896b454fc54d37f31775645ec9707e04c6996c13f0f303584ad47b9a26118a2b

General

Target

896b454fc54d37f31775645ec9707e04c6996c13f0f303584ad47b9a26118a2b.exe
Size

26KB
MD5

05b52fcc52f9ed9a6075ca818061b520
SHA1

e6da7ea0e2d2bf1a6d204a46c2422620aca07e26
SHA256

896b454fc54d37f31775645ec9707e04c6996c13f0f303584ad47b9a26118a2b
SHA512

8fdbca0f8bb7d128f96506f5474487960ff0e8c7f4662f9be3c275159efc44f3be833e391ba78b08af9579c0e6bad5ec98d25fa8ec73a64ae682c587bc670fb7
SSDEEP

768:fhLH26CG8gTC9F0w6dGPDISFPDlzr7E3ByKxKzJRl+JTc:VRFvTCEwmSNDO7tJY

Score

8^/10

discovery exploit

Malware Config

Signatures

Possible privilege escalation attempt 4 IoCs
exploit

Processes:

icacls.exetakeown.exeicacls.exetakeown.exe

pid process

4788 icacls.exe
3132 takeown.exe
308 icacls.exe
2916 takeown.exe
Modifies file permissions 1 TTPs 4 IoCs
discovery

File Permissions Modification
T1222

Processes:

takeown.exeicacls.exetakeown.exeicacls.exe

pid process

3132 takeown.exe
308 icacls.exe
2916 takeown.exe
4788 icacls.exe

pid	process
4788	icacls.exe
3132	takeown.exe
308	icacls.exe
2916	takeown.exe

pid	process
3132	takeown.exe
308	icacls.exe
2916	takeown.exe
4788	icacls.exe

Drops file in System32 directory 5 IoCs

Processes:

896b454fc54d37f31775645ec9707e04c6996c13f0f303584ad47b9a26118a2b.exe

description	ioc	process
File created	C:\Windows\SysWOW64\sxload.tmp	896b454fc54d37f31775645ec9707e04c6996c13f0f303584ad47b9a26118a2b.exe
File opened for modification	C:\Windows\SysWOW64\123F53.tmp	896b454fc54d37f31775645ec9707e04c6996c13f0f303584ad47b9a26118a2b.exe
File created	C:\Windows\SysWOW64\dllcache\rasadhlp.dll	896b454fc54d37f31775645ec9707e04c6996c13f0f303584ad47b9a26118a2b.exe
File opened for modification	C:\Windows\SysWOW64\123900D.tmp	896b454fc54d37f31775645ec9707e04c6996c13f0f303584ad47b9a26118a2b.exe
File created	C:\Windows\SysWOW64\dllcache\midimap.dll	896b454fc54d37f31775645ec9707e04c6996c13f0f303584ad47b9a26118a2b.exe

Drops file in Program Files directory 1 IoCs

Processes:

896b454fc54d37f31775645ec9707e04c6996c13f0f303584ad47b9a26118a2b.exe

description ioc process

File created C:\Program Files (x86)\Common Files\sxmy.tmp 896b454fc54d37f31775645ec9707e04c6996c13f0f303584ad47b9a26118a2b.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

3104 taskkill.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\sxmy.tmp	896b454fc54d37f31775645ec9707e04c6996c13f0f303584ad47b9a26118a2b.exe

pid	process
3104	taskkill.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

896b454fc54d37f31775645ec9707e04c6996c13f0f303584ad47b9a26118a2b.exe

pid	process
4984	896b454fc54d37f31775645ec9707e04c6996c13f0f303584ad47b9a26118a2b.exe
4984	896b454fc54d37f31775645ec9707e04c6996c13f0f303584ad47b9a26118a2b.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

896b454fc54d37f31775645ec9707e04c6996c13f0f303584ad47b9a26118a2b.exetakeown.exetakeown.exetaskkill.exe

description	pid	process
Token: SeDebugPrivilege	4984	896b454fc54d37f31775645ec9707e04c6996c13f0f303584ad47b9a26118a2b.exe
Token: SeTakeOwnershipPrivilege	3132	takeown.exe
Token: SeTakeOwnershipPrivilege	2916	takeown.exe
Token: SeDebugPrivilege	3104	taskkill.exe

Suspicious use of FindShellTrayWindow 8 IoCs

Processes:

896b454fc54d37f31775645ec9707e04c6996c13f0f303584ad47b9a26118a2b.exe

pid	process
4984	896b454fc54d37f31775645ec9707e04c6996c13f0f303584ad47b9a26118a2b.exe
4984	896b454fc54d37f31775645ec9707e04c6996c13f0f303584ad47b9a26118a2b.exe
4984	896b454fc54d37f31775645ec9707e04c6996c13f0f303584ad47b9a26118a2b.exe
4984	896b454fc54d37f31775645ec9707e04c6996c13f0f303584ad47b9a26118a2b.exe
4984	896b454fc54d37f31775645ec9707e04c6996c13f0f303584ad47b9a26118a2b.exe
4984	896b454fc54d37f31775645ec9707e04c6996c13f0f303584ad47b9a26118a2b.exe
4984	896b454fc54d37f31775645ec9707e04c6996c13f0f303584ad47b9a26118a2b.exe
4984	896b454fc54d37f31775645ec9707e04c6996c13f0f303584ad47b9a26118a2b.exe

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

896b454fc54d37f31775645ec9707e04c6996c13f0f303584ad47b9a26118a2b.execmd.execmd.exe

description	pid	process	target process
PID 4984 wrote to memory of 3088	4984	896b454fc54d37f31775645ec9707e04c6996c13f0f303584ad47b9a26118a2b.exe	cmd.exe
PID 4984 wrote to memory of 3088	4984	896b454fc54d37f31775645ec9707e04c6996c13f0f303584ad47b9a26118a2b.exe	cmd.exe
PID 4984 wrote to memory of 3088	4984	896b454fc54d37f31775645ec9707e04c6996c13f0f303584ad47b9a26118a2b.exe	cmd.exe
PID 3088 wrote to memory of 3132	3088	cmd.exe	takeown.exe
PID 3088 wrote to memory of 3132	3088	cmd.exe	takeown.exe
PID 3088 wrote to memory of 3132	3088	cmd.exe	takeown.exe
PID 3088 wrote to memory of 308	3088	cmd.exe	icacls.exe
PID 3088 wrote to memory of 308	3088	cmd.exe	icacls.exe
PID 3088 wrote to memory of 308	3088	cmd.exe	icacls.exe
PID 4984 wrote to memory of 320	4984	896b454fc54d37f31775645ec9707e04c6996c13f0f303584ad47b9a26118a2b.exe	cmd.exe
PID 4984 wrote to memory of 320	4984	896b454fc54d37f31775645ec9707e04c6996c13f0f303584ad47b9a26118a2b.exe	cmd.exe
PID 4984 wrote to memory of 320	4984	896b454fc54d37f31775645ec9707e04c6996c13f0f303584ad47b9a26118a2b.exe	cmd.exe
PID 320 wrote to memory of 2916	320	cmd.exe	takeown.exe
PID 320 wrote to memory of 2916	320	cmd.exe	takeown.exe
PID 320 wrote to memory of 2916	320	cmd.exe	takeown.exe
PID 320 wrote to memory of 4788	320	cmd.exe	icacls.exe
PID 320 wrote to memory of 4788	320	cmd.exe	icacls.exe
PID 320 wrote to memory of 4788	320	cmd.exe	icacls.exe
PID 4984 wrote to memory of 3104	4984	896b454fc54d37f31775645ec9707e04c6996c13f0f303584ad47b9a26118a2b.exe	taskkill.exe
PID 4984 wrote to memory of 3104	4984	896b454fc54d37f31775645ec9707e04c6996c13f0f303584ad47b9a26118a2b.exe	taskkill.exe
PID 4984 wrote to memory of 3104	4984	896b454fc54d37f31775645ec9707e04c6996c13f0f303584ad47b9a26118a2b.exe	taskkill.exe
PID 4984 wrote to memory of 4180	4984	896b454fc54d37f31775645ec9707e04c6996c13f0f303584ad47b9a26118a2b.exe	cmd.exe
PID 4984 wrote to memory of 4180	4984	896b454fc54d37f31775645ec9707e04c6996c13f0f303584ad47b9a26118a2b.exe	cmd.exe
PID 4984 wrote to memory of 4180	4984	896b454fc54d37f31775645ec9707e04c6996c13f0f303584ad47b9a26118a2b.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\896b454fc54d37f31775645ec9707e04c6996c13f0f303584ad47b9a26118a2b.exe
"C:\Users\Admin\AppData\Local\Temp\896b454fc54d37f31775645ec9707e04c6996c13f0f303584ad47b9a26118a2b.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4984

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c takeown /f "C:\Windows\system32\rasadhlp.dll" && icacls "C:\Windows\system32\rasadhlp.dll" /grant administrators:F
2⤵
- Suspicious use of WriteProcessMemory
PID:3088

C:\Windows\SysWOW64\takeown.exe
takeown /f "C:\Windows\system32\rasadhlp.dll"
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:3132

C:\Windows\SysWOW64\icacls.exe
icacls "C:\Windows\system32\rasadhlp.dll" /grant administrators:F
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:308

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c takeown /f "C:\Windows\system32\midimap.dll" && icacls "C:\Windows\system32\midimap.dll" /grant administrators:F
2⤵
- Suspicious use of WriteProcessMemory
PID:320

C:\Windows\SysWOW64\takeown.exe
takeown /f "C:\Windows\system32\midimap.dll"
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:2916

C:\Windows\SysWOW64\icacls.exe
icacls "C:\Windows\system32\midimap.dll" /grant administrators:F
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:4788

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "soul.exe"
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3104

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c 1.bat
2⤵
PID:4180

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File Permissions Modification

1

T1222

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1.bat
Filesize
251B

MD5
7c12d268e4b947de02f85d7bc526e4f2

SHA1
3abed93ebf6c3226aacb351f9135f0b25c2d78ff

SHA256
d87728727e28d48c96ea2aaf2e77bf32e496120212e6e2eb60455e8a9678940d

SHA512
5a3d261e342aaffb960db01cf72abd46907295952607c5ff5bf3891f72205af40a994060557df267f5726e7ef7d6ebc7e99036bacd6d4be591a5723d61d50c29

Download Submit
memory/308-134-0x0000000000000000-mapping.dmp

Download
memory/320-135-0x0000000000000000-mapping.dmp

Download
memory/2916-136-0x0000000000000000-mapping.dmp

Download
memory/3088-132-0x0000000000000000-mapping.dmp

Download
memory/3104-138-0x0000000000000000-mapping.dmp

Download
memory/3132-133-0x0000000000000000-mapping.dmp

Download
memory/4180-139-0x0000000000000000-mapping.dmp

Download
memory/4788-137-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads