38f33f765cac401b12ed8b67616bf725273a576952b0dd849ef1142dfff7416c

General

Target

38f33f765cac401b12ed8b67616bf725273a576952b0dd849ef1142dfff7416c.exe
Size

810KB
MD5

81832cf9fd9df3401e4675b5559a87af
SHA1

e06c795398f46b5b6bca7e236de9a1019e0afce1
SHA256

38f33f765cac401b12ed8b67616bf725273a576952b0dd849ef1142dfff7416c
SHA512

c052ec30ac6cf2ff5208f64fd41bc7d908ecc6f720d7d074b2ab08aac7e6e207dad5f142ddf0a6e5dcd1549167d7a7a0e96ea36d6f2248f103da71cc56ffed61
SSDEEP

12288:uhi+coBfeept/5gxDHd71fIRbSisRNdHxYYtsSPXOsavTUst01AatM:W7t6xDHl1fIfaYR8XOs4TUodae

Score

8^/10

adware discovery exploit persistence stealer

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

38f33f765cac401b12ed8b67616bf725273a576952b0dd849ef1142dfff7416c.exe

description ioc process

File created C:\Windows\SysWOW64\drivers\7ba4a6bf.sys 38f33f765cac401b12ed8b67616bf725273a576952b0dd849ef1142dfff7416c.exe
Possible privilege escalation attempt 4 IoCs
exploit

Processes:

takeown.exeicacls.exetakeown.exeicacls.exe

pid process

5008 takeown.exe
3568 icacls.exe
3536 takeown.exe
3248 icacls.exe

description	ioc	process
File created	C:\Windows\SysWOW64\drivers\7ba4a6bf.sys	38f33f765cac401b12ed8b67616bf725273a576952b0dd849ef1142dfff7416c.exe

pid	process
5008	takeown.exe
3568	icacls.exe
3536	takeown.exe
3248	icacls.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

38f33f765cac401b12ed8b67616bf725273a576952b0dd849ef1142dfff7416c.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\7ba4a6bf\ImagePath = "\\??\\C:\\Windows\\SysWOW64\\drivers\\7ba4a6bf.sys"	38f33f765cac401b12ed8b67616bf725273a576952b0dd849ef1142dfff7416c.exe

Modifies file permissions 1 TTPs 4 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

takeown.exeicacls.exetakeown.exeicacls.exe

pid process

5008 takeown.exe
3568 icacls.exe
3536 takeown.exe
3248 icacls.exe

pid	process
5008	takeown.exe
3568	icacls.exe
3536	takeown.exe
3248	icacls.exe

Installs/modifies Browser Helper Object 2 TTPs 3 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

Processes:

38f33f765cac401b12ed8b67616bf725273a576952b0dd849ef1142dfff7416c.exe

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	38f33f765cac401b12ed8b67616bf725273a576952b0dd849ef1142dfff7416c.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}	38f33f765cac401b12ed8b67616bf725273a576952b0dd849ef1142dfff7416c.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}	38f33f765cac401b12ed8b67616bf725273a576952b0dd849ef1142dfff7416c.exe

Maps connected drives based on registry 3 TTPs 3 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

38f33f765cac401b12ed8b67616bf725273a576952b0dd849ef1142dfff7416c.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	38f33f765cac401b12ed8b67616bf725273a576952b0dd849ef1142dfff7416c.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	38f33f765cac401b12ed8b67616bf725273a576952b0dd849ef1142dfff7416c.exe
Key value enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	38f33f765cac401b12ed8b67616bf725273a576952b0dd849ef1142dfff7416c.exe

Drops file in System32 directory 4 IoCs

Processes:

38f33f765cac401b12ed8b67616bf725273a576952b0dd849ef1142dfff7416c.exe

description	ioc	process
File created	C:\Windows\SysWOW64\ws2tcpip.dll	38f33f765cac401b12ed8b67616bf725273a576952b0dd849ef1142dfff7416c.exe
File opened for modification	C:\Windows\SysWOW64\ws2tcpip.dll	38f33f765cac401b12ed8b67616bf725273a576952b0dd849ef1142dfff7416c.exe
File created	C:\Windows\SysWOW64\wshtcpip.dll	38f33f765cac401b12ed8b67616bf725273a576952b0dd849ef1142dfff7416c.exe
File created	C:\Windows\SysWOW64\midimap.dll	38f33f765cac401b12ed8b67616bf725273a576952b0dd849ef1142dfff7416c.exe

Modifies registry class 4 IoCs

Processes:

38f33f765cac401b12ed8b67616bf725273a576952b0dd849ef1142dfff7416c.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\HOOK_ID	38f33f765cac401b12ed8b67616bf725273a576952b0dd849ef1142dfff7416c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\HOOK_ID\name = "38f33f765cac401b12ed8b67616bf725273a576952b0dd849ef1142dfff7416c.exe"	38f33f765cac401b12ed8b67616bf725273a576952b0dd849ef1142dfff7416c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\SYS_DLL	38f33f765cac401b12ed8b67616bf725273a576952b0dd849ef1142dfff7416c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\SYS_DLL\name = "hru.dll"	38f33f765cac401b12ed8b67616bf725273a576952b0dd849ef1142dfff7416c.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

38f33f765cac401b12ed8b67616bf725273a576952b0dd849ef1142dfff7416c.exe

pid	process
4612	38f33f765cac401b12ed8b67616bf725273a576952b0dd849ef1142dfff7416c.exe
4612	38f33f765cac401b12ed8b67616bf725273a576952b0dd849ef1142dfff7416c.exe
4612	38f33f765cac401b12ed8b67616bf725273a576952b0dd849ef1142dfff7416c.exe
4612	38f33f765cac401b12ed8b67616bf725273a576952b0dd849ef1142dfff7416c.exe
4612	38f33f765cac401b12ed8b67616bf725273a576952b0dd849ef1142dfff7416c.exe
4612	38f33f765cac401b12ed8b67616bf725273a576952b0dd849ef1142dfff7416c.exe
4612	38f33f765cac401b12ed8b67616bf725273a576952b0dd849ef1142dfff7416c.exe
4612	38f33f765cac401b12ed8b67616bf725273a576952b0dd849ef1142dfff7416c.exe
4612	38f33f765cac401b12ed8b67616bf725273a576952b0dd849ef1142dfff7416c.exe
4612	38f33f765cac401b12ed8b67616bf725273a576952b0dd849ef1142dfff7416c.exe
4612	38f33f765cac401b12ed8b67616bf725273a576952b0dd849ef1142dfff7416c.exe
4612	38f33f765cac401b12ed8b67616bf725273a576952b0dd849ef1142dfff7416c.exe
4612	38f33f765cac401b12ed8b67616bf725273a576952b0dd849ef1142dfff7416c.exe
4612	38f33f765cac401b12ed8b67616bf725273a576952b0dd849ef1142dfff7416c.exe
4612	38f33f765cac401b12ed8b67616bf725273a576952b0dd849ef1142dfff7416c.exe
4612	38f33f765cac401b12ed8b67616bf725273a576952b0dd849ef1142dfff7416c.exe
4612	38f33f765cac401b12ed8b67616bf725273a576952b0dd849ef1142dfff7416c.exe
4612	38f33f765cac401b12ed8b67616bf725273a576952b0dd849ef1142dfff7416c.exe
4612	38f33f765cac401b12ed8b67616bf725273a576952b0dd849ef1142dfff7416c.exe
4612	38f33f765cac401b12ed8b67616bf725273a576952b0dd849ef1142dfff7416c.exe
4612	38f33f765cac401b12ed8b67616bf725273a576952b0dd849ef1142dfff7416c.exe
4612	38f33f765cac401b12ed8b67616bf725273a576952b0dd849ef1142dfff7416c.exe
4612	38f33f765cac401b12ed8b67616bf725273a576952b0dd849ef1142dfff7416c.exe
4612	38f33f765cac401b12ed8b67616bf725273a576952b0dd849ef1142dfff7416c.exe
4612	38f33f765cac401b12ed8b67616bf725273a576952b0dd849ef1142dfff7416c.exe
4612	38f33f765cac401b12ed8b67616bf725273a576952b0dd849ef1142dfff7416c.exe
4612	38f33f765cac401b12ed8b67616bf725273a576952b0dd849ef1142dfff7416c.exe
4612	38f33f765cac401b12ed8b67616bf725273a576952b0dd849ef1142dfff7416c.exe
4612	38f33f765cac401b12ed8b67616bf725273a576952b0dd849ef1142dfff7416c.exe
4612	38f33f765cac401b12ed8b67616bf725273a576952b0dd849ef1142dfff7416c.exe
4612	38f33f765cac401b12ed8b67616bf725273a576952b0dd849ef1142dfff7416c.exe
4612	38f33f765cac401b12ed8b67616bf725273a576952b0dd849ef1142dfff7416c.exe
4612	38f33f765cac401b12ed8b67616bf725273a576952b0dd849ef1142dfff7416c.exe
4612	38f33f765cac401b12ed8b67616bf725273a576952b0dd849ef1142dfff7416c.exe
4612	38f33f765cac401b12ed8b67616bf725273a576952b0dd849ef1142dfff7416c.exe
4612	38f33f765cac401b12ed8b67616bf725273a576952b0dd849ef1142dfff7416c.exe
4612	38f33f765cac401b12ed8b67616bf725273a576952b0dd849ef1142dfff7416c.exe
4612	38f33f765cac401b12ed8b67616bf725273a576952b0dd849ef1142dfff7416c.exe
4612	38f33f765cac401b12ed8b67616bf725273a576952b0dd849ef1142dfff7416c.exe
4612	38f33f765cac401b12ed8b67616bf725273a576952b0dd849ef1142dfff7416c.exe
4612	38f33f765cac401b12ed8b67616bf725273a576952b0dd849ef1142dfff7416c.exe
4612	38f33f765cac401b12ed8b67616bf725273a576952b0dd849ef1142dfff7416c.exe
4612	38f33f765cac401b12ed8b67616bf725273a576952b0dd849ef1142dfff7416c.exe
4612	38f33f765cac401b12ed8b67616bf725273a576952b0dd849ef1142dfff7416c.exe
4612	38f33f765cac401b12ed8b67616bf725273a576952b0dd849ef1142dfff7416c.exe
4612	38f33f765cac401b12ed8b67616bf725273a576952b0dd849ef1142dfff7416c.exe
4612	38f33f765cac401b12ed8b67616bf725273a576952b0dd849ef1142dfff7416c.exe
4612	38f33f765cac401b12ed8b67616bf725273a576952b0dd849ef1142dfff7416c.exe
4612	38f33f765cac401b12ed8b67616bf725273a576952b0dd849ef1142dfff7416c.exe
4612	38f33f765cac401b12ed8b67616bf725273a576952b0dd849ef1142dfff7416c.exe
4612	38f33f765cac401b12ed8b67616bf725273a576952b0dd849ef1142dfff7416c.exe
4612	38f33f765cac401b12ed8b67616bf725273a576952b0dd849ef1142dfff7416c.exe
4612	38f33f765cac401b12ed8b67616bf725273a576952b0dd849ef1142dfff7416c.exe
4612	38f33f765cac401b12ed8b67616bf725273a576952b0dd849ef1142dfff7416c.exe
4612	38f33f765cac401b12ed8b67616bf725273a576952b0dd849ef1142dfff7416c.exe
4612	38f33f765cac401b12ed8b67616bf725273a576952b0dd849ef1142dfff7416c.exe
4612	38f33f765cac401b12ed8b67616bf725273a576952b0dd849ef1142dfff7416c.exe
4612	38f33f765cac401b12ed8b67616bf725273a576952b0dd849ef1142dfff7416c.exe
4612	38f33f765cac401b12ed8b67616bf725273a576952b0dd849ef1142dfff7416c.exe
4612	38f33f765cac401b12ed8b67616bf725273a576952b0dd849ef1142dfff7416c.exe
4612	38f33f765cac401b12ed8b67616bf725273a576952b0dd849ef1142dfff7416c.exe
4612	38f33f765cac401b12ed8b67616bf725273a576952b0dd849ef1142dfff7416c.exe
4612	38f33f765cac401b12ed8b67616bf725273a576952b0dd849ef1142dfff7416c.exe
4612	38f33f765cac401b12ed8b67616bf725273a576952b0dd849ef1142dfff7416c.exe

Suspicious behavior: LoadsDriver 2 IoCs

Processes:

38f33f765cac401b12ed8b67616bf725273a576952b0dd849ef1142dfff7416c.exe

pid process

652
4612 38f33f765cac401b12ed8b67616bf725273a576952b0dd849ef1142dfff7416c.exe

pid	process
652
4612	38f33f765cac401b12ed8b67616bf725273a576952b0dd849ef1142dfff7416c.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

38f33f765cac401b12ed8b67616bf725273a576952b0dd849ef1142dfff7416c.exetakeown.exetakeown.exe

description	pid	process
Token: SeDebugPrivilege	4612	38f33f765cac401b12ed8b67616bf725273a576952b0dd849ef1142dfff7416c.exe
Token: SeTakeOwnershipPrivilege	5008	takeown.exe
Token: SeTakeOwnershipPrivilege	3536	takeown.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

38f33f765cac401b12ed8b67616bf725273a576952b0dd849ef1142dfff7416c.execmd.execmd.exe

description	pid	process	target process
PID 4612 wrote to memory of 1824	4612	38f33f765cac401b12ed8b67616bf725273a576952b0dd849ef1142dfff7416c.exe	cmd.exe
PID 4612 wrote to memory of 1824	4612	38f33f765cac401b12ed8b67616bf725273a576952b0dd849ef1142dfff7416c.exe	cmd.exe
PID 4612 wrote to memory of 1824	4612	38f33f765cac401b12ed8b67616bf725273a576952b0dd849ef1142dfff7416c.exe	cmd.exe
PID 1824 wrote to memory of 5008	1824	cmd.exe	takeown.exe
PID 1824 wrote to memory of 5008	1824	cmd.exe	takeown.exe
PID 1824 wrote to memory of 5008	1824	cmd.exe	takeown.exe
PID 1824 wrote to memory of 3568	1824	cmd.exe	icacls.exe
PID 1824 wrote to memory of 3568	1824	cmd.exe	icacls.exe
PID 1824 wrote to memory of 3568	1824	cmd.exe	icacls.exe
PID 4612 wrote to memory of 4584	4612	38f33f765cac401b12ed8b67616bf725273a576952b0dd849ef1142dfff7416c.exe	cmd.exe
PID 4612 wrote to memory of 4584	4612	38f33f765cac401b12ed8b67616bf725273a576952b0dd849ef1142dfff7416c.exe	cmd.exe
PID 4612 wrote to memory of 4584	4612	38f33f765cac401b12ed8b67616bf725273a576952b0dd849ef1142dfff7416c.exe	cmd.exe
PID 4584 wrote to memory of 3536	4584	cmd.exe	takeown.exe
PID 4584 wrote to memory of 3536	4584	cmd.exe	takeown.exe
PID 4584 wrote to memory of 3536	4584	cmd.exe	takeown.exe
PID 4584 wrote to memory of 3248	4584	cmd.exe	icacls.exe
PID 4584 wrote to memory of 3248	4584	cmd.exe	icacls.exe
PID 4584 wrote to memory of 3248	4584	cmd.exe	icacls.exe
PID 4612 wrote to memory of 5056	4612	38f33f765cac401b12ed8b67616bf725273a576952b0dd849ef1142dfff7416c.exe	cmd.exe
PID 4612 wrote to memory of 5056	4612	38f33f765cac401b12ed8b67616bf725273a576952b0dd849ef1142dfff7416c.exe	cmd.exe
PID 4612 wrote to memory of 5056	4612	38f33f765cac401b12ed8b67616bf725273a576952b0dd849ef1142dfff7416c.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\38f33f765cac401b12ed8b67616bf725273a576952b0dd849ef1142dfff7416c.exe
"C:\Users\Admin\AppData\Local\Temp\38f33f765cac401b12ed8b67616bf725273a576952b0dd849ef1142dfff7416c.exe"
1⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Installs/modifies Browser Helper Object
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4612

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c takeown /f C:\Windows\SysWOW64\wshtcpip.dll && icacls C:\Windows\SysWOW64\wshtcpip.dll /grant administrators:F
2⤵
- Suspicious use of WriteProcessMemory
PID:1824

C:\Windows\SysWOW64\takeown.exe
takeown /f C:\Windows\SysWOW64\wshtcpip.dll
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:5008

C:\Windows\SysWOW64\icacls.exe
icacls C:\Windows\SysWOW64\wshtcpip.dll /grant administrators:F
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:3568

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c takeown /f C:\Windows\SysWOW64\midimap.dll && icacls C:\Windows\SysWOW64\midimap.dll /grant administrators:F
2⤵
- Suspicious use of WriteProcessMemory
PID:4584

C:\Windows\SysWOW64\takeown.exe
takeown /f C:\Windows\SysWOW64\midimap.dll
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:3536

C:\Windows\SysWOW64\icacls.exe
icacls C:\Windows\SysWOW64\midimap.dll /grant administrators:F
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:3248

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ahnmove.bat
2⤵
PID:5056

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Browser Extensions

1

T1176

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ahnmove.bat
Filesize
181B

MD5
934af5dc36cb14002859f3d779a91c3a

SHA1
8228ba4a3b745eb617fe8ceaca83261c48b11358

SHA256
06e7a326b863a2ab02f0758430d4cd45a074221b1f21e21f558d43f81158c14b

SHA512
48543c1e6437245ea8105ed17539e4126f963d86e51478c88cdd6938b6d0fbed9d9f9d5a1195310fbf30c4d6a226c98f71f5affae32c4cf4b7f6f425be0391e9

Download Submit
memory/1824-136-0x0000000000000000-mapping.dmp

Download
memory/3248-141-0x0000000000000000-mapping.dmp

Download
memory/3536-140-0x0000000000000000-mapping.dmp

Download
memory/3568-138-0x0000000000000000-mapping.dmp

Download
memory/4584-139-0x0000000000000000-mapping.dmp

Download
memory/4612-132-0x0000000001000000-0x0000000001BDF000-memory.dmp

Filesize
11.9MB

Download
memory/4612-135-0x0000000000550000-0x0000000000570000-memory.dmp

Filesize
128KB

Download
memory/4612-134-0x0000000001000000-0x0000000001BDF000-memory.dmp

Filesize
11.9MB

Download
memory/4612-133-0x0000000000550000-0x0000000000570000-memory.dmp

Filesize
128KB

Download
memory/4612-144-0x0000000001000000-0x0000000001BDF000-memory.dmp

Filesize
11.9MB

Download
memory/5008-137-0x0000000000000000-mapping.dmp

Download
memory/5056-142-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads