26cbcdf87d4edcd15ed03693fa12801daa8471bc9707d9b0afbb84a41ab5e42e

General

Target

26cbcdf87d4edcd15ed03693fa12801daa8471bc9707d9b0afbb84a41ab5e42e.exe
Size

329KB
MD5

304e87b1a549495812c9e34ffd033540
SHA1

52b5f12b6a5167b29dbf15c0c7704a7c2871b134
SHA256

26cbcdf87d4edcd15ed03693fa12801daa8471bc9707d9b0afbb84a41ab5e42e
SHA512

02e5ecdc0a7846088fdedeb3da5013d7de41dc71957f2f82586a6e75abd00e6418f9d06cf439cb426e7151852ec414929e0c164acae24fd69c6c901bebd63358
SSDEEP

6144:7qpxvlACym6wGGWFGDwZyoJ3fzBeM6SpktqHQI6mVk8cL3/CzYjsHh:7qjvlA06wLBHAf9eMvHwmVkhL36zYwHh

Score

8^/10

adware discovery exploit persistence stealer

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

26cbcdf87d4edcd15ed03693fa12801daa8471bc9707d9b0afbb84a41ab5e42e.exe

description ioc process

File created C:\Windows\SysWOW64\drivers\293c234d.sys 26cbcdf87d4edcd15ed03693fa12801daa8471bc9707d9b0afbb84a41ab5e42e.exe
Possible privilege escalation attempt 4 IoCs
exploit

Processes:

takeown.exeicacls.exetakeown.exeicacls.exe

pid process

4344 takeown.exe
3740 icacls.exe
3692 takeown.exe
2544 icacls.exe

description	ioc	process
File created	C:\Windows\SysWOW64\drivers\293c234d.sys	26cbcdf87d4edcd15ed03693fa12801daa8471bc9707d9b0afbb84a41ab5e42e.exe

pid	process
4344	takeown.exe
3740	icacls.exe
3692	takeown.exe
2544	icacls.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

26cbcdf87d4edcd15ed03693fa12801daa8471bc9707d9b0afbb84a41ab5e42e.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\293c234d\ImagePath = "\\??\\C:\\Windows\\SysWOW64\\drivers\\293c234d.sys"	26cbcdf87d4edcd15ed03693fa12801daa8471bc9707d9b0afbb84a41ab5e42e.exe

Modifies file permissions 1 TTPs 4 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exetakeown.exeicacls.exetakeown.exe

pid process

3740 icacls.exe
3692 takeown.exe
2544 icacls.exe
4344 takeown.exe

pid	process
3740	icacls.exe
3692	takeown.exe
2544	icacls.exe
4344	takeown.exe

Installs/modifies Browser Helper Object 2 TTPs 3 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

Processes:

26cbcdf87d4edcd15ed03693fa12801daa8471bc9707d9b0afbb84a41ab5e42e.exe

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}	26cbcdf87d4edcd15ed03693fa12801daa8471bc9707d9b0afbb84a41ab5e42e.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}	26cbcdf87d4edcd15ed03693fa12801daa8471bc9707d9b0afbb84a41ab5e42e.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	26cbcdf87d4edcd15ed03693fa12801daa8471bc9707d9b0afbb84a41ab5e42e.exe

Maps connected drives based on registry 3 TTPs 3 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

26cbcdf87d4edcd15ed03693fa12801daa8471bc9707d9b0afbb84a41ab5e42e.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	26cbcdf87d4edcd15ed03693fa12801daa8471bc9707d9b0afbb84a41ab5e42e.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	26cbcdf87d4edcd15ed03693fa12801daa8471bc9707d9b0afbb84a41ab5e42e.exe
Key value enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	26cbcdf87d4edcd15ed03693fa12801daa8471bc9707d9b0afbb84a41ab5e42e.exe

Drops file in System32 directory 4 IoCs

Processes:

26cbcdf87d4edcd15ed03693fa12801daa8471bc9707d9b0afbb84a41ab5e42e.exe

description	ioc	process
File created	C:\Windows\SysWOW64\ws2tcpip.dll	26cbcdf87d4edcd15ed03693fa12801daa8471bc9707d9b0afbb84a41ab5e42e.exe
File opened for modification	C:\Windows\SysWOW64\ws2tcpip.dll	26cbcdf87d4edcd15ed03693fa12801daa8471bc9707d9b0afbb84a41ab5e42e.exe
File created	C:\Windows\SysWOW64\wshtcpip.dll	26cbcdf87d4edcd15ed03693fa12801daa8471bc9707d9b0afbb84a41ab5e42e.exe
File created	C:\Windows\SysWOW64\midimap.dll	26cbcdf87d4edcd15ed03693fa12801daa8471bc9707d9b0afbb84a41ab5e42e.exe

Modifies registry class 4 IoCs

Processes:

26cbcdf87d4edcd15ed03693fa12801daa8471bc9707d9b0afbb84a41ab5e42e.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\HOOK_ID\name = "26cbcdf87d4edcd15ed03693fa12801daa8471bc9707d9b0afbb84a41ab5e42e.exe"	26cbcdf87d4edcd15ed03693fa12801daa8471bc9707d9b0afbb84a41ab5e42e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\SYS_DLL	26cbcdf87d4edcd15ed03693fa12801daa8471bc9707d9b0afbb84a41ab5e42e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\SYS_DLL\name = "yegsuLauH.dll"	26cbcdf87d4edcd15ed03693fa12801daa8471bc9707d9b0afbb84a41ab5e42e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\HOOK_ID	26cbcdf87d4edcd15ed03693fa12801daa8471bc9707d9b0afbb84a41ab5e42e.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

26cbcdf87d4edcd15ed03693fa12801daa8471bc9707d9b0afbb84a41ab5e42e.exe

pid	process
1052	26cbcdf87d4edcd15ed03693fa12801daa8471bc9707d9b0afbb84a41ab5e42e.exe
1052	26cbcdf87d4edcd15ed03693fa12801daa8471bc9707d9b0afbb84a41ab5e42e.exe
1052	26cbcdf87d4edcd15ed03693fa12801daa8471bc9707d9b0afbb84a41ab5e42e.exe
1052	26cbcdf87d4edcd15ed03693fa12801daa8471bc9707d9b0afbb84a41ab5e42e.exe
1052	26cbcdf87d4edcd15ed03693fa12801daa8471bc9707d9b0afbb84a41ab5e42e.exe
1052	26cbcdf87d4edcd15ed03693fa12801daa8471bc9707d9b0afbb84a41ab5e42e.exe
1052	26cbcdf87d4edcd15ed03693fa12801daa8471bc9707d9b0afbb84a41ab5e42e.exe
1052	26cbcdf87d4edcd15ed03693fa12801daa8471bc9707d9b0afbb84a41ab5e42e.exe
1052	26cbcdf87d4edcd15ed03693fa12801daa8471bc9707d9b0afbb84a41ab5e42e.exe
1052	26cbcdf87d4edcd15ed03693fa12801daa8471bc9707d9b0afbb84a41ab5e42e.exe
1052	26cbcdf87d4edcd15ed03693fa12801daa8471bc9707d9b0afbb84a41ab5e42e.exe
1052	26cbcdf87d4edcd15ed03693fa12801daa8471bc9707d9b0afbb84a41ab5e42e.exe
1052	26cbcdf87d4edcd15ed03693fa12801daa8471bc9707d9b0afbb84a41ab5e42e.exe
1052	26cbcdf87d4edcd15ed03693fa12801daa8471bc9707d9b0afbb84a41ab5e42e.exe
1052	26cbcdf87d4edcd15ed03693fa12801daa8471bc9707d9b0afbb84a41ab5e42e.exe
1052	26cbcdf87d4edcd15ed03693fa12801daa8471bc9707d9b0afbb84a41ab5e42e.exe
1052	26cbcdf87d4edcd15ed03693fa12801daa8471bc9707d9b0afbb84a41ab5e42e.exe
1052	26cbcdf87d4edcd15ed03693fa12801daa8471bc9707d9b0afbb84a41ab5e42e.exe
1052	26cbcdf87d4edcd15ed03693fa12801daa8471bc9707d9b0afbb84a41ab5e42e.exe
1052	26cbcdf87d4edcd15ed03693fa12801daa8471bc9707d9b0afbb84a41ab5e42e.exe
1052	26cbcdf87d4edcd15ed03693fa12801daa8471bc9707d9b0afbb84a41ab5e42e.exe
1052	26cbcdf87d4edcd15ed03693fa12801daa8471bc9707d9b0afbb84a41ab5e42e.exe
1052	26cbcdf87d4edcd15ed03693fa12801daa8471bc9707d9b0afbb84a41ab5e42e.exe
1052	26cbcdf87d4edcd15ed03693fa12801daa8471bc9707d9b0afbb84a41ab5e42e.exe
1052	26cbcdf87d4edcd15ed03693fa12801daa8471bc9707d9b0afbb84a41ab5e42e.exe
1052	26cbcdf87d4edcd15ed03693fa12801daa8471bc9707d9b0afbb84a41ab5e42e.exe
1052	26cbcdf87d4edcd15ed03693fa12801daa8471bc9707d9b0afbb84a41ab5e42e.exe
1052	26cbcdf87d4edcd15ed03693fa12801daa8471bc9707d9b0afbb84a41ab5e42e.exe
1052	26cbcdf87d4edcd15ed03693fa12801daa8471bc9707d9b0afbb84a41ab5e42e.exe
1052	26cbcdf87d4edcd15ed03693fa12801daa8471bc9707d9b0afbb84a41ab5e42e.exe
1052	26cbcdf87d4edcd15ed03693fa12801daa8471bc9707d9b0afbb84a41ab5e42e.exe
1052	26cbcdf87d4edcd15ed03693fa12801daa8471bc9707d9b0afbb84a41ab5e42e.exe
1052	26cbcdf87d4edcd15ed03693fa12801daa8471bc9707d9b0afbb84a41ab5e42e.exe
1052	26cbcdf87d4edcd15ed03693fa12801daa8471bc9707d9b0afbb84a41ab5e42e.exe
1052	26cbcdf87d4edcd15ed03693fa12801daa8471bc9707d9b0afbb84a41ab5e42e.exe
1052	26cbcdf87d4edcd15ed03693fa12801daa8471bc9707d9b0afbb84a41ab5e42e.exe
1052	26cbcdf87d4edcd15ed03693fa12801daa8471bc9707d9b0afbb84a41ab5e42e.exe
1052	26cbcdf87d4edcd15ed03693fa12801daa8471bc9707d9b0afbb84a41ab5e42e.exe
1052	26cbcdf87d4edcd15ed03693fa12801daa8471bc9707d9b0afbb84a41ab5e42e.exe
1052	26cbcdf87d4edcd15ed03693fa12801daa8471bc9707d9b0afbb84a41ab5e42e.exe
1052	26cbcdf87d4edcd15ed03693fa12801daa8471bc9707d9b0afbb84a41ab5e42e.exe
1052	26cbcdf87d4edcd15ed03693fa12801daa8471bc9707d9b0afbb84a41ab5e42e.exe
1052	26cbcdf87d4edcd15ed03693fa12801daa8471bc9707d9b0afbb84a41ab5e42e.exe
1052	26cbcdf87d4edcd15ed03693fa12801daa8471bc9707d9b0afbb84a41ab5e42e.exe
1052	26cbcdf87d4edcd15ed03693fa12801daa8471bc9707d9b0afbb84a41ab5e42e.exe
1052	26cbcdf87d4edcd15ed03693fa12801daa8471bc9707d9b0afbb84a41ab5e42e.exe
1052	26cbcdf87d4edcd15ed03693fa12801daa8471bc9707d9b0afbb84a41ab5e42e.exe
1052	26cbcdf87d4edcd15ed03693fa12801daa8471bc9707d9b0afbb84a41ab5e42e.exe
1052	26cbcdf87d4edcd15ed03693fa12801daa8471bc9707d9b0afbb84a41ab5e42e.exe
1052	26cbcdf87d4edcd15ed03693fa12801daa8471bc9707d9b0afbb84a41ab5e42e.exe
1052	26cbcdf87d4edcd15ed03693fa12801daa8471bc9707d9b0afbb84a41ab5e42e.exe
1052	26cbcdf87d4edcd15ed03693fa12801daa8471bc9707d9b0afbb84a41ab5e42e.exe
1052	26cbcdf87d4edcd15ed03693fa12801daa8471bc9707d9b0afbb84a41ab5e42e.exe
1052	26cbcdf87d4edcd15ed03693fa12801daa8471bc9707d9b0afbb84a41ab5e42e.exe
1052	26cbcdf87d4edcd15ed03693fa12801daa8471bc9707d9b0afbb84a41ab5e42e.exe
1052	26cbcdf87d4edcd15ed03693fa12801daa8471bc9707d9b0afbb84a41ab5e42e.exe
1052	26cbcdf87d4edcd15ed03693fa12801daa8471bc9707d9b0afbb84a41ab5e42e.exe
1052	26cbcdf87d4edcd15ed03693fa12801daa8471bc9707d9b0afbb84a41ab5e42e.exe
1052	26cbcdf87d4edcd15ed03693fa12801daa8471bc9707d9b0afbb84a41ab5e42e.exe
1052	26cbcdf87d4edcd15ed03693fa12801daa8471bc9707d9b0afbb84a41ab5e42e.exe
1052	26cbcdf87d4edcd15ed03693fa12801daa8471bc9707d9b0afbb84a41ab5e42e.exe
1052	26cbcdf87d4edcd15ed03693fa12801daa8471bc9707d9b0afbb84a41ab5e42e.exe
1052	26cbcdf87d4edcd15ed03693fa12801daa8471bc9707d9b0afbb84a41ab5e42e.exe
1052	26cbcdf87d4edcd15ed03693fa12801daa8471bc9707d9b0afbb84a41ab5e42e.exe

Suspicious behavior: LoadsDriver 2 IoCs

Processes:

26cbcdf87d4edcd15ed03693fa12801daa8471bc9707d9b0afbb84a41ab5e42e.exe

pid process

664
1052 26cbcdf87d4edcd15ed03693fa12801daa8471bc9707d9b0afbb84a41ab5e42e.exe

pid	process
664
1052	26cbcdf87d4edcd15ed03693fa12801daa8471bc9707d9b0afbb84a41ab5e42e.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

26cbcdf87d4edcd15ed03693fa12801daa8471bc9707d9b0afbb84a41ab5e42e.exetakeown.exetakeown.exe

description	pid	process
Token: SeDebugPrivilege	1052	26cbcdf87d4edcd15ed03693fa12801daa8471bc9707d9b0afbb84a41ab5e42e.exe
Token: SeTakeOwnershipPrivilege	3692	takeown.exe
Token: SeTakeOwnershipPrivilege	4344	takeown.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

26cbcdf87d4edcd15ed03693fa12801daa8471bc9707d9b0afbb84a41ab5e42e.execmd.execmd.exe

description	pid	process	target process
PID 1052 wrote to memory of 3076	1052	26cbcdf87d4edcd15ed03693fa12801daa8471bc9707d9b0afbb84a41ab5e42e.exe	cmd.exe
PID 1052 wrote to memory of 3076	1052	26cbcdf87d4edcd15ed03693fa12801daa8471bc9707d9b0afbb84a41ab5e42e.exe	cmd.exe
PID 1052 wrote to memory of 3076	1052	26cbcdf87d4edcd15ed03693fa12801daa8471bc9707d9b0afbb84a41ab5e42e.exe	cmd.exe
PID 3076 wrote to memory of 3692	3076	cmd.exe	takeown.exe
PID 3076 wrote to memory of 3692	3076	cmd.exe	takeown.exe
PID 3076 wrote to memory of 3692	3076	cmd.exe	takeown.exe
PID 3076 wrote to memory of 2544	3076	cmd.exe	icacls.exe
PID 3076 wrote to memory of 2544	3076	cmd.exe	icacls.exe
PID 3076 wrote to memory of 2544	3076	cmd.exe	icacls.exe
PID 1052 wrote to memory of 2784	1052	26cbcdf87d4edcd15ed03693fa12801daa8471bc9707d9b0afbb84a41ab5e42e.exe	cmd.exe
PID 1052 wrote to memory of 2784	1052	26cbcdf87d4edcd15ed03693fa12801daa8471bc9707d9b0afbb84a41ab5e42e.exe	cmd.exe
PID 1052 wrote to memory of 2784	1052	26cbcdf87d4edcd15ed03693fa12801daa8471bc9707d9b0afbb84a41ab5e42e.exe	cmd.exe
PID 2784 wrote to memory of 4344	2784	cmd.exe	takeown.exe
PID 2784 wrote to memory of 4344	2784	cmd.exe	takeown.exe
PID 2784 wrote to memory of 4344	2784	cmd.exe	takeown.exe
PID 2784 wrote to memory of 3740	2784	cmd.exe	icacls.exe
PID 2784 wrote to memory of 3740	2784	cmd.exe	icacls.exe
PID 2784 wrote to memory of 3740	2784	cmd.exe	icacls.exe
PID 1052 wrote to memory of 2936	1052	26cbcdf87d4edcd15ed03693fa12801daa8471bc9707d9b0afbb84a41ab5e42e.exe	cmd.exe
PID 1052 wrote to memory of 2936	1052	26cbcdf87d4edcd15ed03693fa12801daa8471bc9707d9b0afbb84a41ab5e42e.exe	cmd.exe
PID 1052 wrote to memory of 2936	1052	26cbcdf87d4edcd15ed03693fa12801daa8471bc9707d9b0afbb84a41ab5e42e.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\26cbcdf87d4edcd15ed03693fa12801daa8471bc9707d9b0afbb84a41ab5e42e.exe
"C:\Users\Admin\AppData\Local\Temp\26cbcdf87d4edcd15ed03693fa12801daa8471bc9707d9b0afbb84a41ab5e42e.exe"
1⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Installs/modifies Browser Helper Object
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1052

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c takeown /f C:\Windows\SysWOW64\wshtcpip.dll && icacls C:\Windows\SysWOW64\wshtcpip.dll /grant administrators:F
2⤵
- Suspicious use of WriteProcessMemory
PID:3076

C:\Windows\SysWOW64\takeown.exe
takeown /f C:\Windows\SysWOW64\wshtcpip.dll
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:3692

C:\Windows\SysWOW64\icacls.exe
icacls C:\Windows\SysWOW64\wshtcpip.dll /grant administrators:F
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:2544

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c takeown /f C:\Windows\SysWOW64\midimap.dll && icacls C:\Windows\SysWOW64\midimap.dll /grant administrators:F
2⤵
- Suspicious use of WriteProcessMemory
PID:2784

C:\Windows\SysWOW64\takeown.exe
takeown /f C:\Windows\SysWOW64\midimap.dll
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:4344

C:\Windows\SysWOW64\icacls.exe
icacls C:\Windows\SysWOW64\midimap.dll /grant administrators:F
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:3740

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ahnmove.bat
2⤵
PID:2936

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Browser Extensions

1

T1176

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ahnmove.bat

Filesize
181B

MD5
2d9deda121003f31d302bac4d4edea7e

SHA1
203ff45ac231344f801c6f0cf5e4e14e6739356a

SHA256
dae7482ccfff60c34ec668e650a0a8de8cf88cfc04b2eb7af3f4bf5b3bfe1400

SHA512
45989a06d683a80852a518ad41693180c257248dbd4ebbf000343a5022a9ac160ae05401209e52f4a787cf9b5de1469f08672a108660a0a804db500dbf853fb9

Download Submit
memory/1052-132-0x0000000001000000-0x0000000001168000-memory.dmp

Filesize
1.4MB

Download
memory/1052-133-0x0000000000550000-0x0000000000570000-memory.dmp

Filesize
128KB

Download
memory/1052-134-0x0000000001000000-0x0000000001168000-memory.dmp

Filesize
1.4MB

Download
memory/1052-135-0x0000000000550000-0x0000000000570000-memory.dmp

Filesize
128KB

Download
memory/1052-143-0x0000000001000000-0x0000000001168000-memory.dmp

Filesize
1.4MB

Download
memory/2544-138-0x0000000000000000-mapping.dmp

Download
memory/2784-139-0x0000000000000000-mapping.dmp

Download
memory/2936-142-0x0000000000000000-mapping.dmp

Download
memory/3076-136-0x0000000000000000-mapping.dmp

Download
memory/3692-137-0x0000000000000000-mapping.dmp

Download
memory/3740-141-0x0000000000000000-mapping.dmp

Download
memory/4344-140-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads