Analysis
-
max time kernel
207s -
max time network
223s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 17:57
Static task
static1
Behavioral task
behavioral1
Sample
0a68f0e9db1d21658e23195595dac0d2b3c5b5434a48d9bc9fd36fc134660211.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
0a68f0e9db1d21658e23195595dac0d2b3c5b5434a48d9bc9fd36fc134660211.exe
Resource
win10v2004-20220812-en
General
-
Target
0a68f0e9db1d21658e23195595dac0d2b3c5b5434a48d9bc9fd36fc134660211.exe
-
Size
6.7MB
-
MD5
c3c418b7342a3c95091959ff676b75ec
-
SHA1
b470140d808ed45db15038f245606db79bf8c137
-
SHA256
0a68f0e9db1d21658e23195595dac0d2b3c5b5434a48d9bc9fd36fc134660211
-
SHA512
dc825864c6e8df727c6ebe8fd38d5164368d049cdf01c4b51ae6540bbe51c7797674eb6f5ee06d79077ae347b1d258c7bedb8911bffbe76d14c089410385ea51
-
SSDEEP
98304:iXCbohcBBUVl3YWbj3unY62eGHWdSfKPtoBWZfyjJy58BmH9XbpMDCE3EHotwMJC:iwBWn7und2eOFat2Ipo0ItwMJQTzT
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
Processes:
e57beeb.exedescription ioc process File created C:\Windows\SysWOW64\drivers\792e9af0.sys e57beeb.exe -
Executes dropped EXE 3 IoCs
Processes:
e577e48.tmp0a68f0e9db1d21658e23195595dac0d2b3c5b5434a48d9bc9fd36fc134660211.exee57beeb.exepid process 4712 e577e48.tmp 1724 0a68f0e9db1d21658e23195595dac0d2b3c5b5434a48d9bc9fd36fc134660211.exe 4304 e57beeb.exe -
Possible privilege escalation attempt 4 IoCs
Processes:
icacls.exetakeown.exeicacls.exetakeown.exepid process 1576 icacls.exe 220 takeown.exe 1076 icacls.exe 2808 takeown.exe -
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
e57beeb.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\792e9af0\ImagePath = "\\??\\C:\\Windows\\SysWOW64\\drivers\\792e9af0.sys" e57beeb.exe -
Modifies file permissions 1 TTPs 4 IoCs
Processes:
takeown.exeicacls.exetakeown.exeicacls.exepid process 2808 takeown.exe 1576 icacls.exe 220 takeown.exe 1076 icacls.exe -
Installs/modifies Browser Helper Object 2 TTPs 3 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
Processes:
e57beeb.exedescription ioc process Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects e57beeb.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA} e57beeb.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C} e57beeb.exe -
Maps connected drives based on registry 3 TTPs 3 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
e57beeb.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum e57beeb.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum e57beeb.exe Key value enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum e57beeb.exe -
Drops file in System32 directory 4 IoCs
Processes:
e57beeb.exedescription ioc process File created C:\Windows\SysWOW64\ws2tcpip.dll e57beeb.exe File opened for modification C:\Windows\SysWOW64\ws2tcpip.dll e57beeb.exe File created C:\Windows\SysWOW64\wshtcpip.dll e57beeb.exe File created C:\Windows\SysWOW64\midimap.dll e57beeb.exe -
Modifies registry class 4 IoCs
Processes:
e57beeb.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\SYS_DLL e57beeb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\SYS_DLL\name = "f8A8HU.dll" e57beeb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\HOOK_ID e57beeb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\HOOK_ID\name = "e57beeb.exe" e57beeb.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
e57beeb.exepid process 4304 e57beeb.exe 4304 e57beeb.exe 4304 e57beeb.exe 4304 e57beeb.exe 4304 e57beeb.exe 4304 e57beeb.exe 4304 e57beeb.exe 4304 e57beeb.exe 4304 e57beeb.exe 4304 e57beeb.exe 4304 e57beeb.exe 4304 e57beeb.exe 4304 e57beeb.exe 4304 e57beeb.exe 4304 e57beeb.exe 4304 e57beeb.exe 4304 e57beeb.exe 4304 e57beeb.exe 4304 e57beeb.exe 4304 e57beeb.exe 4304 e57beeb.exe 4304 e57beeb.exe 4304 e57beeb.exe 4304 e57beeb.exe 4304 e57beeb.exe 4304 e57beeb.exe 4304 e57beeb.exe 4304 e57beeb.exe 4304 e57beeb.exe 4304 e57beeb.exe 4304 e57beeb.exe 4304 e57beeb.exe 4304 e57beeb.exe 4304 e57beeb.exe 4304 e57beeb.exe 4304 e57beeb.exe 4304 e57beeb.exe 4304 e57beeb.exe 4304 e57beeb.exe 4304 e57beeb.exe 4304 e57beeb.exe 4304 e57beeb.exe 4304 e57beeb.exe 4304 e57beeb.exe 4304 e57beeb.exe 4304 e57beeb.exe 4304 e57beeb.exe 4304 e57beeb.exe 4304 e57beeb.exe 4304 e57beeb.exe 4304 e57beeb.exe 4304 e57beeb.exe 4304 e57beeb.exe 4304 e57beeb.exe 4304 e57beeb.exe 4304 e57beeb.exe 4304 e57beeb.exe 4304 e57beeb.exe 4304 e57beeb.exe 4304 e57beeb.exe 4304 e57beeb.exe 4304 e57beeb.exe 4304 e57beeb.exe 4304 e57beeb.exe -
Suspicious behavior: LoadsDriver 2 IoCs
Processes:
e57beeb.exepid process 656 4304 e57beeb.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
e57beeb.exetakeown.exetakeown.exedescription pid process Token: SeDebugPrivilege 4304 e57beeb.exe Token: SeTakeOwnershipPrivilege 2808 takeown.exe Token: SeTakeOwnershipPrivilege 220 takeown.exe -
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
0a68f0e9db1d21658e23195595dac0d2b3c5b5434a48d9bc9fd36fc134660211.exee577e48.tmpe57beeb.execmd.execmd.exedescription pid process target process PID 4820 wrote to memory of 4712 4820 0a68f0e9db1d21658e23195595dac0d2b3c5b5434a48d9bc9fd36fc134660211.exe e577e48.tmp PID 4820 wrote to memory of 4712 4820 0a68f0e9db1d21658e23195595dac0d2b3c5b5434a48d9bc9fd36fc134660211.exe e577e48.tmp PID 4820 wrote to memory of 4712 4820 0a68f0e9db1d21658e23195595dac0d2b3c5b5434a48d9bc9fd36fc134660211.exe e577e48.tmp PID 4712 wrote to memory of 1724 4712 e577e48.tmp 0a68f0e9db1d21658e23195595dac0d2b3c5b5434a48d9bc9fd36fc134660211.exe PID 4712 wrote to memory of 1724 4712 e577e48.tmp 0a68f0e9db1d21658e23195595dac0d2b3c5b5434a48d9bc9fd36fc134660211.exe PID 4712 wrote to memory of 1724 4712 e577e48.tmp 0a68f0e9db1d21658e23195595dac0d2b3c5b5434a48d9bc9fd36fc134660211.exe PID 4712 wrote to memory of 4304 4712 e577e48.tmp e57beeb.exe PID 4712 wrote to memory of 4304 4712 e577e48.tmp e57beeb.exe PID 4712 wrote to memory of 4304 4712 e577e48.tmp e57beeb.exe PID 4304 wrote to memory of 1400 4304 e57beeb.exe cmd.exe PID 4304 wrote to memory of 1400 4304 e57beeb.exe cmd.exe PID 4304 wrote to memory of 1400 4304 e57beeb.exe cmd.exe PID 1400 wrote to memory of 2808 1400 cmd.exe takeown.exe PID 1400 wrote to memory of 2808 1400 cmd.exe takeown.exe PID 1400 wrote to memory of 2808 1400 cmd.exe takeown.exe PID 1400 wrote to memory of 1576 1400 cmd.exe icacls.exe PID 1400 wrote to memory of 1576 1400 cmd.exe icacls.exe PID 1400 wrote to memory of 1576 1400 cmd.exe icacls.exe PID 4304 wrote to memory of 3324 4304 e57beeb.exe cmd.exe PID 4304 wrote to memory of 3324 4304 e57beeb.exe cmd.exe PID 4304 wrote to memory of 3324 4304 e57beeb.exe cmd.exe PID 3324 wrote to memory of 220 3324 cmd.exe takeown.exe PID 3324 wrote to memory of 220 3324 cmd.exe takeown.exe PID 3324 wrote to memory of 220 3324 cmd.exe takeown.exe PID 3324 wrote to memory of 1076 3324 cmd.exe icacls.exe PID 3324 wrote to memory of 1076 3324 cmd.exe icacls.exe PID 3324 wrote to memory of 1076 3324 cmd.exe icacls.exe PID 4304 wrote to memory of 4892 4304 e57beeb.exe cmd.exe PID 4304 wrote to memory of 4892 4304 e57beeb.exe cmd.exe PID 4304 wrote to memory of 4892 4304 e57beeb.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0a68f0e9db1d21658e23195595dac0d2b3c5b5434a48d9bc9fd36fc134660211.exe"C:\Users\Admin\AppData\Local\Temp\0a68f0e9db1d21658e23195595dac0d2b3c5b5434a48d9bc9fd36fc134660211.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\e577e48.tmp>C:\Users\Admin\AppData\Local\Temp\0a68f0e9db1d21658e23195595dac0d2b3c5b5434a48d9bc9fd36fc134660211.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\Users\Admin\AppData\Local\Temp\0a68f0e9db1d21658e23195595dac0d2b3c5b5434a48d9bc9fd36fc134660211.exe"C:\Users\Admin\AppData\Local\Temp\0a68f0e9db1d21658e23195595dac0d2b3c5b5434a48d9bc9fd36fc134660211.exe"3⤵
- Executes dropped EXE
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\e57beeb.exe"C:\Users\Admin\AppData\Local\Temp\\e57beeb.exe"3⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Sets service image path in registry
- Installs/modifies Browser Helper Object
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Windows\SysWOW64\cmd.execmd.exe /c takeown /f C:\Windows\SysWOW64\wshtcpip.dll && icacls C:\Windows\SysWOW64\wshtcpip.dll /grant administrators:F4⤵
- Suspicious use of WriteProcessMemory
PID:1400 -
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\SysWOW64\wshtcpip.dll5⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:2808 -
C:\Windows\SysWOW64\icacls.exeicacls C:\Windows\SysWOW64\wshtcpip.dll /grant administrators:F5⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1576 -
C:\Windows\SysWOW64\cmd.execmd.exe /c takeown /f C:\Windows\SysWOW64\midimap.dll && icacls C:\Windows\SysWOW64\midimap.dll /grant administrators:F4⤵
- Suspicious use of WriteProcessMemory
PID:3324 -
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\SysWOW64\midimap.dll5⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:220 -
C:\Windows\SysWOW64\icacls.exeicacls C:\Windows\SysWOW64\midimap.dll /grant administrators:F5⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1076 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ahnmove.bat4⤵PID:4892
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\0a68f0e9db1d21658e23195595dac0d2b3c5b5434a48d9bc9fd36fc134660211.exeFilesize
6.0MB
MD5b2efbcefd835b3fce42080fa3537a0f1
SHA11b4907d26fc9e3b01c04bae8bc9ae585db93d453
SHA25639dd2098b2fa1cac516a844b1178c2da64b476006fae557a7a050e3bea1fa1fe
SHA5124757c6b08d122019d5087c3ecab13a5f99e7f7092b147c2f71c94a14c78174a9c6715ee4f53a5371dda71ca6e33a0c085f3c270fe2513a412f4e1284ece53973
-
C:\Users\Admin\AppData\Local\Temp\0a68f0e9db1d21658e23195595dac0d2b3c5b5434a48d9bc9fd36fc134660211.exeFilesize
6.0MB
MD5b2efbcefd835b3fce42080fa3537a0f1
SHA11b4907d26fc9e3b01c04bae8bc9ae585db93d453
SHA25639dd2098b2fa1cac516a844b1178c2da64b476006fae557a7a050e3bea1fa1fe
SHA5124757c6b08d122019d5087c3ecab13a5f99e7f7092b147c2f71c94a14c78174a9c6715ee4f53a5371dda71ca6e33a0c085f3c270fe2513a412f4e1284ece53973
-
C:\Users\Admin\AppData\Local\Temp\ahnmove.batFilesize
179B
MD5e8663a6a06929ee195c01ed949d5ef70
SHA15feb9b3b0df0b270a1cd8774bb8d8f732c2b0011
SHA2561a0ed5808d48bf5f6f413b888c9dbc762fbd7d3ed8fc1f79bac47246d6bf75ad
SHA512af983f84eb9b114c2ae2a1d59f46cbd2cf342279b9c800ec7aa3ce46f569712b045d66c46198d94adad367e51b055402ff378b73d20cb65387494c24a2c70cef
-
C:\Users\Admin\AppData\Local\Temp\e577e48.tmpFilesize
6.7MB
MD5c3c418b7342a3c95091959ff676b75ec
SHA1b470140d808ed45db15038f245606db79bf8c137
SHA2560a68f0e9db1d21658e23195595dac0d2b3c5b5434a48d9bc9fd36fc134660211
SHA512dc825864c6e8df727c6ebe8fd38d5164368d049cdf01c4b51ae6540bbe51c7797674eb6f5ee06d79077ae347b1d258c7bedb8911bffbe76d14c089410385ea51
-
C:\Users\Admin\AppData\Local\Temp\e577e48.tmpFilesize
6.7MB
MD5c3c418b7342a3c95091959ff676b75ec
SHA1b470140d808ed45db15038f245606db79bf8c137
SHA2560a68f0e9db1d21658e23195595dac0d2b3c5b5434a48d9bc9fd36fc134660211
SHA512dc825864c6e8df727c6ebe8fd38d5164368d049cdf01c4b51ae6540bbe51c7797674eb6f5ee06d79077ae347b1d258c7bedb8911bffbe76d14c089410385ea51
-
C:\Users\Admin\AppData\Local\Temp\e57beeb.exeFilesize
714KB
MD5343df0ebec1cd6e5731b5758d1741db0
SHA129f48ff645f53279c4cf7be585cfc7c5c82373c8
SHA256f5140b3d67edfbd1a8d5ce8519ddfb32e1efa7362285ed59aabb905b7fada762
SHA512fae17f537c4d991005cc90b29e01aa1a250436a9dc3e509ec760c594a9c97ef0e372e90332072998d527f9247fc91e4a1027e967200d67bf40df0a5aff4d79f3
-
C:\Users\Admin\AppData\Local\Temp\e57beeb.exeFilesize
714KB
MD5343df0ebec1cd6e5731b5758d1741db0
SHA129f48ff645f53279c4cf7be585cfc7c5c82373c8
SHA256f5140b3d67edfbd1a8d5ce8519ddfb32e1efa7362285ed59aabb905b7fada762
SHA512fae17f537c4d991005cc90b29e01aa1a250436a9dc3e509ec760c594a9c97ef0e372e90332072998d527f9247fc91e4a1027e967200d67bf40df0a5aff4d79f3
-
memory/220-151-0x0000000000000000-mapping.dmp
-
memory/1076-152-0x0000000000000000-mapping.dmp
-
memory/1400-147-0x0000000000000000-mapping.dmp
-
memory/1576-149-0x0000000000000000-mapping.dmp
-
memory/1724-136-0x0000000000000000-mapping.dmp
-
memory/2808-148-0x0000000000000000-mapping.dmp
-
memory/3324-150-0x0000000000000000-mapping.dmp
-
memory/4304-146-0x0000000001000000-0x0000000001BC7000-memory.dmpFilesize
11.8MB
-
memory/4304-145-0x0000000000560000-0x0000000000580000-memory.dmpFilesize
128KB
-
memory/4304-143-0x0000000001000000-0x0000000001BC7000-memory.dmpFilesize
11.8MB
-
memory/4304-142-0x0000000000560000-0x0000000000580000-memory.dmpFilesize
128KB
-
memory/4304-138-0x0000000000000000-mapping.dmp
-
memory/4304-155-0x0000000001000000-0x0000000001BC7000-memory.dmpFilesize
11.8MB
-
memory/4712-140-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/4712-133-0x0000000000000000-mapping.dmp
-
memory/4820-132-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/4892-153-0x0000000000000000-mapping.dmp