Analysis
-
max time kernel
187s -
max time network
248s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
27-11-2022 22:50
Static task
static1
Behavioral task
behavioral1
Sample
67382d2ccc2b1d509f43d9d51690c34ebb881148c3cba06bae8ff93ecd3ef53f.exe
Resource
win7-20220812-en
General
-
Target
67382d2ccc2b1d509f43d9d51690c34ebb881148c3cba06bae8ff93ecd3ef53f.exe
-
Size
27KB
-
MD5
291c6983919cf96defb04dc705d71b80
-
SHA1
ecaef7540497fadef77d80542a7633e2e7422bb8
-
SHA256
67382d2ccc2b1d509f43d9d51690c34ebb881148c3cba06bae8ff93ecd3ef53f
-
SHA512
96e135ad1876464c10b7f50b752b8113da501100b9fc31159a8e837ece66a9e50efdf4c925ca35379ef2a5a5c8f2a16cdf43913840e53df3348dfed70f32702d
-
SSDEEP
768:ruM/sYxbXAVliI+xBA7fdz4qsS/eqk/k0:ruMhUbixUL9Cd
Malware Config
Signatures
-
Possible privilege escalation attempt 6 IoCs
Processes:
takeown.exeicacls.exetakeown.exeicacls.exetakeown.exeicacls.exepid process 2392 takeown.exe 1328 icacls.exe 2080 takeown.exe 3556 icacls.exe 744 takeown.exe 916 icacls.exe -
Modifies file permissions 1 TTPs 6 IoCs
Processes:
icacls.exetakeown.exeicacls.exetakeown.exeicacls.exetakeown.exepid process 916 icacls.exe 2392 takeown.exe 1328 icacls.exe 2080 takeown.exe 3556 icacls.exe 744 takeown.exe -
Drops file in System32 directory 7 IoCs
Processes:
67382d2ccc2b1d509f43d9d51690c34ebb881148c3cba06bae8ff93ecd3ef53f.exedescription ioc process File created C:\Windows\SysWOW64\sxload.tmp 67382d2ccc2b1d509f43d9d51690c34ebb881148c3cba06bae8ff93ecd3ef53f.exe File opened for modification C:\Windows\SysWOW64\123FFA.tmp 67382d2ccc2b1d509f43d9d51690c34ebb881148c3cba06bae8ff93ecd3ef53f.exe File created C:\Windows\SysWOW64\dllcache\iphlpapi.dll 67382d2ccc2b1d509f43d9d51690c34ebb881148c3cba06bae8ff93ecd3ef53f.exe File opened for modification C:\Windows\SysWOW64\1231DD6.tmp 67382d2ccc2b1d509f43d9d51690c34ebb881148c3cba06bae8ff93ecd3ef53f.exe File created C:\Windows\SysWOW64\dllcache\rasadhlp.dll 67382d2ccc2b1d509f43d9d51690c34ebb881148c3cba06bae8ff93ecd3ef53f.exe File opened for modification C:\Windows\SysWOW64\1232401.tmp 67382d2ccc2b1d509f43d9d51690c34ebb881148c3cba06bae8ff93ecd3ef53f.exe File created C:\Windows\SysWOW64\dllcache\midimap.dll 67382d2ccc2b1d509f43d9d51690c34ebb881148c3cba06bae8ff93ecd3ef53f.exe -
Drops file in Program Files directory 1 IoCs
Processes:
67382d2ccc2b1d509f43d9d51690c34ebb881148c3cba06bae8ff93ecd3ef53f.exedescription ioc process File created C:\Program Files (x86)\Common Files\sxmxd.tmp 67382d2ccc2b1d509f43d9d51690c34ebb881148c3cba06bae8ff93ecd3ef53f.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 5100 taskkill.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
67382d2ccc2b1d509f43d9d51690c34ebb881148c3cba06bae8ff93ecd3ef53f.exepid process 4436 67382d2ccc2b1d509f43d9d51690c34ebb881148c3cba06bae8ff93ecd3ef53f.exe 4436 67382d2ccc2b1d509f43d9d51690c34ebb881148c3cba06bae8ff93ecd3ef53f.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
67382d2ccc2b1d509f43d9d51690c34ebb881148c3cba06bae8ff93ecd3ef53f.exetakeown.exetaskkill.exedescription pid process Token: SeDebugPrivilege 4436 67382d2ccc2b1d509f43d9d51690c34ebb881148c3cba06bae8ff93ecd3ef53f.exe Token: SeTakeOwnershipPrivilege 2392 takeown.exe Token: SeDebugPrivilege 5100 taskkill.exe -
Suspicious use of FindShellTrayWindow 12 IoCs
Processes:
67382d2ccc2b1d509f43d9d51690c34ebb881148c3cba06bae8ff93ecd3ef53f.exepid process 4436 67382d2ccc2b1d509f43d9d51690c34ebb881148c3cba06bae8ff93ecd3ef53f.exe 4436 67382d2ccc2b1d509f43d9d51690c34ebb881148c3cba06bae8ff93ecd3ef53f.exe 4436 67382d2ccc2b1d509f43d9d51690c34ebb881148c3cba06bae8ff93ecd3ef53f.exe 4436 67382d2ccc2b1d509f43d9d51690c34ebb881148c3cba06bae8ff93ecd3ef53f.exe 4436 67382d2ccc2b1d509f43d9d51690c34ebb881148c3cba06bae8ff93ecd3ef53f.exe 4436 67382d2ccc2b1d509f43d9d51690c34ebb881148c3cba06bae8ff93ecd3ef53f.exe 4436 67382d2ccc2b1d509f43d9d51690c34ebb881148c3cba06bae8ff93ecd3ef53f.exe 4436 67382d2ccc2b1d509f43d9d51690c34ebb881148c3cba06bae8ff93ecd3ef53f.exe 4436 67382d2ccc2b1d509f43d9d51690c34ebb881148c3cba06bae8ff93ecd3ef53f.exe 4436 67382d2ccc2b1d509f43d9d51690c34ebb881148c3cba06bae8ff93ecd3ef53f.exe 4436 67382d2ccc2b1d509f43d9d51690c34ebb881148c3cba06bae8ff93ecd3ef53f.exe 4436 67382d2ccc2b1d509f43d9d51690c34ebb881148c3cba06bae8ff93ecd3ef53f.exe -
Suspicious use of WriteProcessMemory 42 IoCs
Processes:
67382d2ccc2b1d509f43d9d51690c34ebb881148c3cba06bae8ff93ecd3ef53f.execmd.execmd.execmd.execmd.execmd.execmd.exedescription pid process target process PID 4436 wrote to memory of 2156 4436 67382d2ccc2b1d509f43d9d51690c34ebb881148c3cba06bae8ff93ecd3ef53f.exe cmd.exe PID 4436 wrote to memory of 2156 4436 67382d2ccc2b1d509f43d9d51690c34ebb881148c3cba06bae8ff93ecd3ef53f.exe cmd.exe PID 4436 wrote to memory of 2156 4436 67382d2ccc2b1d509f43d9d51690c34ebb881148c3cba06bae8ff93ecd3ef53f.exe cmd.exe PID 2156 wrote to memory of 4460 2156 cmd.exe cmd.exe PID 2156 wrote to memory of 4460 2156 cmd.exe cmd.exe PID 2156 wrote to memory of 4460 2156 cmd.exe cmd.exe PID 4460 wrote to memory of 2392 4460 cmd.exe takeown.exe PID 4460 wrote to memory of 2392 4460 cmd.exe takeown.exe PID 4460 wrote to memory of 2392 4460 cmd.exe takeown.exe PID 2156 wrote to memory of 1328 2156 cmd.exe icacls.exe PID 2156 wrote to memory of 1328 2156 cmd.exe icacls.exe PID 2156 wrote to memory of 1328 2156 cmd.exe icacls.exe PID 4436 wrote to memory of 4868 4436 67382d2ccc2b1d509f43d9d51690c34ebb881148c3cba06bae8ff93ecd3ef53f.exe cmd.exe PID 4436 wrote to memory of 4868 4436 67382d2ccc2b1d509f43d9d51690c34ebb881148c3cba06bae8ff93ecd3ef53f.exe cmd.exe PID 4436 wrote to memory of 4868 4436 67382d2ccc2b1d509f43d9d51690c34ebb881148c3cba06bae8ff93ecd3ef53f.exe cmd.exe PID 4868 wrote to memory of 3828 4868 cmd.exe cmd.exe PID 4868 wrote to memory of 3828 4868 cmd.exe cmd.exe PID 4868 wrote to memory of 3828 4868 cmd.exe cmd.exe PID 3828 wrote to memory of 2080 3828 cmd.exe takeown.exe PID 3828 wrote to memory of 2080 3828 cmd.exe takeown.exe PID 3828 wrote to memory of 2080 3828 cmd.exe takeown.exe PID 4868 wrote to memory of 3556 4868 cmd.exe icacls.exe PID 4868 wrote to memory of 3556 4868 cmd.exe icacls.exe PID 4868 wrote to memory of 3556 4868 cmd.exe icacls.exe PID 4436 wrote to memory of 3716 4436 67382d2ccc2b1d509f43d9d51690c34ebb881148c3cba06bae8ff93ecd3ef53f.exe cmd.exe PID 4436 wrote to memory of 3716 4436 67382d2ccc2b1d509f43d9d51690c34ebb881148c3cba06bae8ff93ecd3ef53f.exe cmd.exe PID 4436 wrote to memory of 3716 4436 67382d2ccc2b1d509f43d9d51690c34ebb881148c3cba06bae8ff93ecd3ef53f.exe cmd.exe PID 3716 wrote to memory of 5064 3716 cmd.exe cmd.exe PID 3716 wrote to memory of 5064 3716 cmd.exe cmd.exe PID 3716 wrote to memory of 5064 3716 cmd.exe cmd.exe PID 5064 wrote to memory of 744 5064 cmd.exe takeown.exe PID 5064 wrote to memory of 744 5064 cmd.exe takeown.exe PID 5064 wrote to memory of 744 5064 cmd.exe takeown.exe PID 3716 wrote to memory of 916 3716 cmd.exe icacls.exe PID 3716 wrote to memory of 916 3716 cmd.exe icacls.exe PID 3716 wrote to memory of 916 3716 cmd.exe icacls.exe PID 4436 wrote to memory of 5100 4436 67382d2ccc2b1d509f43d9d51690c34ebb881148c3cba06bae8ff93ecd3ef53f.exe taskkill.exe PID 4436 wrote to memory of 5100 4436 67382d2ccc2b1d509f43d9d51690c34ebb881148c3cba06bae8ff93ecd3ef53f.exe taskkill.exe PID 4436 wrote to memory of 5100 4436 67382d2ccc2b1d509f43d9d51690c34ebb881148c3cba06bae8ff93ecd3ef53f.exe taskkill.exe PID 4436 wrote to memory of 3992 4436 67382d2ccc2b1d509f43d9d51690c34ebb881148c3cba06bae8ff93ecd3ef53f.exe cmd.exe PID 4436 wrote to memory of 3992 4436 67382d2ccc2b1d509f43d9d51690c34ebb881148c3cba06bae8ff93ecd3ef53f.exe cmd.exe PID 4436 wrote to memory of 3992 4436 67382d2ccc2b1d509f43d9d51690c34ebb881148c3cba06bae8ff93ecd3ef53f.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\67382d2ccc2b1d509f43d9d51690c34ebb881148c3cba06bae8ff93ecd3ef53f.exe"C:\Users\Admin\AppData\Local\Temp\67382d2ccc2b1d509f43d9d51690c34ebb881148c3cba06bae8ff93ecd3ef53f.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 2.bat2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /c takeown /f "C:\Windows\System32"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32"4⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32" /grant administrators:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 2.bat2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /c takeown /f "C:\Windows\System32"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32"4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32" /grant administrators:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 2.bat2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /c takeown /f "C:\Windows\System32"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32"4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32" /grant administrators:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im "maplestory.exe"2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 1.bat2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\1.batFilesize
253B
MD5b84bbc273b9c1462ea67c2c2b4685b6f
SHA160c9a5a94099c536cda8c4267f4c030b39dc1de0
SHA256ee0245ba98376c0822e61c6c22424553afb8185ed1e05782b7209dfa1c5c056e
SHA512d4a718708eb0e79858d81c5b6a3c2135507ad853c0aba9e5578e4c49fd0a36fd873c46241af29f49ec01f2f78a2a845be1266774fe745cf0a0a7e5bf269c5d3e
-
C:\Users\Admin\AppData\Local\Temp\2.batFilesize
110B
MD512e768a105dc0d143a5f5becdd12167a
SHA18f82f11fc9b8921b1a80eb23b600d243a8756766
SHA2560f909a1c0e0cddb3f99f0a7bac66a86797f25635b15fb25faa0bffcc5e702056
SHA5123ba416aa4d0575fe281b24b1cc7401254ad2c38de37b340a780e8796f34738d48f6a89801596bbfaed009c1fb74255cf0caf49997cf1e679ea6075b02b758c77
-
C:\Users\Admin\AppData\Local\Temp\2.batFilesize
110B
MD512e768a105dc0d143a5f5becdd12167a
SHA18f82f11fc9b8921b1a80eb23b600d243a8756766
SHA2560f909a1c0e0cddb3f99f0a7bac66a86797f25635b15fb25faa0bffcc5e702056
SHA5123ba416aa4d0575fe281b24b1cc7401254ad2c38de37b340a780e8796f34738d48f6a89801596bbfaed009c1fb74255cf0caf49997cf1e679ea6075b02b758c77
-
C:\Users\Admin\AppData\Local\Temp\2.batFilesize
110B
MD512e768a105dc0d143a5f5becdd12167a
SHA18f82f11fc9b8921b1a80eb23b600d243a8756766
SHA2560f909a1c0e0cddb3f99f0a7bac66a86797f25635b15fb25faa0bffcc5e702056
SHA5123ba416aa4d0575fe281b24b1cc7401254ad2c38de37b340a780e8796f34738d48f6a89801596bbfaed009c1fb74255cf0caf49997cf1e679ea6075b02b758c77
-
C:\Windows\SysWOW64\dllcache\iphlpapi.dllFilesize
192KB
MD5e3f75f63f56789e5a3edb85f17933594
SHA1d4a9ad438971294099f1b14b67f2d2f33ca19498
SHA2568c6cbc631ec4013a3b99726f6bcaf3f8e11cb3f64a3ebf68b6e0e69cfaad54ce
SHA512bfb732a68b5c5072caa0d4303bfdbaf0a74ee6bcd1cb2dbb32e0bd041a6693beff641124be57dacf4e0e1886e5e2988bcbe1e597f5a4aa8933ed5dd2de4c1a34
-
C:\Windows\SysWOW64\dllcache\rasadhlp.dllFilesize
12KB
MD5ccc8b561f91537b54ea41ae10b60b2dc
SHA172c5bb4adf50cbcf9053b05ff35e5d8b97537305
SHA256a3b573b45ad961bd358cf751f409fef62b9571c822fdeb6fd40fa64821f43271
SHA5126e9f5e5638024bb704938bda9c0f686607e4c5530714ac684e74567d73d6b984dd06ced2d5b0f9fffc2b897aae2412cdf81dc1c78d611b829a89fdc559fe870f
-
C:\Windows\SysWOW64\iphlpapi.dllFilesize
192KB
MD5e3f75f63f56789e5a3edb85f17933594
SHA1d4a9ad438971294099f1b14b67f2d2f33ca19498
SHA2568c6cbc631ec4013a3b99726f6bcaf3f8e11cb3f64a3ebf68b6e0e69cfaad54ce
SHA512bfb732a68b5c5072caa0d4303bfdbaf0a74ee6bcd1cb2dbb32e0bd041a6693beff641124be57dacf4e0e1886e5e2988bcbe1e597f5a4aa8933ed5dd2de4c1a34
-
C:\Windows\SysWOW64\rasadhlp.dllFilesize
12KB
MD5ccc8b561f91537b54ea41ae10b60b2dc
SHA172c5bb4adf50cbcf9053b05ff35e5d8b97537305
SHA256a3b573b45ad961bd358cf751f409fef62b9571c822fdeb6fd40fa64821f43271
SHA5126e9f5e5638024bb704938bda9c0f686607e4c5530714ac684e74567d73d6b984dd06ced2d5b0f9fffc2b897aae2412cdf81dc1c78d611b829a89fdc559fe870f
-
memory/744-147-0x0000000000000000-mapping.dmp
-
memory/916-148-0x0000000000000000-mapping.dmp
-
memory/1328-136-0x0000000000000000-mapping.dmp
-
memory/2080-140-0x0000000000000000-mapping.dmp
-
memory/2156-132-0x0000000000000000-mapping.dmp
-
memory/2392-135-0x0000000000000000-mapping.dmp
-
memory/3556-141-0x0000000000000000-mapping.dmp
-
memory/3716-144-0x0000000000000000-mapping.dmp
-
memory/3828-139-0x0000000000000000-mapping.dmp
-
memory/3992-152-0x0000000000000000-mapping.dmp
-
memory/4460-134-0x0000000000000000-mapping.dmp
-
memory/4868-137-0x0000000000000000-mapping.dmp
-
memory/5064-146-0x0000000000000000-mapping.dmp
-
memory/5100-151-0x0000000000000000-mapping.dmp