Analysis
- max time kernel
169s - max time network
191s - platform
windows10-2004_x64 - resource
win10v2004-20221111-en - resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system - submitted
27/11/2022, 16:07
Static task
static1
Behavioral task
behavioral1
Sample
4c316c9eb117f7cc8084f04098a5f03469690bc4fe4a449ae369a4b6ec49a9e0.exe
Resource
win7-20221111-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
4c316c9eb117f7cc8084f04098a5f03469690bc4fe4a449ae369a4b6ec49a9e0.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
12 signatures
150 seconds
General
- Target 4c316c9eb117f7cc8084f04098a5f03469690bc4fe4a449ae369a4b6ec49a9e0.exe
- Size 329KB
- Sample221127-tk2l3aae82
- SHA256 4c316c9eb117f7cc8084f04098a5f03469690bc4fe4a449ae369a4b6ec49a9e0
- MD5 3fbd95361e604f32a1f7fc19aa896361
- SHA1 7edf9fad5c4a6927eac6d6e83a5b8eeae3095fde
- SHA512 86fcd9f548f89e77e9734d0582f3f9351fc2b8b83183638850e1298e0fe6ad22f9b3c3651bf5427f5d31604734bc27370a40ddca7fdcc85e398619044b48aa89
- SSDEEP 6144:QqpxvlACym6wGGWFGDwZyoJ3fzBeM6SpktqHQI6mVk8cL3/CzYjsHh:QqjvlA06wLBHAf9eMvHwmVkhL36zYwHh
- MD5 SHA1 SHA512 SSDEEP
Score
8/10
Malware Config
Signatures
- Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\drivers\2b510a0d.sys 4c316c9eb117f7cc8084f04098a5f03469690bc4fe4a449ae369a4b6ec49a9e0.exe - Possible privilege escalation attempt 4 IoCs
pid Process 4988 takeown.exe 2228 icacls.exe 5076 takeown.exe 4540 icacls.exe - Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\2b510a0d\ImagePath = "\\??\\C:\\Windows\\SysWOW64\\drivers\\2b510a0d.sys" 4c316c9eb117f7cc8084f04098a5f03469690bc4fe4a449ae369a4b6ec49a9e0.exe - Modifies file permissions 1 TTPs 4 IoCs
pid Process 4988 takeown.exe 2228 icacls.exe 5076 takeown.exe 4540 icacls.exe - Installs/modifies Browser Helper Object 2 TTPs 3 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects 4c316c9eb117f7cc8084f04098a5f03469690bc4fe4a449ae369a4b6ec49a9e0.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA} 4c316c9eb117f7cc8084f04098a5f03469690bc4fe4a449ae369a4b6ec49a9e0.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C} 4c316c9eb117f7cc8084f04098a5f03469690bc4fe4a449ae369a4b6ec49a9e0.exe - Maps connected drives based on registry 3 TTPs 3 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum 4c316c9eb117f7cc8084f04098a5f03469690bc4fe4a449ae369a4b6ec49a9e0.exe Key value enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum 4c316c9eb117f7cc8084f04098a5f03469690bc4fe4a449ae369a4b6ec49a9e0.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 4c316c9eb117f7cc8084f04098a5f03469690bc4fe4a449ae369a4b6ec49a9e0.exe - Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\ws2tcpip.dll 4c316c9eb117f7cc8084f04098a5f03469690bc4fe4a449ae369a4b6ec49a9e0.exe File created C:\Windows\SysWOW64\wshtcpip.dll 4c316c9eb117f7cc8084f04098a5f03469690bc4fe4a449ae369a4b6ec49a9e0.exe File created C:\Windows\SysWOW64\midimap.dll 4c316c9eb117f7cc8084f04098a5f03469690bc4fe4a449ae369a4b6ec49a9e0.exe File created C:\Windows\SysWOW64\ws2tcpip.dll 4c316c9eb117f7cc8084f04098a5f03469690bc4fe4a449ae369a4b6ec49a9e0.exe - Modifies registry class 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\HOOK_ID 4c316c9eb117f7cc8084f04098a5f03469690bc4fe4a449ae369a4b6ec49a9e0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\HOOK_ID\name = "4c316c9eb117f7cc8084f04098a5f03469690bc4fe4a449ae369a4b6ec49a9e0.exe" 4c316c9eb117f7cc8084f04098a5f03469690bc4fe4a449ae369a4b6ec49a9e0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\SYS_DLL 4c316c9eb117f7cc8084f04098a5f03469690bc4fe4a449ae369a4b6ec49a9e0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\SYS_DLL\name = "7Js3d8.dll" 4c316c9eb117f7cc8084f04098a5f03469690bc4fe4a449ae369a4b6ec49a9e0.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 364 4c316c9eb117f7cc8084f04098a5f03469690bc4fe4a449ae369a4b6ec49a9e0.exe 364 4c316c9eb117f7cc8084f04098a5f03469690bc4fe4a449ae369a4b6ec49a9e0.exe 364 4c316c9eb117f7cc8084f04098a5f03469690bc4fe4a449ae369a4b6ec49a9e0.exe 364 4c316c9eb117f7cc8084f04098a5f03469690bc4fe4a449ae369a4b6ec49a9e0.exe 364 4c316c9eb117f7cc8084f04098a5f03469690bc4fe4a449ae369a4b6ec49a9e0.exe 364 4c316c9eb117f7cc8084f04098a5f03469690bc4fe4a449ae369a4b6ec49a9e0.exe 364 4c316c9eb117f7cc8084f04098a5f03469690bc4fe4a449ae369a4b6ec49a9e0.exe 364 4c316c9eb117f7cc8084f04098a5f03469690bc4fe4a449ae369a4b6ec49a9e0.exe 364 4c316c9eb117f7cc8084f04098a5f03469690bc4fe4a449ae369a4b6ec49a9e0.exe 364 4c316c9eb117f7cc8084f04098a5f03469690bc4fe4a449ae369a4b6ec49a9e0.exe 364 4c316c9eb117f7cc8084f04098a5f03469690bc4fe4a449ae369a4b6ec49a9e0.exe 364 4c316c9eb117f7cc8084f04098a5f03469690bc4fe4a449ae369a4b6ec49a9e0.exe 364 4c316c9eb117f7cc8084f04098a5f03469690bc4fe4a449ae369a4b6ec49a9e0.exe 364 4c316c9eb117f7cc8084f04098a5f03469690bc4fe4a449ae369a4b6ec49a9e0.exe 364 4c316c9eb117f7cc8084f04098a5f03469690bc4fe4a449ae369a4b6ec49a9e0.exe 364 4c316c9eb117f7cc8084f04098a5f03469690bc4fe4a449ae369a4b6ec49a9e0.exe 364 4c316c9eb117f7cc8084f04098a5f03469690bc4fe4a449ae369a4b6ec49a9e0.exe 364 4c316c9eb117f7cc8084f04098a5f03469690bc4fe4a449ae369a4b6ec49a9e0.exe 364 4c316c9eb117f7cc8084f04098a5f03469690bc4fe4a449ae369a4b6ec49a9e0.exe 364 4c316c9eb117f7cc8084f04098a5f03469690bc4fe4a449ae369a4b6ec49a9e0.exe 364 4c316c9eb117f7cc8084f04098a5f03469690bc4fe4a449ae369a4b6ec49a9e0.exe 364 4c316c9eb117f7cc8084f04098a5f03469690bc4fe4a449ae369a4b6ec49a9e0.exe 364 4c316c9eb117f7cc8084f04098a5f03469690bc4fe4a449ae369a4b6ec49a9e0.exe 364 4c316c9eb117f7cc8084f04098a5f03469690bc4fe4a449ae369a4b6ec49a9e0.exe 364 4c316c9eb117f7cc8084f04098a5f03469690bc4fe4a449ae369a4b6ec49a9e0.exe 364 4c316c9eb117f7cc8084f04098a5f03469690bc4fe4a449ae369a4b6ec49a9e0.exe 364 4c316c9eb117f7cc8084f04098a5f03469690bc4fe4a449ae369a4b6ec49a9e0.exe 364 4c316c9eb117f7cc8084f04098a5f03469690bc4fe4a449ae369a4b6ec49a9e0.exe 364 4c316c9eb117f7cc8084f04098a5f03469690bc4fe4a449ae369a4b6ec49a9e0.exe 364 4c316c9eb117f7cc8084f04098a5f03469690bc4fe4a449ae369a4b6ec49a9e0.exe 364 4c316c9eb117f7cc8084f04098a5f03469690bc4fe4a449ae369a4b6ec49a9e0.exe 364 4c316c9eb117f7cc8084f04098a5f03469690bc4fe4a449ae369a4b6ec49a9e0.exe 364 4c316c9eb117f7cc8084f04098a5f03469690bc4fe4a449ae369a4b6ec49a9e0.exe 364 4c316c9eb117f7cc8084f04098a5f03469690bc4fe4a449ae369a4b6ec49a9e0.exe 364 4c316c9eb117f7cc8084f04098a5f03469690bc4fe4a449ae369a4b6ec49a9e0.exe 364 4c316c9eb117f7cc8084f04098a5f03469690bc4fe4a449ae369a4b6ec49a9e0.exe 364 4c316c9eb117f7cc8084f04098a5f03469690bc4fe4a449ae369a4b6ec49a9e0.exe 364 4c316c9eb117f7cc8084f04098a5f03469690bc4fe4a449ae369a4b6ec49a9e0.exe 364 4c316c9eb117f7cc8084f04098a5f03469690bc4fe4a449ae369a4b6ec49a9e0.exe 364 4c316c9eb117f7cc8084f04098a5f03469690bc4fe4a449ae369a4b6ec49a9e0.exe 364 4c316c9eb117f7cc8084f04098a5f03469690bc4fe4a449ae369a4b6ec49a9e0.exe 364 4c316c9eb117f7cc8084f04098a5f03469690bc4fe4a449ae369a4b6ec49a9e0.exe 364 4c316c9eb117f7cc8084f04098a5f03469690bc4fe4a449ae369a4b6ec49a9e0.exe 364 4c316c9eb117f7cc8084f04098a5f03469690bc4fe4a449ae369a4b6ec49a9e0.exe 364 4c316c9eb117f7cc8084f04098a5f03469690bc4fe4a449ae369a4b6ec49a9e0.exe 364 4c316c9eb117f7cc8084f04098a5f03469690bc4fe4a449ae369a4b6ec49a9e0.exe 364 4c316c9eb117f7cc8084f04098a5f03469690bc4fe4a449ae369a4b6ec49a9e0.exe 364 4c316c9eb117f7cc8084f04098a5f03469690bc4fe4a449ae369a4b6ec49a9e0.exe 364 4c316c9eb117f7cc8084f04098a5f03469690bc4fe4a449ae369a4b6ec49a9e0.exe 364 4c316c9eb117f7cc8084f04098a5f03469690bc4fe4a449ae369a4b6ec49a9e0.exe 364 4c316c9eb117f7cc8084f04098a5f03469690bc4fe4a449ae369a4b6ec49a9e0.exe 364 4c316c9eb117f7cc8084f04098a5f03469690bc4fe4a449ae369a4b6ec49a9e0.exe 364 4c316c9eb117f7cc8084f04098a5f03469690bc4fe4a449ae369a4b6ec49a9e0.exe 364 4c316c9eb117f7cc8084f04098a5f03469690bc4fe4a449ae369a4b6ec49a9e0.exe 364 4c316c9eb117f7cc8084f04098a5f03469690bc4fe4a449ae369a4b6ec49a9e0.exe 364 4c316c9eb117f7cc8084f04098a5f03469690bc4fe4a449ae369a4b6ec49a9e0.exe 364 4c316c9eb117f7cc8084f04098a5f03469690bc4fe4a449ae369a4b6ec49a9e0.exe 364 4c316c9eb117f7cc8084f04098a5f03469690bc4fe4a449ae369a4b6ec49a9e0.exe 364 4c316c9eb117f7cc8084f04098a5f03469690bc4fe4a449ae369a4b6ec49a9e0.exe 364 4c316c9eb117f7cc8084f04098a5f03469690bc4fe4a449ae369a4b6ec49a9e0.exe 364 4c316c9eb117f7cc8084f04098a5f03469690bc4fe4a449ae369a4b6ec49a9e0.exe 364 4c316c9eb117f7cc8084f04098a5f03469690bc4fe4a449ae369a4b6ec49a9e0.exe 364 4c316c9eb117f7cc8084f04098a5f03469690bc4fe4a449ae369a4b6ec49a9e0.exe 364 4c316c9eb117f7cc8084f04098a5f03469690bc4fe4a449ae369a4b6ec49a9e0.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 656 Process not Found 364 4c316c9eb117f7cc8084f04098a5f03469690bc4fe4a449ae369a4b6ec49a9e0.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 364 4c316c9eb117f7cc8084f04098a5f03469690bc4fe4a449ae369a4b6ec49a9e0.exe Token: SeTakeOwnershipPrivilege 4988 takeown.exe Token: SeTakeOwnershipPrivilege 5076 takeown.exe - Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 364 wrote to memory of 1340 364 4c316c9eb117f7cc8084f04098a5f03469690bc4fe4a449ae369a4b6ec49a9e0.exe 86 PID 364 wrote to memory of 1340 364 4c316c9eb117f7cc8084f04098a5f03469690bc4fe4a449ae369a4b6ec49a9e0.exe 86 PID 364 wrote to memory of 1340 364 4c316c9eb117f7cc8084f04098a5f03469690bc4fe4a449ae369a4b6ec49a9e0.exe 86 PID 1340 wrote to memory of 4988 1340 cmd.exe 88 PID 1340 wrote to memory of 4988 1340 cmd.exe 88 PID 1340 wrote to memory of 4988 1340 cmd.exe 88 PID 1340 wrote to memory of 2228 1340 cmd.exe 89 PID 1340 wrote to memory of 2228 1340 cmd.exe 89 PID 1340 wrote to memory of 2228 1340 cmd.exe 89 PID 364 wrote to memory of 4472 364 4c316c9eb117f7cc8084f04098a5f03469690bc4fe4a449ae369a4b6ec49a9e0.exe 90 PID 364 wrote to memory of 4472 364 4c316c9eb117f7cc8084f04098a5f03469690bc4fe4a449ae369a4b6ec49a9e0.exe 90 PID 364 wrote to memory of 4472 364 4c316c9eb117f7cc8084f04098a5f03469690bc4fe4a449ae369a4b6ec49a9e0.exe 90 PID 4472 wrote to memory of 5076 4472 cmd.exe 92 PID 4472 wrote to memory of 5076 4472 cmd.exe 92 PID 4472 wrote to memory of 5076 4472 cmd.exe 92 PID 4472 wrote to memory of 4540 4472 cmd.exe 93 PID 4472 wrote to memory of 4540 4472 cmd.exe 93 PID 4472 wrote to memory of 4540 4472 cmd.exe 93 PID 364 wrote to memory of 4120 364 4c316c9eb117f7cc8084f04098a5f03469690bc4fe4a449ae369a4b6ec49a9e0.exe 95 PID 364 wrote to memory of 4120 364 4c316c9eb117f7cc8084f04098a5f03469690bc4fe4a449ae369a4b6ec49a9e0.exe 95 PID 364 wrote to memory of 4120 364 4c316c9eb117f7cc8084f04098a5f03469690bc4fe4a449ae369a4b6ec49a9e0.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\4c316c9eb117f7cc8084f04098a5f03469690bc4fe4a449ae369a4b6ec49a9e0.exe"C:\Users\Admin\AppData\Local\Temp\4c316c9eb117f7cc8084f04098a5f03469690bc4fe4a449ae369a4b6ec49a9e0.exe"1⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Installs/modifies Browser Helper Object
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:364 -
C:\Windows\SysWOW64\cmd.execmd.exe /c takeown /f C:\Windows\SysWOW64\wshtcpip.dll && icacls C:\Windows\SysWOW64\wshtcpip.dll /grant administrators:F2⤵
- Suspicious use of WriteProcessMemory
PID:1340 -
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\SysWOW64\wshtcpip.dll3⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:4988
-
-
C:\Windows\SysWOW64\icacls.exeicacls C:\Windows\SysWOW64\wshtcpip.dll /grant administrators:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:2228
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c takeown /f C:\Windows\SysWOW64\midimap.dll && icacls C:\Windows\SysWOW64\midimap.dll /grant administrators:F2⤵
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\SysWOW64\midimap.dll3⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:5076
-
-
C:\Windows\SysWOW64\icacls.exeicacls C:\Windows\SysWOW64\midimap.dll /grant administrators:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:4540
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ahnmove.bat2⤵PID:4120
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\ahnmove.bat
- Size 181B
- SHA256 0525089c4d0c489545370da46819ef72524257b338bbe7514be77a9ab89b9756
- MD5 ad328b02bd518ed083a6dc0e654d23ca
- SHA1 03a6d9920754d51116f183899ed8c5025fc90870
- SHA512 cdcb34cac8d9225692b177e7794d14337bf7c11f39e150edfbaf3c3085ac4e97fd891beb2f51840f99fa522cd4b52e6874a0d4a1834e651cb582ef3672498806
- MD5 SHA1 SHA512