97e71e8473db7d2f5f0b7f9fc797b35c9443022f4c4e7414e67fe05b6d67cb80

General

Target

97e71e8473db7d2f5f0b7f9fc797b35c9443022f4c4e7414e67fe05b6d67cb80.exe
Size

350KB
MD5

481372eb5aa7bdefca915f76943f9d00
SHA1

062719427aa3baab3869212cd05f84b69cea6e6e
SHA256

97e71e8473db7d2f5f0b7f9fc797b35c9443022f4c4e7414e67fe05b6d67cb80
SHA512

19fcd4925f6b54813282a76db12057d8be95ec656c834333a6f2dcaadbf8168c71aa68f7cfaf5e377e89e36a82899997dfde67341c4a0fccc0b8f144609a8f77
SSDEEP

6144:9yXu7IEBSsQ9ElMwm60lmqs7MTRGA3h3GVqdppJXEGhBukJF/KAwxFUOWdEmh:93BdQLL4BE93NGVYZX9BukJlwxSJdEm

Score

8^/10

adware discovery exploit persistence stealer upx

Malware Config

Signatures

Drops file in Drivers directory 2 IoCs

Processes:

97e71e8473db7d2f5f0b7f9fc797b35c9443022f4c4e7414e67fe05b6d67cb80.exe

description	ioc	process
File created	C:\Windows\SysWOW64\drivers\7e1593ff.sys	97e71e8473db7d2f5f0b7f9fc797b35c9443022f4c4e7414e67fe05b6d67cb80.exe
File created	C:\Windows\SysWOW64\drivers\02bea679.sys	97e71e8473db7d2f5f0b7f9fc797b35c9443022f4c4e7414e67fe05b6d67cb80.exe

Possible privilege escalation attempt 2 IoCs
exploit

Processes:

takeown.exeicacls.exe

pid process

1120 takeown.exe
324 icacls.exe

pid	process
1120	takeown.exe
324	icacls.exe

Sets service image path in registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

97e71e8473db7d2f5f0b7f9fc797b35c9443022f4c4e7414e67fe05b6d67cb80.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\7e1593ff\ImagePath = "\\??\\C:\\Windows\\SysWOW64\\drivers\\7e1593ff.sys"	97e71e8473db7d2f5f0b7f9fc797b35c9443022f4c4e7414e67fe05b6d67cb80.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\02bea679\ImagePath = "\\??\\C:\\Windows\\SysWOW64\\drivers\\02bea679.sys"	97e71e8473db7d2f5f0b7f9fc797b35c9443022f4c4e7414e67fe05b6d67cb80.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1148-55-0x0000000001000000-0x000000000112D000-memory.dmp	upx
behavioral1/memory/1148-60-0x0000000001000000-0x000000000112D000-memory.dmp	upx

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

652 cmd.exe
Modifies file permissions 1 TTPs 2 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

takeown.exeicacls.exe

pid process

1120 takeown.exe
324 icacls.exe

pid	process
652	cmd.exe

pid	process
1120	takeown.exe
324	icacls.exe

Installs/modifies Browser Helper Object 2 TTPs 4 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

Processes:

97e71e8473db7d2f5f0b7f9fc797b35c9443022f4c4e7414e67fe05b6d67cb80.exe

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}	97e71e8473db7d2f5f0b7f9fc797b35c9443022f4c4e7414e67fe05b6d67cb80.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}	97e71e8473db7d2f5f0b7f9fc797b35c9443022f4c4e7414e67fe05b6d67cb80.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}	97e71e8473db7d2f5f0b7f9fc797b35c9443022f4c4e7414e67fe05b6d67cb80.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects	97e71e8473db7d2f5f0b7f9fc797b35c9443022f4c4e7414e67fe05b6d67cb80.exe

Drops file in System32 directory 5 IoCs

Processes:

97e71e8473db7d2f5f0b7f9fc797b35c9443022f4c4e7414e67fe05b6d67cb80.exe

description	ioc	process
File created	C:\Windows\SysWOW64\ws2tcpip.dll	97e71e8473db7d2f5f0b7f9fc797b35c9443022f4c4e7414e67fe05b6d67cb80.exe
File opened for modification	C:\Windows\SysWOW64\ws2tcpip.dll	97e71e8473db7d2f5f0b7f9fc797b35c9443022f4c4e7414e67fe05b6d67cb80.exe
File created	C:\Windows\SysWOW64\wshtcpip.dll	97e71e8473db7d2f5f0b7f9fc797b35c9443022f4c4e7414e67fe05b6d67cb80.exe
File opened for modification	C:\Windows\SysWOW64\goodsb.dll	97e71e8473db7d2f5f0b7f9fc797b35c9443022f4c4e7414e67fe05b6d67cb80.exe
File created	C:\Windows\SysWOW64\goodsb.dll	97e71e8473db7d2f5f0b7f9fc797b35c9443022f4c4e7414e67fe05b6d67cb80.exe

Modifies registry class 4 IoCs

Processes:

97e71e8473db7d2f5f0b7f9fc797b35c9443022f4c4e7414e67fe05b6d67cb80.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\SYS_DLL	97e71e8473db7d2f5f0b7f9fc797b35c9443022f4c4e7414e67fe05b6d67cb80.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\SYS_DLL\name = "qAeGqf.dll"	97e71e8473db7d2f5f0b7f9fc797b35c9443022f4c4e7414e67fe05b6d67cb80.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\HOOK_ID	97e71e8473db7d2f5f0b7f9fc797b35c9443022f4c4e7414e67fe05b6d67cb80.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\HOOK_ID\name = "97e71e8473db7d2f5f0b7f9fc797b35c9443022f4c4e7414e67fe05b6d67cb80.exe"	97e71e8473db7d2f5f0b7f9fc797b35c9443022f4c4e7414e67fe05b6d67cb80.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

97e71e8473db7d2f5f0b7f9fc797b35c9443022f4c4e7414e67fe05b6d67cb80.exe

pid	process
1148	97e71e8473db7d2f5f0b7f9fc797b35c9443022f4c4e7414e67fe05b6d67cb80.exe
1148	97e71e8473db7d2f5f0b7f9fc797b35c9443022f4c4e7414e67fe05b6d67cb80.exe
1148	97e71e8473db7d2f5f0b7f9fc797b35c9443022f4c4e7414e67fe05b6d67cb80.exe
1148	97e71e8473db7d2f5f0b7f9fc797b35c9443022f4c4e7414e67fe05b6d67cb80.exe
1148	97e71e8473db7d2f5f0b7f9fc797b35c9443022f4c4e7414e67fe05b6d67cb80.exe
1148	97e71e8473db7d2f5f0b7f9fc797b35c9443022f4c4e7414e67fe05b6d67cb80.exe
1148	97e71e8473db7d2f5f0b7f9fc797b35c9443022f4c4e7414e67fe05b6d67cb80.exe
1148	97e71e8473db7d2f5f0b7f9fc797b35c9443022f4c4e7414e67fe05b6d67cb80.exe
1148	97e71e8473db7d2f5f0b7f9fc797b35c9443022f4c4e7414e67fe05b6d67cb80.exe
1148	97e71e8473db7d2f5f0b7f9fc797b35c9443022f4c4e7414e67fe05b6d67cb80.exe
1148	97e71e8473db7d2f5f0b7f9fc797b35c9443022f4c4e7414e67fe05b6d67cb80.exe
1148	97e71e8473db7d2f5f0b7f9fc797b35c9443022f4c4e7414e67fe05b6d67cb80.exe
1148	97e71e8473db7d2f5f0b7f9fc797b35c9443022f4c4e7414e67fe05b6d67cb80.exe
1148	97e71e8473db7d2f5f0b7f9fc797b35c9443022f4c4e7414e67fe05b6d67cb80.exe
1148	97e71e8473db7d2f5f0b7f9fc797b35c9443022f4c4e7414e67fe05b6d67cb80.exe
1148	97e71e8473db7d2f5f0b7f9fc797b35c9443022f4c4e7414e67fe05b6d67cb80.exe
1148	97e71e8473db7d2f5f0b7f9fc797b35c9443022f4c4e7414e67fe05b6d67cb80.exe
1148	97e71e8473db7d2f5f0b7f9fc797b35c9443022f4c4e7414e67fe05b6d67cb80.exe
1148	97e71e8473db7d2f5f0b7f9fc797b35c9443022f4c4e7414e67fe05b6d67cb80.exe
1148	97e71e8473db7d2f5f0b7f9fc797b35c9443022f4c4e7414e67fe05b6d67cb80.exe
1148	97e71e8473db7d2f5f0b7f9fc797b35c9443022f4c4e7414e67fe05b6d67cb80.exe
1148	97e71e8473db7d2f5f0b7f9fc797b35c9443022f4c4e7414e67fe05b6d67cb80.exe
1148	97e71e8473db7d2f5f0b7f9fc797b35c9443022f4c4e7414e67fe05b6d67cb80.exe
1148	97e71e8473db7d2f5f0b7f9fc797b35c9443022f4c4e7414e67fe05b6d67cb80.exe
1148	97e71e8473db7d2f5f0b7f9fc797b35c9443022f4c4e7414e67fe05b6d67cb80.exe
1148	97e71e8473db7d2f5f0b7f9fc797b35c9443022f4c4e7414e67fe05b6d67cb80.exe
1148	97e71e8473db7d2f5f0b7f9fc797b35c9443022f4c4e7414e67fe05b6d67cb80.exe
1148	97e71e8473db7d2f5f0b7f9fc797b35c9443022f4c4e7414e67fe05b6d67cb80.exe
1148	97e71e8473db7d2f5f0b7f9fc797b35c9443022f4c4e7414e67fe05b6d67cb80.exe
1148	97e71e8473db7d2f5f0b7f9fc797b35c9443022f4c4e7414e67fe05b6d67cb80.exe
1148	97e71e8473db7d2f5f0b7f9fc797b35c9443022f4c4e7414e67fe05b6d67cb80.exe
1148	97e71e8473db7d2f5f0b7f9fc797b35c9443022f4c4e7414e67fe05b6d67cb80.exe
1148	97e71e8473db7d2f5f0b7f9fc797b35c9443022f4c4e7414e67fe05b6d67cb80.exe
1148	97e71e8473db7d2f5f0b7f9fc797b35c9443022f4c4e7414e67fe05b6d67cb80.exe
1148	97e71e8473db7d2f5f0b7f9fc797b35c9443022f4c4e7414e67fe05b6d67cb80.exe
1148	97e71e8473db7d2f5f0b7f9fc797b35c9443022f4c4e7414e67fe05b6d67cb80.exe
1148	97e71e8473db7d2f5f0b7f9fc797b35c9443022f4c4e7414e67fe05b6d67cb80.exe
1148	97e71e8473db7d2f5f0b7f9fc797b35c9443022f4c4e7414e67fe05b6d67cb80.exe
1148	97e71e8473db7d2f5f0b7f9fc797b35c9443022f4c4e7414e67fe05b6d67cb80.exe
1148	97e71e8473db7d2f5f0b7f9fc797b35c9443022f4c4e7414e67fe05b6d67cb80.exe
1148	97e71e8473db7d2f5f0b7f9fc797b35c9443022f4c4e7414e67fe05b6d67cb80.exe
1148	97e71e8473db7d2f5f0b7f9fc797b35c9443022f4c4e7414e67fe05b6d67cb80.exe
1148	97e71e8473db7d2f5f0b7f9fc797b35c9443022f4c4e7414e67fe05b6d67cb80.exe
1148	97e71e8473db7d2f5f0b7f9fc797b35c9443022f4c4e7414e67fe05b6d67cb80.exe
1148	97e71e8473db7d2f5f0b7f9fc797b35c9443022f4c4e7414e67fe05b6d67cb80.exe
1148	97e71e8473db7d2f5f0b7f9fc797b35c9443022f4c4e7414e67fe05b6d67cb80.exe
1148	97e71e8473db7d2f5f0b7f9fc797b35c9443022f4c4e7414e67fe05b6d67cb80.exe
1148	97e71e8473db7d2f5f0b7f9fc797b35c9443022f4c4e7414e67fe05b6d67cb80.exe
1148	97e71e8473db7d2f5f0b7f9fc797b35c9443022f4c4e7414e67fe05b6d67cb80.exe
1148	97e71e8473db7d2f5f0b7f9fc797b35c9443022f4c4e7414e67fe05b6d67cb80.exe
1148	97e71e8473db7d2f5f0b7f9fc797b35c9443022f4c4e7414e67fe05b6d67cb80.exe
1148	97e71e8473db7d2f5f0b7f9fc797b35c9443022f4c4e7414e67fe05b6d67cb80.exe
1148	97e71e8473db7d2f5f0b7f9fc797b35c9443022f4c4e7414e67fe05b6d67cb80.exe
1148	97e71e8473db7d2f5f0b7f9fc797b35c9443022f4c4e7414e67fe05b6d67cb80.exe
1148	97e71e8473db7d2f5f0b7f9fc797b35c9443022f4c4e7414e67fe05b6d67cb80.exe
1148	97e71e8473db7d2f5f0b7f9fc797b35c9443022f4c4e7414e67fe05b6d67cb80.exe
1148	97e71e8473db7d2f5f0b7f9fc797b35c9443022f4c4e7414e67fe05b6d67cb80.exe
1148	97e71e8473db7d2f5f0b7f9fc797b35c9443022f4c4e7414e67fe05b6d67cb80.exe
1148	97e71e8473db7d2f5f0b7f9fc797b35c9443022f4c4e7414e67fe05b6d67cb80.exe
1148	97e71e8473db7d2f5f0b7f9fc797b35c9443022f4c4e7414e67fe05b6d67cb80.exe
1148	97e71e8473db7d2f5f0b7f9fc797b35c9443022f4c4e7414e67fe05b6d67cb80.exe
1148	97e71e8473db7d2f5f0b7f9fc797b35c9443022f4c4e7414e67fe05b6d67cb80.exe
1148	97e71e8473db7d2f5f0b7f9fc797b35c9443022f4c4e7414e67fe05b6d67cb80.exe
1148	97e71e8473db7d2f5f0b7f9fc797b35c9443022f4c4e7414e67fe05b6d67cb80.exe

Suspicious behavior: LoadsDriver 5 IoCs

Processes:

97e71e8473db7d2f5f0b7f9fc797b35c9443022f4c4e7414e67fe05b6d67cb80.exe

pid	process
464
1148	97e71e8473db7d2f5f0b7f9fc797b35c9443022f4c4e7414e67fe05b6d67cb80.exe
464
1148	97e71e8473db7d2f5f0b7f9fc797b35c9443022f4c4e7414e67fe05b6d67cb80.exe
1148	97e71e8473db7d2f5f0b7f9fc797b35c9443022f4c4e7414e67fe05b6d67cb80.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

97e71e8473db7d2f5f0b7f9fc797b35c9443022f4c4e7414e67fe05b6d67cb80.exetakeown.exe

description	pid	process
Token: SeDebugPrivilege	1148	97e71e8473db7d2f5f0b7f9fc797b35c9443022f4c4e7414e67fe05b6d67cb80.exe
Token: SeTakeOwnershipPrivilege	1120	takeown.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

97e71e8473db7d2f5f0b7f9fc797b35c9443022f4c4e7414e67fe05b6d67cb80.execmd.exe

description	pid	process	target process
PID 1148 wrote to memory of 920	1148	97e71e8473db7d2f5f0b7f9fc797b35c9443022f4c4e7414e67fe05b6d67cb80.exe	cmd.exe
PID 1148 wrote to memory of 920	1148	97e71e8473db7d2f5f0b7f9fc797b35c9443022f4c4e7414e67fe05b6d67cb80.exe	cmd.exe
PID 1148 wrote to memory of 920	1148	97e71e8473db7d2f5f0b7f9fc797b35c9443022f4c4e7414e67fe05b6d67cb80.exe	cmd.exe
PID 1148 wrote to memory of 920	1148	97e71e8473db7d2f5f0b7f9fc797b35c9443022f4c4e7414e67fe05b6d67cb80.exe	cmd.exe
PID 920 wrote to memory of 1120	920	cmd.exe	takeown.exe
PID 920 wrote to memory of 1120	920	cmd.exe	takeown.exe
PID 920 wrote to memory of 1120	920	cmd.exe	takeown.exe
PID 920 wrote to memory of 1120	920	cmd.exe	takeown.exe
PID 920 wrote to memory of 324	920	cmd.exe	icacls.exe
PID 920 wrote to memory of 324	920	cmd.exe	icacls.exe
PID 920 wrote to memory of 324	920	cmd.exe	icacls.exe
PID 920 wrote to memory of 324	920	cmd.exe	icacls.exe
PID 1148 wrote to memory of 652	1148	97e71e8473db7d2f5f0b7f9fc797b35c9443022f4c4e7414e67fe05b6d67cb80.exe	cmd.exe
PID 1148 wrote to memory of 652	1148	97e71e8473db7d2f5f0b7f9fc797b35c9443022f4c4e7414e67fe05b6d67cb80.exe	cmd.exe
PID 1148 wrote to memory of 652	1148	97e71e8473db7d2f5f0b7f9fc797b35c9443022f4c4e7414e67fe05b6d67cb80.exe	cmd.exe
PID 1148 wrote to memory of 652	1148	97e71e8473db7d2f5f0b7f9fc797b35c9443022f4c4e7414e67fe05b6d67cb80.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\97e71e8473db7d2f5f0b7f9fc797b35c9443022f4c4e7414e67fe05b6d67cb80.exe
"C:\Users\Admin\AppData\Local\Temp\97e71e8473db7d2f5f0b7f9fc797b35c9443022f4c4e7414e67fe05b6d67cb80.exe"
1⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1148

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c takeown /f C:\Windows\SysWOW64\wshtcpip.dll && icacls C:\Windows\SysWOW64\wshtcpip.dll /grant administrators:F
2⤵
- Suspicious use of WriteProcessMemory
PID:920

C:\Windows\SysWOW64\takeown.exe
takeown /f C:\Windows\SysWOW64\wshtcpip.dll
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:1120

C:\Windows\SysWOW64\icacls.exe
icacls C:\Windows\SysWOW64\wshtcpip.dll /grant administrators:F
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:324

C:\Windows\SysWOW64\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\ahnmove.bat
2⤵
- Deletes itself
PID:652

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Browser Extensions

1

T1176

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ahnmove.bat
Filesize
181B

MD5
8337b459581d3acfbf7f3d9680fdcb4c

SHA1
e55b0c6ff185c4a4fa796525e1a03233c32d7f8c

SHA256
c927ac80024cf78e3fed8a3533fcbda5e31c8244f8b1462154bdf44d866e1b99

SHA512
6b0e3f1be778ef103426f8b612eb963b7c6a0fe9e4a74319dfe81c49e0ab72ab2d43c16440c8aa3bf5490330f8ef120413409a1ee993127f3b5f7635ea414cdc

Download Submit
memory/324-58-0x0000000000000000-mapping.dmp

Download
memory/652-59-0x0000000000000000-mapping.dmp

Download
memory/920-56-0x0000000000000000-mapping.dmp

Download
memory/1120-57-0x0000000000000000-mapping.dmp

Download
memory/1148-54-0x00000000767F1000-0x00000000767F3000-memory.dmp

Filesize
8KB

Download
memory/1148-55-0x0000000001000000-0x000000000112D000-memory.dmp

Filesize
1.2MB

Download
memory/1148-60-0x0000000001000000-0x000000000112D000-memory.dmp

Filesize
1.2MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads