Analysis
-
max time kernel
91s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
27-11-2022 15:06
Static task
static1
Behavioral task
behavioral1
Sample
bb6737fc2dcb136b6a1c28ea6bc1a16e9feeb2266949e41607dd5d2562a37de3.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
bb6737fc2dcb136b6a1c28ea6bc1a16e9feeb2266949e41607dd5d2562a37de3.exe
Resource
win10v2004-20220901-en
General
-
Target
bb6737fc2dcb136b6a1c28ea6bc1a16e9feeb2266949e41607dd5d2562a37de3.exe
-
Size
847KB
-
MD5
e6129848fc34f8e3b021abb346d6c398
-
SHA1
05da7c1a5008891b6242c60b2e426f4edefe06be
-
SHA256
bb6737fc2dcb136b6a1c28ea6bc1a16e9feeb2266949e41607dd5d2562a37de3
-
SHA512
5091ec97b4c559d936c0196ba7d7e8cb6371461fc820bcd6ed4fb9b07a03d56e74f1d10ede87a5cdcc8d42d427699a7b6c2a107ab8cd0c361920e9fc66a1337b
-
SSDEEP
12288:+PdvxyWzoUaUmN68LAt4WlACSORF9RmZUO2nu19nOmCpYhY6CBTX:+LyvF5NV+MORFrQ119nOVOhVk
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
Processes:
bb6737fc2dcb136b6a1c28ea6bc1a16e9feeb2266949e41607dd5d2562a37de3.exedescription ioc process File created C:\Windows\SysWOW64\drivers\6deeb7f9.sys bb6737fc2dcb136b6a1c28ea6bc1a16e9feeb2266949e41607dd5d2562a37de3.exe -
Possible privilege escalation attempt 4 IoCs
Processes:
takeown.exeicacls.exetakeown.exeicacls.exepid process 4400 takeown.exe 792 icacls.exe 212 takeown.exe 3092 icacls.exe -
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
bb6737fc2dcb136b6a1c28ea6bc1a16e9feeb2266949e41607dd5d2562a37de3.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\6deeb7f9\ImagePath = "\\??\\C:\\Windows\\SysWOW64\\drivers\\6deeb7f9.sys" bb6737fc2dcb136b6a1c28ea6bc1a16e9feeb2266949e41607dd5d2562a37de3.exe -
Modifies file permissions 1 TTPs 4 IoCs
Processes:
icacls.exetakeown.exeicacls.exetakeown.exepid process 792 icacls.exe 212 takeown.exe 3092 icacls.exe 4400 takeown.exe -
Installs/modifies Browser Helper Object 2 TTPs 3 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
Processes:
bb6737fc2dcb136b6a1c28ea6bc1a16e9feeb2266949e41607dd5d2562a37de3.exedescription ioc process Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA} bb6737fc2dcb136b6a1c28ea6bc1a16e9feeb2266949e41607dd5d2562a37de3.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C} bb6737fc2dcb136b6a1c28ea6bc1a16e9feeb2266949e41607dd5d2562a37de3.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects bb6737fc2dcb136b6a1c28ea6bc1a16e9feeb2266949e41607dd5d2562a37de3.exe -
Maps connected drives based on registry 3 TTPs 3 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
bb6737fc2dcb136b6a1c28ea6bc1a16e9feeb2266949e41607dd5d2562a37de3.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum bb6737fc2dcb136b6a1c28ea6bc1a16e9feeb2266949e41607dd5d2562a37de3.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum bb6737fc2dcb136b6a1c28ea6bc1a16e9feeb2266949e41607dd5d2562a37de3.exe Key value enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum bb6737fc2dcb136b6a1c28ea6bc1a16e9feeb2266949e41607dd5d2562a37de3.exe -
Drops file in System32 directory 4 IoCs
Processes:
bb6737fc2dcb136b6a1c28ea6bc1a16e9feeb2266949e41607dd5d2562a37de3.exedescription ioc process File created C:\Windows\SysWOW64\ws2tcpip.dll bb6737fc2dcb136b6a1c28ea6bc1a16e9feeb2266949e41607dd5d2562a37de3.exe File opened for modification C:\Windows\SysWOW64\ws2tcpip.dll bb6737fc2dcb136b6a1c28ea6bc1a16e9feeb2266949e41607dd5d2562a37de3.exe File created C:\Windows\SysWOW64\wshtcpip.dll bb6737fc2dcb136b6a1c28ea6bc1a16e9feeb2266949e41607dd5d2562a37de3.exe File created C:\Windows\SysWOW64\midimap.dll bb6737fc2dcb136b6a1c28ea6bc1a16e9feeb2266949e41607dd5d2562a37de3.exe -
Modifies registry class 4 IoCs
Processes:
bb6737fc2dcb136b6a1c28ea6bc1a16e9feeb2266949e41607dd5d2562a37de3.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\HOOK_ID bb6737fc2dcb136b6a1c28ea6bc1a16e9feeb2266949e41607dd5d2562a37de3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\HOOK_ID\name = "bb6737fc2dcb136b6a1c28ea6bc1a16e9feeb2266949e41607dd5d2562a37de3.exe" bb6737fc2dcb136b6a1c28ea6bc1a16e9feeb2266949e41607dd5d2562a37de3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\SYS_DLL bb6737fc2dcb136b6a1c28ea6bc1a16e9feeb2266949e41607dd5d2562a37de3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\SYS_DLL\name = "ytVbFq.dll" bb6737fc2dcb136b6a1c28ea6bc1a16e9feeb2266949e41607dd5d2562a37de3.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
bb6737fc2dcb136b6a1c28ea6bc1a16e9feeb2266949e41607dd5d2562a37de3.exepid process 4932 bb6737fc2dcb136b6a1c28ea6bc1a16e9feeb2266949e41607dd5d2562a37de3.exe 4932 bb6737fc2dcb136b6a1c28ea6bc1a16e9feeb2266949e41607dd5d2562a37de3.exe 4932 bb6737fc2dcb136b6a1c28ea6bc1a16e9feeb2266949e41607dd5d2562a37de3.exe 4932 bb6737fc2dcb136b6a1c28ea6bc1a16e9feeb2266949e41607dd5d2562a37de3.exe 4932 bb6737fc2dcb136b6a1c28ea6bc1a16e9feeb2266949e41607dd5d2562a37de3.exe 4932 bb6737fc2dcb136b6a1c28ea6bc1a16e9feeb2266949e41607dd5d2562a37de3.exe 4932 bb6737fc2dcb136b6a1c28ea6bc1a16e9feeb2266949e41607dd5d2562a37de3.exe 4932 bb6737fc2dcb136b6a1c28ea6bc1a16e9feeb2266949e41607dd5d2562a37de3.exe 4932 bb6737fc2dcb136b6a1c28ea6bc1a16e9feeb2266949e41607dd5d2562a37de3.exe 4932 bb6737fc2dcb136b6a1c28ea6bc1a16e9feeb2266949e41607dd5d2562a37de3.exe 4932 bb6737fc2dcb136b6a1c28ea6bc1a16e9feeb2266949e41607dd5d2562a37de3.exe 4932 bb6737fc2dcb136b6a1c28ea6bc1a16e9feeb2266949e41607dd5d2562a37de3.exe 4932 bb6737fc2dcb136b6a1c28ea6bc1a16e9feeb2266949e41607dd5d2562a37de3.exe 4932 bb6737fc2dcb136b6a1c28ea6bc1a16e9feeb2266949e41607dd5d2562a37de3.exe 4932 bb6737fc2dcb136b6a1c28ea6bc1a16e9feeb2266949e41607dd5d2562a37de3.exe 4932 bb6737fc2dcb136b6a1c28ea6bc1a16e9feeb2266949e41607dd5d2562a37de3.exe 4932 bb6737fc2dcb136b6a1c28ea6bc1a16e9feeb2266949e41607dd5d2562a37de3.exe 4932 bb6737fc2dcb136b6a1c28ea6bc1a16e9feeb2266949e41607dd5d2562a37de3.exe 4932 bb6737fc2dcb136b6a1c28ea6bc1a16e9feeb2266949e41607dd5d2562a37de3.exe 4932 bb6737fc2dcb136b6a1c28ea6bc1a16e9feeb2266949e41607dd5d2562a37de3.exe 4932 bb6737fc2dcb136b6a1c28ea6bc1a16e9feeb2266949e41607dd5d2562a37de3.exe 4932 bb6737fc2dcb136b6a1c28ea6bc1a16e9feeb2266949e41607dd5d2562a37de3.exe 4932 bb6737fc2dcb136b6a1c28ea6bc1a16e9feeb2266949e41607dd5d2562a37de3.exe 4932 bb6737fc2dcb136b6a1c28ea6bc1a16e9feeb2266949e41607dd5d2562a37de3.exe 4932 bb6737fc2dcb136b6a1c28ea6bc1a16e9feeb2266949e41607dd5d2562a37de3.exe 4932 bb6737fc2dcb136b6a1c28ea6bc1a16e9feeb2266949e41607dd5d2562a37de3.exe 4932 bb6737fc2dcb136b6a1c28ea6bc1a16e9feeb2266949e41607dd5d2562a37de3.exe 4932 bb6737fc2dcb136b6a1c28ea6bc1a16e9feeb2266949e41607dd5d2562a37de3.exe 4932 bb6737fc2dcb136b6a1c28ea6bc1a16e9feeb2266949e41607dd5d2562a37de3.exe 4932 bb6737fc2dcb136b6a1c28ea6bc1a16e9feeb2266949e41607dd5d2562a37de3.exe 4932 bb6737fc2dcb136b6a1c28ea6bc1a16e9feeb2266949e41607dd5d2562a37de3.exe 4932 bb6737fc2dcb136b6a1c28ea6bc1a16e9feeb2266949e41607dd5d2562a37de3.exe 4932 bb6737fc2dcb136b6a1c28ea6bc1a16e9feeb2266949e41607dd5d2562a37de3.exe 4932 bb6737fc2dcb136b6a1c28ea6bc1a16e9feeb2266949e41607dd5d2562a37de3.exe 4932 bb6737fc2dcb136b6a1c28ea6bc1a16e9feeb2266949e41607dd5d2562a37de3.exe 4932 bb6737fc2dcb136b6a1c28ea6bc1a16e9feeb2266949e41607dd5d2562a37de3.exe 4932 bb6737fc2dcb136b6a1c28ea6bc1a16e9feeb2266949e41607dd5d2562a37de3.exe 4932 bb6737fc2dcb136b6a1c28ea6bc1a16e9feeb2266949e41607dd5d2562a37de3.exe 4932 bb6737fc2dcb136b6a1c28ea6bc1a16e9feeb2266949e41607dd5d2562a37de3.exe 4932 bb6737fc2dcb136b6a1c28ea6bc1a16e9feeb2266949e41607dd5d2562a37de3.exe 4932 bb6737fc2dcb136b6a1c28ea6bc1a16e9feeb2266949e41607dd5d2562a37de3.exe 4932 bb6737fc2dcb136b6a1c28ea6bc1a16e9feeb2266949e41607dd5d2562a37de3.exe 4932 bb6737fc2dcb136b6a1c28ea6bc1a16e9feeb2266949e41607dd5d2562a37de3.exe 4932 bb6737fc2dcb136b6a1c28ea6bc1a16e9feeb2266949e41607dd5d2562a37de3.exe 4932 bb6737fc2dcb136b6a1c28ea6bc1a16e9feeb2266949e41607dd5d2562a37de3.exe 4932 bb6737fc2dcb136b6a1c28ea6bc1a16e9feeb2266949e41607dd5d2562a37de3.exe 4932 bb6737fc2dcb136b6a1c28ea6bc1a16e9feeb2266949e41607dd5d2562a37de3.exe 4932 bb6737fc2dcb136b6a1c28ea6bc1a16e9feeb2266949e41607dd5d2562a37de3.exe 4932 bb6737fc2dcb136b6a1c28ea6bc1a16e9feeb2266949e41607dd5d2562a37de3.exe 4932 bb6737fc2dcb136b6a1c28ea6bc1a16e9feeb2266949e41607dd5d2562a37de3.exe 4932 bb6737fc2dcb136b6a1c28ea6bc1a16e9feeb2266949e41607dd5d2562a37de3.exe 4932 bb6737fc2dcb136b6a1c28ea6bc1a16e9feeb2266949e41607dd5d2562a37de3.exe 4932 bb6737fc2dcb136b6a1c28ea6bc1a16e9feeb2266949e41607dd5d2562a37de3.exe 4932 bb6737fc2dcb136b6a1c28ea6bc1a16e9feeb2266949e41607dd5d2562a37de3.exe 4932 bb6737fc2dcb136b6a1c28ea6bc1a16e9feeb2266949e41607dd5d2562a37de3.exe 4932 bb6737fc2dcb136b6a1c28ea6bc1a16e9feeb2266949e41607dd5d2562a37de3.exe 4932 bb6737fc2dcb136b6a1c28ea6bc1a16e9feeb2266949e41607dd5d2562a37de3.exe 4932 bb6737fc2dcb136b6a1c28ea6bc1a16e9feeb2266949e41607dd5d2562a37de3.exe 4932 bb6737fc2dcb136b6a1c28ea6bc1a16e9feeb2266949e41607dd5d2562a37de3.exe 4932 bb6737fc2dcb136b6a1c28ea6bc1a16e9feeb2266949e41607dd5d2562a37de3.exe 4932 bb6737fc2dcb136b6a1c28ea6bc1a16e9feeb2266949e41607dd5d2562a37de3.exe 4932 bb6737fc2dcb136b6a1c28ea6bc1a16e9feeb2266949e41607dd5d2562a37de3.exe 4932 bb6737fc2dcb136b6a1c28ea6bc1a16e9feeb2266949e41607dd5d2562a37de3.exe 4932 bb6737fc2dcb136b6a1c28ea6bc1a16e9feeb2266949e41607dd5d2562a37de3.exe -
Suspicious behavior: LoadsDriver 2 IoCs
Processes:
bb6737fc2dcb136b6a1c28ea6bc1a16e9feeb2266949e41607dd5d2562a37de3.exepid process 648 4932 bb6737fc2dcb136b6a1c28ea6bc1a16e9feeb2266949e41607dd5d2562a37de3.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
bb6737fc2dcb136b6a1c28ea6bc1a16e9feeb2266949e41607dd5d2562a37de3.exetakeown.exetakeown.exedescription pid process Token: SeDebugPrivilege 4932 bb6737fc2dcb136b6a1c28ea6bc1a16e9feeb2266949e41607dd5d2562a37de3.exe Token: SeTakeOwnershipPrivilege 4400 takeown.exe Token: SeTakeOwnershipPrivilege 212 takeown.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
bb6737fc2dcb136b6a1c28ea6bc1a16e9feeb2266949e41607dd5d2562a37de3.execmd.execmd.exedescription pid process target process PID 4932 wrote to memory of 4368 4932 bb6737fc2dcb136b6a1c28ea6bc1a16e9feeb2266949e41607dd5d2562a37de3.exe cmd.exe PID 4932 wrote to memory of 4368 4932 bb6737fc2dcb136b6a1c28ea6bc1a16e9feeb2266949e41607dd5d2562a37de3.exe cmd.exe PID 4932 wrote to memory of 4368 4932 bb6737fc2dcb136b6a1c28ea6bc1a16e9feeb2266949e41607dd5d2562a37de3.exe cmd.exe PID 4368 wrote to memory of 4400 4368 cmd.exe takeown.exe PID 4368 wrote to memory of 4400 4368 cmd.exe takeown.exe PID 4368 wrote to memory of 4400 4368 cmd.exe takeown.exe PID 4368 wrote to memory of 792 4368 cmd.exe icacls.exe PID 4368 wrote to memory of 792 4368 cmd.exe icacls.exe PID 4368 wrote to memory of 792 4368 cmd.exe icacls.exe PID 4932 wrote to memory of 1544 4932 bb6737fc2dcb136b6a1c28ea6bc1a16e9feeb2266949e41607dd5d2562a37de3.exe cmd.exe PID 4932 wrote to memory of 1544 4932 bb6737fc2dcb136b6a1c28ea6bc1a16e9feeb2266949e41607dd5d2562a37de3.exe cmd.exe PID 4932 wrote to memory of 1544 4932 bb6737fc2dcb136b6a1c28ea6bc1a16e9feeb2266949e41607dd5d2562a37de3.exe cmd.exe PID 1544 wrote to memory of 212 1544 cmd.exe takeown.exe PID 1544 wrote to memory of 212 1544 cmd.exe takeown.exe PID 1544 wrote to memory of 212 1544 cmd.exe takeown.exe PID 1544 wrote to memory of 3092 1544 cmd.exe icacls.exe PID 1544 wrote to memory of 3092 1544 cmd.exe icacls.exe PID 1544 wrote to memory of 3092 1544 cmd.exe icacls.exe PID 4932 wrote to memory of 1480 4932 bb6737fc2dcb136b6a1c28ea6bc1a16e9feeb2266949e41607dd5d2562a37de3.exe cmd.exe PID 4932 wrote to memory of 1480 4932 bb6737fc2dcb136b6a1c28ea6bc1a16e9feeb2266949e41607dd5d2562a37de3.exe cmd.exe PID 4932 wrote to memory of 1480 4932 bb6737fc2dcb136b6a1c28ea6bc1a16e9feeb2266949e41607dd5d2562a37de3.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bb6737fc2dcb136b6a1c28ea6bc1a16e9feeb2266949e41607dd5d2562a37de3.exe"C:\Users\Admin\AppData\Local\Temp\bb6737fc2dcb136b6a1c28ea6bc1a16e9feeb2266949e41607dd5d2562a37de3.exe"1⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Installs/modifies Browser Helper Object
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /c takeown /f C:\Windows\SysWOW64\wshtcpip.dll && icacls C:\Windows\SysWOW64\wshtcpip.dll /grant administrators:F2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\SysWOW64\wshtcpip.dll3⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\icacls.exeicacls C:\Windows\SysWOW64\wshtcpip.dll /grant administrators:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.execmd.exe /c takeown /f C:\Windows\SysWOW64\midimap.dll && icacls C:\Windows\SysWOW64\midimap.dll /grant administrators:F2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\SysWOW64\midimap.dll3⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\icacls.exeicacls C:\Windows\SysWOW64\midimap.dll /grant administrators:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ahnmove.bat2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\ahnmove.batFilesize
181B
MD53403710eb86fa72cabbcebc0f863d205
SHA15e0f26806bde2b030a15b363fc7b3dbea842393c
SHA256c5914a979ddea6d07f2b1c3e750ca106d4795ae4b829a0504fadec7781d09bac
SHA5125b3fb784d57290baa3dbd3017228d6acceaad74e6afedc18be9a843c7166d383d197ec7410e37d13d24055e83ca2f04daaf58b3f50b6735fc072df2137a1f56c
-
memory/212-140-0x0000000000000000-mapping.dmp
-
memory/792-138-0x0000000000000000-mapping.dmp
-
memory/1480-142-0x0000000000000000-mapping.dmp
-
memory/1544-139-0x0000000000000000-mapping.dmp
-
memory/3092-141-0x0000000000000000-mapping.dmp
-
memory/4368-136-0x0000000000000000-mapping.dmp
-
memory/4400-137-0x0000000000000000-mapping.dmp
-
memory/4932-135-0x0000000000540000-0x0000000000560000-memory.dmpFilesize
128KB
-
memory/4932-132-0x0000000001000000-0x0000000001C56000-memory.dmpFilesize
12.3MB
-
memory/4932-134-0x0000000001000000-0x0000000001C56000-memory.dmpFilesize
12.3MB
-
memory/4932-133-0x0000000000540000-0x0000000000560000-memory.dmpFilesize
128KB
-
memory/4932-144-0x0000000001000000-0x0000000001C56000-memory.dmpFilesize
12.3MB