98515cb437cb11582d39116c4e598608.exe

description	ioc	process
File created	C:\Windows\SysWOW64\ws2tcpip.dll	6b0779c26c858893b465a597c9601adb98515cb437cb11582d39116c4e598608.exe
File opened for modification	C:\Windows\SysWOW64\ws2tcpip.dll	6b0779c26c858893b465a597c9601adb98515cb437cb11582d39116c4e598608.exe
File created	C:\Windows\SysWOW64\wshtcpip.dll	6b0779c26c858893b465a597c9601adb98515cb437cb11582d39116c4e598608.exe
File opened for modification	C:\Windows\SysWOW64\goodsb.dll	6b0779c26c858893b465a597c9601adb98515cb437cb11582d39116c4e598608.exe
File created	C:\Windows\SysWOW64\goodsb.dll	6b0779c26c858893b465a597c9601adb98515cb437cb11582d39116c4e598608.exe

Modifies registry class 4 IoCs

Processes:

6b0779c26c858893b465a597c9601adb98515cb437cb11582d39116c4e598608.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\HOOK_ID	6b0779c26c858893b465a597c9601adb98515cb437cb11582d39116c4e598608.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\HOOK_ID\name = "6b0779c26c858893b465a597c9601adb98515cb437cb11582d39116c4e598608.exe"	6b0779c26c858893b465a597c9601adb98515cb437cb11582d39116c4e598608.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\SYS_DLL	6b0779c26c858893b465a597c9601adb98515cb437cb11582d39116c4e598608.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\SYS_DLL\name = "hfH.dll"	6b0779c26c858893b465a597c9601adb98515cb437cb11582d39116c4e598608.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

6b0779c26c858893b465a597c9601adb98515cb437cb11582d39116c4e598608.exe

pid	process
4180	6b0779c26c858893b465a597c9601adb98515cb437cb11582d39116c4e598608.exe
4180	6b0779c26c858893b465a597c9601adb98515cb437cb11582d39116c4e598608.exe
4180	6b0779c26c858893b465a597c9601adb98515cb437cb11582d39116c4e598608.exe
4180	6b0779c26c858893b465a597c9601adb98515cb437cb11582d39116c4e598608.exe
4180	6b0779c26c858893b465a597c9601adb98515cb437cb11582d39116c4e598608.exe
4180	6b0779c26c858893b465a597c9601adb98515cb437cb11582d39116c4e598608.exe
4180	6b0779c26c858893b465a597c9601adb98515cb437cb11582d39116c4e598608.exe
4180	6b0779c26c858893b465a597c9601adb98515cb437cb11582d39116c4e598608.exe
4180	6b0779c26c858893b465a597c9601adb98515cb437cb11582d39116c4e598608.exe
4180	6b0779c26c858893b465a597c9601adb98515cb437cb11582d39116c4e598608.exe
4180	6b0779c26c858893b465a597c9601adb98515cb437cb11582d39116c4e598608.exe
4180	6b0779c26c858893b465a597c9601adb98515cb437cb11582d39116c4e598608.exe
4180	6b0779c26c858893b465a597c9601adb98515cb437cb11582d39116c4e598608.exe
4180	6b0779c26c858893b465a597c9601adb98515cb437cb11582d39116c4e598608.exe
4180	6b0779c26c858893b465a597c9601adb98515cb437cb11582d39116c4e598608.exe
4180	6b0779c26c858893b465a597c9601adb98515cb437cb11582d39116c4e598608.exe
4180	6b0779c26c858893b465a597c9601adb98515cb437cb11582d39116c4e598608.exe
4180	6b0779c26c858893b465a597c9601adb98515cb437cb11582d39116c4e598608.exe
4180	6b0779c26c858893b465a597c9601adb98515cb437cb11582d39116c4e598608.exe
4180	6b0779c26c858893b465a597c9601adb98515cb437cb11582d39116c4e598608.exe
4180	6b0779c26c858893b465a597c9601adb98515cb437cb11582d39116c4e598608.exe
4180	6b0779c26c858893b465a597c9601adb98515cb437cb11582d39116c4e598608.exe
4180	6b0779c26c858893b465a597c9601adb98515cb437cb11582d39116c4e598608.exe
4180	6b0779c26c858893b465a597c9601adb98515cb437cb11582d39116c4e598608.exe
4180	6b0779c26c858893b465a597c9601adb98515cb437cb11582d39116c4e598608.exe
4180	6b0779c26c858893b465a597c9601adb98515cb437cb11582d39116c4e598608.exe
4180	6b0779c26c858893b465a597c9601adb98515cb437cb11582d39116c4e598608.exe
4180	6b0779c26c858893b465a597c9601adb98515cb437cb11582d39116c4e598608.exe
4180	6b0779c26c858893b465a597c9601adb98515cb437cb11582d39116c4e598608.exe
4180	6b0779c26c858893b465a597c9601adb98515cb437cb11582d39116c4e598608.exe
4180	6b0779c26c858893b465a597c9601adb98515cb437cb11582d39116c4e598608.exe
4180	6b0779c26c858893b465a597c9601adb98515cb437cb11582d39116c4e598608.exe
4180	6b0779c26c858893b465a597c9601adb98515cb437cb11582d39116c4e598608.exe
4180	6b0779c26c858893b465a597c9601adb98515cb437cb11582d39116c4e598608.exe
4180	6b0779c26c858893b465a597c9601adb98515cb437cb11582d39116c4e598608.exe
4180	6b0779c26c858893b465a597c9601adb98515cb437cb11582d39116c4e598608.exe
4180	6b0779c26c858893b465a597c9601adb98515cb437cb11582d39116c4e598608.exe
4180	6b0779c26c858893b465a597c9601adb98515cb437cb11582d39116c4e598608.exe
4180	6b0779c26c858893b465a597c9601adb98515cb437cb11582d39116c4e598608.exe
4180	6b0779c26c858893b465a597c9601adb98515cb437cb11582d39116c4e598608.exe
4180	6b0779c26c858893b465a597c9601adb98515cb437cb11582d39116c4e598608.exe
4180	6b0779c26c858893b465a597c9601adb98515cb437cb11582d39116c4e598608.exe
4180	6b0779c26c858893b465a597c9601adb98515cb437cb11582d39116c4e598608.exe
4180	6b0779c26c858893b465a597c9601adb98515cb437cb11582d39116c4e598608.exe
4180	6b0779c26c858893b465a597c9601adb98515cb437cb11582d39116c4e598608.exe
4180	6b0779c26c858893b465a597c9601adb98515cb437cb11582d39116c4e598608.exe
4180	6b0779c26c858893b465a597c9601adb98515cb437cb11582d39116c4e598608.exe
4180	6b0779c26c858893b465a597c9601adb98515cb437cb11582d39116c4e598608.exe
4180	6b0779c26c858893b465a597c9601adb98515cb437cb11582d39116c4e598608.exe
4180	6b0779c26c858893b465a597c9601adb98515cb437cb11582d39116c4e598608.exe
4180	6b0779c26c858893b465a597c9601adb98515cb437cb11582d39116c4e598608.exe
4180	6b0779c26c858893b465a597c9601adb98515cb437cb11582d39116c4e598608.exe
4180	6b0779c26c858893b465a597c9601adb98515cb437cb11582d39116c4e598608.exe
4180	6b0779c26c858893b465a597c9601adb98515cb437cb11582d39116c4e598608.exe
4180	6b0779c26c858893b465a597c9601adb98515cb437cb11582d39116c4e598608.exe
4180	6b0779c26c858893b465a597c9601adb98515cb437cb11582d39116c4e598608.exe
4180	6b0779c26c858893b465a597c9601adb98515cb437cb11582d39116c4e598608.exe
4180	6b0779c26c858893b465a597c9601adb98515cb437cb11582d39116c4e598608.exe
4180	6b0779c26c858893b465a597c9601adb98515cb437cb11582d39116c4e598608.exe
4180	6b0779c26c858893b465a597c9601adb98515cb437cb11582d39116c4e598608.exe
4180	6b0779c26c858893b465a597c9601adb98515cb437cb11582d39116c4e598608.exe
4180	6b0779c26c858893b465a597c9601adb98515cb437cb11582d39116c4e598608.exe
4180	6b0779c26c858893b465a597c9601adb98515cb437cb11582d39116c4e598608.exe
4180	6b0779c26c858893b465a597c9601adb98515cb437cb11582d39116c4e598608.exe

Suspicious behavior: LoadsDriver 5 IoCs

Processes:

6b0779c26c858893b465a597c9601adb98515cb437cb11582d39116c4e598608.exe

pid	process
660
4180	6b0779c26c858893b465a597c9601adb98515cb437cb11582d39116c4e598608.exe
660
4180	6b0779c26c858893b465a597c9601adb98515cb437cb11582d39116c4e598608.exe
4180	6b0779c26c858893b465a597c9601adb98515cb437cb11582d39116c4e598608.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

6b0779c26c858893b465a597c9601adb98515cb437cb11582d39116c4e598608.exetakeown.exe

description	pid	process
Token: SeDebugPrivilege	4180	6b0779c26c858893b465a597c9601adb98515cb437cb11582d39116c4e598608.exe
Token: SeTakeOwnershipPrivilege	876	takeown.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

6b0779c26c858893b465a597c9601adb98515cb437cb11582d39116c4e598608.execmd.exe

description	pid	process	target process
PID 4180 wrote to memory of 32	4180	6b0779c26c858893b465a597c9601adb98515cb437cb11582d39116c4e598608.exe	cmd.exe
PID 4180 wrote to memory of 32	4180	6b0779c26c858893b465a597c9601adb98515cb437cb11582d39116c4e598608.exe	cmd.exe
PID 4180 wrote to memory of 32	4180	6b0779c26c858893b465a597c9601adb98515cb437cb11582d39116c4e598608.exe	cmd.exe
PID 32 wrote to memory of 876	32	cmd.exe	takeown.exe
PID 32 wrote to memory of 876	32	cmd.exe	takeown.exe
PID 32 wrote to memory of 876	32	cmd.exe	takeown.exe
PID 32 wrote to memory of 900	32	cmd.exe	icacls.exe
PID 32 wrote to memory of 900	32	cmd.exe	icacls.exe
PID 32 wrote to memory of 900	32	cmd.exe	icacls.exe
PID 4180 wrote to memory of 4072	4180	6b0779c26c858893b465a597c9601adb98515cb437cb11582d39116c4e598608.exe	cmd.exe
PID 4180 wrote to memory of 4072	4180	6b0779c26c858893b465a597c9601adb98515cb437cb11582d39116c4e598608.exe	cmd.exe
PID 4180 wrote to memory of 4072	4180	6b0779c26c858893b465a597c9601adb98515cb437cb11582d39116c4e598608.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\6b0779c26c858893b465a597c9601adb98515cb437cb11582d39116c4e598608.exe
"C:\Users\Admin\AppData\Local\Temp\6b0779c26c858893b465a597c9601adb98515cb437cb11582d39116c4e598608.exe"
1⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4180

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c takeown /f C:\Windows\SysWOW64\wshtcpip.dll && icacls C:\Windows\SysWOW64\wshtcpip.dll /grant administrators:F
2⤵
- Suspicious use of WriteProcessMemory
PID:32

C:\Windows\SysWOW64\takeown.exe
takeown /f C:\Windows\SysWOW64\wshtcpip.dll
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:876

C:\Windows\SysWOW64\icacls.exe
icacls C:\Windows\SysWOW64\wshtcpip.dll /grant administrators:F
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:900

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ahnmove.bat
2⤵
PID:4072

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Browser Extensions

1

T1176

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ahnmove.bat
Filesize
181B

MD5
72751f0786f8e9fb9e4172a7be17dcc3

SHA1
5bfc66e1a37d3d6914c5ac3e6d59dbe40de19b8f

SHA256
897e2e6e8ae212a7e1d2ecb805920582c7e58bbc44485804af56e6f4711360ab

SHA512
9b4f16e8f8909a30e0d211c89bb061c474d00b9f570a596a9e0968ffefbc07793e0e5e7d001ef13cfb1f5f8516e8391611f33924a015680afe15deb397e029e8

Download Submit
memory/32-133-0x0000000000000000-mapping.dmp

Download
memory/876-134-0x0000000000000000-mapping.dmp

Download
memory/900-135-0x0000000000000000-mapping.dmp

Download
memory/4072-136-0x0000000000000000-mapping.dmp

Download
memory/4180-132-0x0000000001000000-0x000000000112D000-memory.dmp

Filesize
1.2MB

Download
memory/4180-138-0x0000000001000000-0x000000000112D000-memory.dmp

Filesize
1.2MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads