Overview

overview

8

Static

static

564d4d591f...3d.exe

windows7-x64

8

564d4d591f...3d.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-11-2022 08:45

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    564d4d591fbee72741120aad1d61e91afc4a7fed095b7f6acadfe254face5e3d.exe

  • Size

    328KB

  • MD5

    1418bc22e59199f408628e641f1c9780

  • SHA1

    78b1d9a4f475ee201a939173940c564c50e782b6

  • SHA256

    564d4d591fbee72741120aad1d61e91afc4a7fed095b7f6acadfe254face5e3d

  • SHA512

    b0b2c75cedaecd48b1d24cf8f555db9c01cc55e8236a708cb132a98407816514c1940b9502db3c1de716065561536fe8e1a42b667e20a817d8d87858314ae01d

  • SSDEEP

    6144:pyWOeLm+tkxoGQvT+W4+HMc+MEGRQ6saHSMf3z0AzbLUG50Tpm+MmvbWdlL0d5aU:pCemx0vN3HKGi6sYjJLUGGtedud5tr7

Score
8/10
adwarediscoveryexploitpersistencestealer

Malware Config

Signatures

  • Drops file in Drivers directory 1 IoCs
  • Possible privilege escalation attempt 4 IoCs
    exploit
  • Sets service image path in registry 2 TTPs 1 IoCs
    persistence
  • Modifies file permissions 1 TTPs 4 IoCs
    discovery
  • Installs/modifies Browser Helper Object 2 TTPs 3 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Maps connected drives based on registry 3 TTPs 3 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory 4 IoCs
  • Modifies registry class 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\564d4d591fbee72741120aad1d61e91afc4a7fed095b7f6acadfe254face5e3d.exe
    "C:\Users\Admin\AppData\Local\Temp\564d4d591fbee72741120aad1d61e91afc4a7fed095b7f6acadfe254face5e3d.exe"
    1⤵
    • Drops file in Drivers directory
    • Sets service image path in registry
    • Installs/modifies Browser Helper Object
    • Maps connected drives based on registry
    • Drops file in System32 directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: LoadsDriver
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3472
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c takeown /f C:\Windows\SysWOW64\wshtcpip.dll && icacls C:\Windows\SysWOW64\wshtcpip.dll /grant administrators:F
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2104
      • C:\Windows\SysWOW64\takeown.exe
        takeown /f C:\Windows\SysWOW64\wshtcpip.dll
        3⤵
        • Possible privilege escalation attempt
        • Modifies file permissions
        • Suspicious use of AdjustPrivilegeToken
        PID:1796
      • C:\Windows\SysWOW64\icacls.exe
        icacls C:\Windows\SysWOW64\wshtcpip.dll /grant administrators:F
        3⤵
        • Possible privilege escalation attempt
        • Modifies file permissions
        PID:1400
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c takeown /f C:\Windows\SysWOW64\midimap.dll && icacls C:\Windows\SysWOW64\midimap.dll /grant administrators:F
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:5028
      • C:\Windows\SysWOW64\takeown.exe
        takeown /f C:\Windows\SysWOW64\midimap.dll
        3⤵
        • Possible privilege escalation attempt
        • Modifies file permissions
        • Suspicious use of AdjustPrivilegeToken
        PID:3992
      • C:\Windows\SysWOW64\icacls.exe
        icacls C:\Windows\SysWOW64\midimap.dll /grant administrators:F
        3⤵
        • Possible privilege escalation attempt
        • Modifies file permissions
        PID:776
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ahnmove.bat
      2⤵
        PID:3828

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\ahnmove.bat
      Filesize

      181B

      MD5

      b3a43b7d59456adcd5c5a485b86b1859

      SHA1

      f93a902c2d82acb763d9b9e2e789fe4c4b7b7123

      SHA256

      9f87f425f1801fb9d0cd988d7d4467f2ff512cc885ee08a65a33575050fc0e85

      SHA512

      4a92cbafa5f7622d6c5ad6515f003a00af0be6a2973d81ef43847059a8e7d176c9cb2bd17a9db560b6db25f882b53e7cb7ff62d5c92fd455469c4a9d3d83545c

      Download Submit
    • memory/776-141-0x0000000000000000-mapping.dmp
      Download
    • memory/1400-138-0x0000000000000000-mapping.dmp
      Download
    • memory/1796-137-0x0000000000000000-mapping.dmp
      Download
    • memory/2104-136-0x0000000000000000-mapping.dmp
      Download
    • memory/3472-135-0x0000000000590000-0x00000000005B0000-memory.dmp
      Filesize

      128KB

      Download
    • memory/3472-132-0x0000000001000000-0x000000000116A000-memory.dmp
      Filesize

      1.4MB

      Download
    • memory/3472-134-0x0000000001000000-0x000000000116A000-memory.dmp
      Filesize

      1.4MB

      Download
    • memory/3472-143-0x0000000001000000-0x000000000116A000-memory.dmp
      Filesize

      1.4MB

      Download
    • memory/3472-133-0x0000000000590000-0x00000000005B0000-memory.dmp
      Filesize

      128KB

      Download
    • memory/3828-142-0x0000000000000000-mapping.dmp
      Download
    • memory/3992-140-0x0000000000000000-mapping.dmp
      Download
    • memory/5028-139-0x0000000000000000-mapping.dmp
      Download