a6963bb5ae9f8bd47ad12e371ddd633ca7dd7bdbe8d9d9ca09fd6f20f2442291

General

Target

a6963bb5ae9f8bd47ad12e371ddd633ca7dd7bdbe8d9d9ca09fd6f20f2442291.exe
Size

1.3MB
MD5

ce91f8d31da74fe243e6404a8866b2c1
SHA1

3929bb670d830dc1b990a338483d9fb389e63308
SHA256

a6963bb5ae9f8bd47ad12e371ddd633ca7dd7bdbe8d9d9ca09fd6f20f2442291
SHA512

d0525dfcd869d2dc12045cafb31872c8b9c585ed85de002eb5027f28a7e59150bfd408134fcf947b0858b819c64148b760ca5efee4f61580ac7ef493a224391b

Score

8^/10

discovery evasion exploit

Malware Config

Signatures

Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031
Possible privilege escalation attempt 6 IoCs
exploit

Processes:

icacls.exeicacls.exeicacls.exetakeown.exetakeown.exeicacls.exe

pid process

388 icacls.exe
1272 icacls.exe
2664 icacls.exe
812 takeown.exe
4116 takeown.exe
316 icacls.exe
Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489

pid	process
388	icacls.exe
1272	icacls.exe
2664	icacls.exe
812	takeown.exe
4116	takeown.exe
316	icacls.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

a6963bb5ae9f8bd47ad12e371ddd633ca7dd7bdbe8d9d9ca09fd6f20f2442291.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation	a6963bb5ae9f8bd47ad12e371ddd633ca7dd7bdbe8d9d9ca09fd6f20f2442291.exe

Modifies file permissions 1 TTPs 6 IoCs
discovery

File Permissions Modification
T1222

Processes:

icacls.exeicacls.exeicacls.exeicacls.exetakeown.exetakeown.exe

pid process

316 icacls.exe
388 icacls.exe
1272 icacls.exe
2664 icacls.exe
812 takeown.exe
4116 takeown.exe
Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

takeown.exetakeown.exe

description pid process

Token: SeTakeOwnershipPrivilege 812 takeown.exe
Token: SeTakeOwnershipPrivilege 4116 takeown.exe

pid	process
316	icacls.exe
388	icacls.exe
1272	icacls.exe
2664	icacls.exe
812	takeown.exe
4116	takeown.exe

description	pid	process
Token: SeTakeOwnershipPrivilege	812	takeown.exe
Token: SeTakeOwnershipPrivilege	4116	takeown.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

a6963bb5ae9f8bd47ad12e371ddd633ca7dd7bdbe8d9d9ca09fd6f20f2442291.execmd.exe

description	pid	process	target process
PID 3472 wrote to memory of 1812	3472	a6963bb5ae9f8bd47ad12e371ddd633ca7dd7bdbe8d9d9ca09fd6f20f2442291.exe	cmd.exe
PID 3472 wrote to memory of 1812	3472	a6963bb5ae9f8bd47ad12e371ddd633ca7dd7bdbe8d9d9ca09fd6f20f2442291.exe	cmd.exe
PID 3472 wrote to memory of 1812	3472	a6963bb5ae9f8bd47ad12e371ddd633ca7dd7bdbe8d9d9ca09fd6f20f2442291.exe	cmd.exe
PID 1812 wrote to memory of 3880	1812	cmd.exe	fsutil.exe
PID 1812 wrote to memory of 3880	1812	cmd.exe	fsutil.exe
PID 1812 wrote to memory of 3880	1812	cmd.exe	fsutil.exe
PID 1812 wrote to memory of 3984	1812	cmd.exe	netsh.exe
PID 1812 wrote to memory of 3984	1812	cmd.exe	netsh.exe
PID 1812 wrote to memory of 3984	1812	cmd.exe	netsh.exe
PID 1812 wrote to memory of 456	1812	cmd.exe	netsh.exe
PID 1812 wrote to memory of 456	1812	cmd.exe	netsh.exe
PID 1812 wrote to memory of 456	1812	cmd.exe	netsh.exe
PID 1812 wrote to memory of 4624	1812	cmd.exe	netsh.exe
PID 1812 wrote to memory of 4624	1812	cmd.exe	netsh.exe
PID 1812 wrote to memory of 4624	1812	cmd.exe	netsh.exe
PID 1812 wrote to memory of 4984	1812	cmd.exe	netsh.exe
PID 1812 wrote to memory of 4984	1812	cmd.exe	netsh.exe
PID 1812 wrote to memory of 4984	1812	cmd.exe	netsh.exe
PID 1812 wrote to memory of 3904	1812	cmd.exe	netsh.exe
PID 1812 wrote to memory of 3904	1812	cmd.exe	netsh.exe
PID 1812 wrote to memory of 3904	1812	cmd.exe	netsh.exe
PID 1812 wrote to memory of 1176	1812	cmd.exe	schtasks.exe
PID 1812 wrote to memory of 1176	1812	cmd.exe	schtasks.exe
PID 1812 wrote to memory of 1176	1812	cmd.exe	schtasks.exe
PID 1812 wrote to memory of 4612	1812	cmd.exe	schtasks.exe
PID 1812 wrote to memory of 4612	1812	cmd.exe	schtasks.exe
PID 1812 wrote to memory of 4612	1812	cmd.exe	schtasks.exe
PID 1812 wrote to memory of 4444	1812	cmd.exe	schtasks.exe
PID 1812 wrote to memory of 4444	1812	cmd.exe	schtasks.exe
PID 1812 wrote to memory of 4444	1812	cmd.exe	schtasks.exe
PID 1812 wrote to memory of 444	1812	cmd.exe	schtasks.exe
PID 1812 wrote to memory of 444	1812	cmd.exe	schtasks.exe
PID 1812 wrote to memory of 444	1812	cmd.exe	schtasks.exe
PID 1812 wrote to memory of 2556	1812	cmd.exe	schtasks.exe
PID 1812 wrote to memory of 2556	1812	cmd.exe	schtasks.exe
PID 1812 wrote to memory of 2556	1812	cmd.exe	schtasks.exe
PID 1812 wrote to memory of 5024	1812	cmd.exe	schtasks.exe
PID 1812 wrote to memory of 5024	1812	cmd.exe	schtasks.exe
PID 1812 wrote to memory of 5024	1812	cmd.exe	schtasks.exe
PID 1812 wrote to memory of 5112	1812	cmd.exe	schtasks.exe
PID 1812 wrote to memory of 5112	1812	cmd.exe	schtasks.exe
PID 1812 wrote to memory of 5112	1812	cmd.exe	schtasks.exe
PID 1812 wrote to memory of 3452	1812	cmd.exe	schtasks.exe
PID 1812 wrote to memory of 3452	1812	cmd.exe	schtasks.exe
PID 1812 wrote to memory of 3452	1812	cmd.exe	schtasks.exe
PID 1812 wrote to memory of 4144	1812	cmd.exe	schtasks.exe
PID 1812 wrote to memory of 4144	1812	cmd.exe	schtasks.exe
PID 1812 wrote to memory of 4144	1812	cmd.exe	schtasks.exe
PID 1812 wrote to memory of 2872	1812	cmd.exe	schtasks.exe
PID 1812 wrote to memory of 2872	1812	cmd.exe	schtasks.exe
PID 1812 wrote to memory of 2872	1812	cmd.exe	schtasks.exe
PID 1812 wrote to memory of 1292	1812	cmd.exe	schtasks.exe
PID 1812 wrote to memory of 1292	1812	cmd.exe	schtasks.exe
PID 1812 wrote to memory of 1292	1812	cmd.exe	schtasks.exe
PID 1812 wrote to memory of 1484	1812	cmd.exe	schtasks.exe
PID 1812 wrote to memory of 1484	1812	cmd.exe	schtasks.exe
PID 1812 wrote to memory of 1484	1812	cmd.exe	schtasks.exe
PID 1812 wrote to memory of 1440	1812	cmd.exe	schtasks.exe
PID 1812 wrote to memory of 1440	1812	cmd.exe	schtasks.exe
PID 1812 wrote to memory of 1440	1812	cmd.exe	schtasks.exe
PID 1812 wrote to memory of 1096	1812	cmd.exe	schtasks.exe
PID 1812 wrote to memory of 1096	1812	cmd.exe	schtasks.exe
PID 1812 wrote to memory of 1096	1812	cmd.exe	schtasks.exe
PID 1812 wrote to memory of 1664	1812	cmd.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\a6963bb5ae9f8bd47ad12e371ddd633ca7dd7bdbe8d9d9ca09fd6f20f2442291.exe
"C:\Users\Admin\AppData\Local\Temp\a6963bb5ae9f8bd47ad12e371ddd633ca7dd7bdbe8d9d9ca09fd6f20f2442291.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3472

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\SetupComplete.cmd" "
2⤵
- Suspicious use of WriteProcessMemory
PID:1812

C:\Windows\SysWOW64\fsutil.exe
fsutil dirty query C:
3⤵
PID:3880

C:\Windows\SysWOW64\netsh.exe
netsh advfirewall set allprofiles state on
3⤵
PID:3984

C:\Windows\SysWOW64\netsh.exe
netsh advfirewall firewall delete rule all
3⤵
PID:456

C:\Windows\SysWOW64\netsh.exe
netsh advfirewall set allprofiles firewallpolicy blockinbound,allowoutbound
3⤵
PID:4624

C:\Windows\SysWOW64\netsh.exe
netsh advfirewall set allprofiles settings inboundusernotification enable
3⤵
PID:4984

C:\Windows\SysWOW64\netsh.exe
netsh advfirewall set allprofiles settings remotemanagement disable
3⤵
PID:3904

C:\Windows\SysWOW64\schtasks.exe
schtasks /end /tn "\Microsoft\Windows\Customer Experience Improvement Program\Consolidator"
3⤵
PID:1176

C:\Windows\SysWOW64\schtasks.exe
schtasks /end /tn "\Microsoft\Windows\Customer Experience Improvement Program\UsbCeip"
3⤵
PID:4612

C:\Windows\SysWOW64\schtasks.exe
schtasks /end /tn "\Microsoft\Windows\Autochk\Proxy"
3⤵
PID:4444

C:\Windows\SysWOW64\schtasks.exe
schtasks /end /tn "\Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser"
3⤵
PID:444

C:\Windows\SysWOW64\schtasks.exe
schtasks /end /tn "\Microsoft\Windows\Application Experience\ProgramDataUpdater"
3⤵
PID:2556

C:\Windows\SysWOW64\schtasks.exe
schtasks /end /tn "\Microsoft\Windows\Application Experience\StartupAppTask"
3⤵
PID:5024

C:\Windows\SysWOW64\schtasks.exe
schtasks /end /tn "\Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticDataCollector"
3⤵
PID:5112

C:\Windows\SysWOW64\schtasks.exe
schtasks /end /tn "\Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticResolver"
3⤵
PID:3452

C:\Windows\SysWOW64\schtasks.exe
schtasks /end /tn "\Microsoft\Windows\Power Efficiency Diagnostics\AnalyzeSystem"
3⤵
PID:4144

C:\Windows\SysWOW64\schtasks.exe
schtasks /end /tn "\Microsoft\Windows\Shell\FamilySafetyMonitor"
3⤵
PID:2872

C:\Windows\SysWOW64\schtasks.exe
schtasks /end /tn "\Microsoft\Windows\Maintenance\WinSAT"
3⤵
PID:1292

C:\Windows\SysWOW64\schtasks.exe
schtasks /change /disable /tn "\Microsoft\Windows\Customer Experience Improvement Program\Consolidator"
3⤵
PID:1484

C:\Windows\SysWOW64\schtasks.exe
schtasks /change /disable /tn "\Microsoft\Windows\Customer Experience Improvement Program\UsbCeip"
3⤵
PID:1440

C:\Windows\SysWOW64\schtasks.exe
schtasks /change /disable /tn "\Microsoft\Windows\Autochk\Proxy"
3⤵
PID:1096

C:\Windows\SysWOW64\schtasks.exe
schtasks /change /disable /tn "\Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser"
3⤵
PID:1664

C:\Windows\SysWOW64\schtasks.exe
schtasks /change /disable /tn "\Microsoft\Windows\Application Experience\ProgramDataUpdater"
3⤵
PID:1564

C:\Windows\SysWOW64\schtasks.exe
schtasks /change /disable /tn "\Microsoft\Windows\Application Experience\StartupAppTask"
3⤵
PID:1792

C:\Windows\SysWOW64\schtasks.exe
schtasks /change /disable /tn "\Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticDataCollector"
3⤵
PID:3016

C:\Windows\SysWOW64\schtasks.exe
schtasks /change /disable /tn "\Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticResolver"
3⤵
PID:4560

C:\Windows\SysWOW64\schtasks.exe
schtasks /change /disable /tn "\Microsoft\Windows\Power Efficiency Diagnostics\AnalyzeSystem"
3⤵
PID:4568

C:\Windows\SysWOW64\schtasks.exe
schtasks /change /disable /tn "\Microsoft\Windows\Shell\FamilySafetyMonitor"
3⤵
PID:4224

C:\Windows\SysWOW64\schtasks.exe
schtasks /change /disable /tn "\Microsoft\Windows\Maintenance\WinSAT"
3⤵
PID:1980

C:\Windows\SysWOW64\sc.exe
sc stop Alerter
3⤵
PID:4196

C:\Windows\SysWOW64\sc.exe
sc stop Browser
3⤵
PID:3148

C:\Windows\SysWOW64\sc.exe
sc stop bthserv
3⤵
PID:4548

C:\Windows\SysWOW64\sc.exe
sc stop cisvc
3⤵
PID:5088

C:\Windows\SysWOW64\sc.exe
sc stop ClipSrv
3⤵
PID:3660

C:\Windows\SysWOW64\sc.exe
sc stop CscService
3⤵
PID:2948

C:\Windows\SysWOW64\sc.exe
sc stop cscsvc
3⤵
PID:1500

C:\Windows\SysWOW64\sc.exe
sc stop DiagTrack
3⤵
PID:5020

C:\Windows\SysWOW64\sc.exe
sc stop ERSvc
3⤵
PID:3612

C:\Windows\SysWOW64\sc.exe
sc stop helpsvc
3⤵
PID:1392

C:\Windows\SysWOW64\sc.exe
sc stop HbHost
3⤵
PID:60

C:\Windows\SysWOW64\sc.exe
sc stop HidServ
3⤵
PID:764

C:\Windows\SysWOW64\sc.exe
sc stop HvHost
3⤵
PID:4320

C:\Windows\SysWOW64\sc.exe
sc stop LanmanServer
3⤵
PID:4468

C:\Windows\SysWOW64\sc.exe
sc stop lfsvc
3⤵
PID:3208

C:\Windows\SysWOW64\sc.exe
sc stop LmHosts
3⤵
PID:704

C:\Windows\SysWOW64\sc.exe
sc stop MapsBroker
3⤵
PID:3368

C:\Windows\SysWOW64\sc.exe
sc stop Messenger
3⤵
PID:1364

C:\Windows\SysWOW64\sc.exe
sc stop mnmsrvc
3⤵
PID:2372

C:\Windows\SysWOW64\sc.exe
sc stop NetDDE
3⤵
PID:3980

C:\Windows\SysWOW64\sc.exe
sc stop NetDDEdsdm
3⤵
PID:4728

C:\Windows\SysWOW64\sc.exe
sc stop Netlogon
3⤵
PID:2380

C:\Windows\SysWOW64\sc.exe
sc stop PeerDistSvc
3⤵
PID:5016

C:\Windows\SysWOW64\sc.exe
sc stop PhoneSvc
3⤵
PID:3960

C:\Windows\SysWOW64\sc.exe
sc stop PolicyAgent
3⤵
PID:4076

C:\Windows\SysWOW64\sc.exe
sc stop RDSessMgr
3⤵
PID:5060

C:\Windows\SysWOW64\sc.exe
sc stop RemoteAccess
3⤵
PID:3352

C:\Windows\SysWOW64\sc.exe
sc stop RemoteRegistry
3⤵
PID:1520

C:\Windows\SysWOW64\sc.exe
sc stop Retaildemo
3⤵
PID:4800

C:\Windows\SysWOW64\sc.exe
sc stop RpcLocator
3⤵
PID:3700

C:\Windows\SysWOW64\sc.exe
sc stop RSVP
3⤵
PID:2252

C:\Windows\SysWOW64\sc.exe
sc stop SCardDrv
3⤵
PID:4300

C:\Windows\SysWOW64\sc.exe
sc stop SCardSvr
3⤵
PID:4140

C:\Windows\SysWOW64\sc.exe
sc stop SEMgrsvc
3⤵
PID:3940

C:\Windows\SysWOW64\sc.exe
sc stop SensorService
3⤵
PID:4988

C:\Windows\SysWOW64\sc.exe
sc stop SensrSvc
3⤵
PID:4020

C:\Windows\SysWOW64\sc.exe
sc stop Smsrouter
3⤵
PID:1696

C:\Windows\SysWOW64\sc.exe
sc stop Snmptrap
3⤵
PID:3936

C:\Windows\SysWOW64\sc.exe
sc stop SSDPSRV
3⤵
PID:4040

C:\Windows\SysWOW64\sc.exe
sc stop SysmonLog
3⤵
PID:3516

C:\Windows\SysWOW64\sc.exe
sc stop TlntSvr
3⤵
PID:1680

C:\Windows\SysWOW64\sc.exe
sc stop uploadmgr
3⤵
PID:1796

C:\Windows\SysWOW64\sc.exe
sc stop Upnphost
3⤵
PID:492

C:\Windows\SysWOW64\sc.exe
sc stop UPS
3⤵
PID:3276

C:\Windows\SysWOW64\sc.exe
sc stop vmicguestinterface
3⤵
PID:4664

C:\Windows\SysWOW64\sc.exe
sc stop vmicheartbeat
3⤵
PID:4648

C:\Windows\SysWOW64\sc.exe
sc stop vmickvpexchange
3⤵
PID:2072

C:\Windows\SysWOW64\sc.exe
sc stop vmicrdv
3⤵
PID:4448

C:\Windows\SysWOW64\sc.exe
sc stop vmicshutdown
3⤵
PID:4620

C:\Windows\SysWOW64\sc.exe
sc stop vmictimesync
3⤵
PID:3320

C:\Windows\SysWOW64\sc.exe
sc stop vmicvmsession
3⤵
PID:3040

C:\Windows\SysWOW64\sc.exe
sc stop vmicvss
3⤵
PID:4612

C:\Windows\SysWOW64\sc.exe
sc stop W32Time
3⤵
PID:752

C:\Windows\SysWOW64\sc.exe
sc stop WebClient
3⤵
PID:3388

C:\Windows\SysWOW64\sc.exe
sc stop Wersvc
3⤵
PID:1160

C:\Windows\SysWOW64\sc.exe
sc stop winrm
3⤵
PID:1176

C:\Windows\SysWOW64\sc.exe
sc stop WmdmPmSp
3⤵
PID:4000

C:\Windows\SysWOW64\sc.exe
sc stop WmiApSrv
3⤵
PID:5044

C:\Windows\SysWOW64\sc.exe
sc stop WMPNetworkSvc
3⤵
PID:5024

C:\Windows\SysWOW64\sc.exe
sc stop WZCSVC
3⤵
PID:4112

C:\Windows\SysWOW64\sc.exe
sc config Alerter start= disabled
3⤵
PID:3112

C:\Windows\SysWOW64\sc.exe
sc config Browser start= disabled
3⤵
PID:3452

C:\Windows\SysWOW64\sc.exe
sc config bthserv start= disabled
3⤵
PID:3772

C:\Windows\SysWOW64\sc.exe
sc config cisvc start= disabled
3⤵
PID:768

C:\Windows\SysWOW64\sc.exe
sc config ClipSrv start= disabled
3⤵
PID:2872

C:\Windows\SysWOW64\sc.exe
sc config CscService start= disabled
3⤵
PID:4676

C:\Windows\SysWOW64\sc.exe
sc config cscsvc start= disabled
3⤵
PID:4172

C:\Windows\SysWOW64\sc.exe
sc config DiagTrack start= disabled
3⤵
PID:3252

C:\Windows\SysWOW64\sc.exe
sc config ERSvc start= disabled
3⤵
PID:1440

C:\Windows\SysWOW64\sc.exe
sc config helpsvc start= disabled
3⤵
PID:1672

C:\Windows\SysWOW64\sc.exe
sc config HbHost start= disabled
3⤵
PID:1128

C:\Windows\SysWOW64\sc.exe
sc config HidServ start= disabled
3⤵
PID:3600

C:\Windows\SysWOW64\sc.exe
sc config HvHost start= disabled
3⤵
PID:1564

C:\Windows\SysWOW64\sc.exe
sc config LanmanServer start= disabled
3⤵
PID:3892

C:\Windows\SysWOW64\sc.exe
sc config lfsvc start= disabled
3⤵
PID:4608

C:\Windows\SysWOW64\sc.exe
sc config LmHosts start= disabled
3⤵
PID:4452

C:\Windows\SysWOW64\sc.exe
sc config MapsBroker start= disabled
3⤵
PID:4560

C:\Windows\SysWOW64\sc.exe
sc config Messenger start= disabled
3⤵
PID:816

C:\Windows\SysWOW64\sc.exe
sc config mnmsrvc start= disabled
3⤵
PID:1952

C:\Windows\SysWOW64\sc.exe
sc config NetDDE start= disabled
3⤵
PID:4224

C:\Windows\SysWOW64\sc.exe
sc config NetDDEdsdm start= disabled
3⤵
PID:968

C:\Windows\SysWOW64\sc.exe
sc config Netlogon start= disabled
3⤵
PID:976

C:\Windows\SysWOW64\sc.exe
sc config PeerDistSvc start= disabled
3⤵
PID:3752

C:\Windows\SysWOW64\sc.exe
sc config PhoneSvc start= disabled
3⤵
PID:2780

C:\Windows\SysWOW64\sc.exe
sc config PolicyAgent start= disabled
3⤵
PID:888

C:\Windows\SysWOW64\sc.exe
sc config RDSessMgr start= disabled
3⤵
PID:3164

C:\Windows\SysWOW64\sc.exe
sc config RemoteAccess start= disabled
3⤵
PID:1316

C:\Windows\SysWOW64\sc.exe
sc config RemoteRegistry start= disabled
3⤵
PID:1540

C:\Windows\SysWOW64\sc.exe
sc config Retaildemo start= disabled
3⤵
PID:3328

C:\Windows\SysWOW64\sc.exe
sc config RpcLocator start= disabled
3⤵
PID:2948

C:\Windows\SysWOW64\sc.exe
sc config RSVP start= disabled
3⤵
PID:868

C:\Windows\SysWOW64\sc.exe
sc config SCardDrv start= disabled
3⤵
PID:384

C:\Windows\SysWOW64\sc.exe
sc config SCardSvr start= disabled
3⤵
PID:3128

C:\Windows\SysWOW64\sc.exe
sc config SEMgrsvc start= disabled
3⤵
PID:1536

C:\Windows\SysWOW64\sc.exe
sc config SensorService start= disabled
3⤵
PID:2936

C:\Windows\SysWOW64\sc.exe
sc config SensrSvc start= disabled
3⤵
PID:1392

C:\Windows\SysWOW64\sc.exe
sc config Smsrouter start= disabled
3⤵
PID:396

C:\Windows\SysWOW64\sc.exe
sc config Snmptrap start= disabled
3⤵
PID:4732

C:\Windows\SysWOW64\sc.exe
sc config SSDPSRV start= disabled
3⤵
PID:764

C:\Windows\SysWOW64\sc.exe
sc config SysmonLog start= disabled
3⤵
PID:4740

C:\Windows\SysWOW64\sc.exe
sc config TlntSvr start= disabled
3⤵
PID:3088

C:\Windows\SysWOW64\sc.exe
sc config uploadmgr start= disabled
3⤵
PID:2900

C:\Windows\SysWOW64\sc.exe
sc config Upnphost start= disabled
3⤵
PID:2888

C:\Windows\SysWOW64\sc.exe
sc config UPS start= disabled
3⤵
PID:4504

C:\Windows\SysWOW64\sc.exe
sc config vmicguestinterface start= disabled
3⤵
PID:2772

C:\Windows\SysWOW64\sc.exe
sc config vmicheartbeat start= disabled
3⤵
PID:4124

C:\Windows\SysWOW64\sc.exe
sc config vmickvpexchange start= disabled
3⤵
PID:2848

C:\Windows\SysWOW64\sc.exe
sc config vmicrdv start= disabled
3⤵
PID:4396

C:\Windows\SysWOW64\sc.exe
sc config vmicshutdown start= disabled
3⤵
PID:2748

C:\Windows\SysWOW64\sc.exe
sc config vmictimesync start= disabled
3⤵
PID:824

C:\Windows\SysWOW64\sc.exe
sc config vmicvmsession start= disabled
3⤵
PID:4744

C:\Windows\SysWOW64\sc.exe
sc config vmicvss start= disabled
3⤵
PID:2576

C:\Windows\SysWOW64\sc.exe
sc config W32Time start= disabled
3⤵
PID:2572

C:\Windows\SysWOW64\sc.exe
sc config WebClient start= disabled
3⤵
PID:1936

C:\Windows\SysWOW64\sc.exe
sc config Wersvc start= disabled
3⤵
PID:5032

C:\Windows\SysWOW64\sc.exe
sc config winrm start= disabled
3⤵
PID:1780

C:\Windows\SysWOW64\sc.exe
sc config WmdmPmSp start= disabled
3⤵
PID:1372

C:\Windows\SysWOW64\sc.exe
sc config WmiApSrv start= disabled
3⤵
PID:5008

C:\Windows\SysWOW64\sc.exe
sc config WMPNetworkSvc start= disabled
3⤵
PID:2380

C:\Windows\SysWOW64\sc.exe
sc config WZCSVC start= disabled
3⤵
PID:3060

C:\Windows\SysWOW64\takeown.exe
takeown /f C:\Windows\System32\winlogon.exe
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:812

C:\Windows\SysWOW64\takeown.exe
takeown /f C:\Windows\System32\logonui.exe
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:4116

C:\Windows\SysWOW64\icacls.exe
icacls C:\Windows\System32\winlogon.exe /grant:r *S-1-2-1:RX
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:316

C:\Windows\SysWOW64\icacls.exe
icacls C:\Windows\System32\winlogon.exe /remove:g Administrators:RX
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:388

C:\Windows\SysWOW64\icacls.exe
icacls C:\Windows\System32\logonui.exe /grant:r *S-1-2-1:RX
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1272

C:\Windows\SysWOW64\icacls.exe
icacls C:\Windows\System32\logonui.exe /remove:g Administrators:RX
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:2664

C:\Windows\SysWOW64\ROUTE.EXE
route -f
3⤵
PID:3352

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

2

T1031

Privilege Escalation

Defense Evasion

Impair Defenses

1

T1562

File Permissions Modification

1

T1222

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Service Stop

1

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RarSFX0\SetupComplete.cmd
Filesize
7KB

MD5
fcc89e58c5b046a8d2c87aca544c02b3

SHA1
ebf1a16c838cd785225cfcc764292db099312f1f

SHA256
437c669010702539e319e00c5bafad509ed5b449325ba8839856977d7a8d4a29

SHA512
43d39db19456da49cc6d1db4cf41a5a177f0a1c82ea207606d7a587b228d8527bc858068b444a5c0761be507df16c473b9cfa5a2781755c145eb65d9af25e75e

Download Submit
memory/60-170-0x0000000000000000-mapping.dmp

Download
memory/444-141-0x0000000000000000-mapping.dmp

Download
memory/456-134-0x0000000000000000-mapping.dmp

Download
memory/704-175-0x0000000000000000-mapping.dmp

Download
memory/764-171-0x0000000000000000-mapping.dmp

Download
memory/1096-151-0x0000000000000000-mapping.dmp

Download
memory/1176-138-0x0000000000000000-mapping.dmp

Download
memory/1292-148-0x0000000000000000-mapping.dmp

Download
memory/1364-177-0x0000000000000000-mapping.dmp

Download
memory/1392-169-0x0000000000000000-mapping.dmp

Download
memory/1440-150-0x0000000000000000-mapping.dmp

Download
memory/1484-149-0x0000000000000000-mapping.dmp

Download
memory/1500-166-0x0000000000000000-mapping.dmp

Download
memory/1520-187-0x0000000000000000-mapping.dmp

Download
memory/1564-153-0x0000000000000000-mapping.dmp

Download
memory/1664-152-0x0000000000000000-mapping.dmp

Download
memory/1792-154-0x0000000000000000-mapping.dmp

Download
memory/1812-130-0x0000000000000000-mapping.dmp

Download
memory/1980-159-0x0000000000000000-mapping.dmp

Download
memory/2252-190-0x0000000000000000-mapping.dmp

Download
memory/2372-178-0x0000000000000000-mapping.dmp

Download
memory/2380-181-0x0000000000000000-mapping.dmp

Download
memory/2556-142-0x0000000000000000-mapping.dmp

Download
memory/2872-147-0x0000000000000000-mapping.dmp

Download
memory/2948-165-0x0000000000000000-mapping.dmp

Download
memory/3016-155-0x0000000000000000-mapping.dmp

Download
memory/3148-161-0x0000000000000000-mapping.dmp

Download
memory/3208-174-0x0000000000000000-mapping.dmp

Download
memory/3352-186-0x0000000000000000-mapping.dmp

Download
memory/3368-176-0x0000000000000000-mapping.dmp

Download
memory/3452-145-0x0000000000000000-mapping.dmp

Download
memory/3612-168-0x0000000000000000-mapping.dmp

Download
memory/3660-164-0x0000000000000000-mapping.dmp

Download
memory/3700-189-0x0000000000000000-mapping.dmp

Download
memory/3880-132-0x0000000000000000-mapping.dmp

Download
memory/3904-137-0x0000000000000000-mapping.dmp

Download
memory/3940-193-0x0000000000000000-mapping.dmp

Download
memory/3960-183-0x0000000000000000-mapping.dmp

Download
memory/3980-179-0x0000000000000000-mapping.dmp

Download
memory/3984-133-0x0000000000000000-mapping.dmp

Download
memory/4076-184-0x0000000000000000-mapping.dmp

Download
memory/4140-192-0x0000000000000000-mapping.dmp

Download
memory/4144-146-0x0000000000000000-mapping.dmp

Download
memory/4196-160-0x0000000000000000-mapping.dmp

Download
memory/4224-158-0x0000000000000000-mapping.dmp

Download
memory/4300-191-0x0000000000000000-mapping.dmp

Download
memory/4320-172-0x0000000000000000-mapping.dmp

Download
memory/4444-140-0x0000000000000000-mapping.dmp

Download
memory/4468-173-0x0000000000000000-mapping.dmp

Download
memory/4548-162-0x0000000000000000-mapping.dmp

Download
memory/4560-156-0x0000000000000000-mapping.dmp

Download
memory/4568-157-0x0000000000000000-mapping.dmp

Download
memory/4612-139-0x0000000000000000-mapping.dmp

Download
memory/4624-135-0x0000000000000000-mapping.dmp

Download
memory/4728-180-0x0000000000000000-mapping.dmp

Download
memory/4800-188-0x0000000000000000-mapping.dmp

Download
memory/4984-136-0x0000000000000000-mapping.dmp

Download
memory/4988-194-0x0000000000000000-mapping.dmp

Download
memory/5016-182-0x0000000000000000-mapping.dmp

Download
memory/5020-167-0x0000000000000000-mapping.dmp

Download
memory/5024-143-0x0000000000000000-mapping.dmp

Download
memory/5060-185-0x0000000000000000-mapping.dmp

Download
memory/5088-163-0x0000000000000000-mapping.dmp

Download
memory/5112-144-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing