ba1460c7db6d6b4ce1acdcd533a0c31ff6a58b79207e35a2fe8f4a02dbef1ad4

Resubmissions

19-03-2023 20:59

230319-zszqbscb6z 8

Analysis

max time kernel
29s
max time network
32s
platform
windows7_x64
resource
win7-20230220-es
resource tags

arch:x64arch:x86image:win7-20230220-eslocale:es-esos:windows7-x64systemwindows
submitted
19-03-2023 20:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cmd.bat.ps1
Size

85B
MD5

16516dc452a82d806ca6ee7c5e27caa8
SHA1

285ccd3a98cda64133672b6574ef3a4297844c6d
SHA256

ba1460c7db6d6b4ce1acdcd533a0c31ff6a58b79207e35a2fe8f4a02dbef1ad4
SHA512

b9a12a9b6c6a50ebaa3fcd0f40fc8e1c8ac7f339bbd44ded9c729cc38945f015e6afce4a85e3910502fe794e9a7970ac5c86673712c362294a440718ef2d80ac

Score

8^/10

discovery exploit

Malware Config

Signatures

Possible privilege escalation attempt 2 IoCs
exploit

Processes:

takeown.exeicacls.exe

pid process

1716 takeown.exe
776 icacls.exe
Modifies file permissions 1 TTPs 2 IoCs
discovery

File Permissions Modification
T1222

Processes:

takeown.exeicacls.exe

pid process

1716 takeown.exe
776 icacls.exe
Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

1408 taskkill.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

924 powershell.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

powershell.exetakeown.exetaskkill.exe

description pid process

Token: SeDebugPrivilege 924 powershell.exe
Token: SeTakeOwnershipPrivilege 1716 takeown.exe
Token: SeDebugPrivilege 1408 taskkill.exe

pid	process
1716	takeown.exe
776	icacls.exe

pid	process
1716	takeown.exe
776	icacls.exe

pid	process
1408	taskkill.exe

pid	process
924	powershell.exe

description	pid	process
Token: SeDebugPrivilege	924	powershell.exe
Token: SeTakeOwnershipPrivilege	1716	takeown.exe
Token: SeDebugPrivilege	1408	taskkill.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

powershell.exe

description	pid	process	target process
PID 924 wrote to memory of 1716	924	powershell.exe	takeown.exe
PID 924 wrote to memory of 1716	924	powershell.exe	takeown.exe
PID 924 wrote to memory of 1716	924	powershell.exe	takeown.exe
PID 924 wrote to memory of 776	924	powershell.exe	icacls.exe
PID 924 wrote to memory of 776	924	powershell.exe	icacls.exe
PID 924 wrote to memory of 776	924	powershell.exe	icacls.exe
PID 924 wrote to memory of 1408	924	powershell.exe	taskkill.exe
PID 924 wrote to memory of 1408	924	powershell.exe	taskkill.exe
PID 924 wrote to memory of 1408	924	powershell.exe	taskkill.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\cmd.bat.ps1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:924

C:\Windows\system32\takeown.exe
"C:\Windows\system32\takeown.exe" /f C:\Windows\System32
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:1716

C:\Windows\system32\icacls.exe
"C:\Windows\system32\icacls.exe" C:\Windows\System32
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:776

C:\Windows\system32\taskkill.exe
"C:\Windows\system32\taskkill.exe" /f /im csrss.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1408

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/924-58-0x000000001B1F0000-0x000000001B4D2000-memory.dmp

Filesize
2.9MB

Download
memory/924-59-0x00000000022B0000-0x00000000022B8000-memory.dmp

Filesize
32KB

Download
memory/924-60-0x00000000022D0000-0x00000000022DE000-memory.dmp

Filesize
56KB

Download
memory/924-61-0x0000000002710000-0x0000000002756000-memory.dmp

Filesize
280KB

Download
memory/924-62-0x0000000002520000-0x000000000252A000-memory.dmp

Filesize
40KB

Download
memory/924-63-0x0000000002760000-0x0000000002768000-memory.dmp

Filesize
32KB

Download
memory/924-64-0x000000001BB70000-0x000000001BBBE000-memory.dmp

Filesize
312KB

Download
memory/924-65-0x00000000029E0000-0x0000000002A60000-memory.dmp

Filesize
512KB

Download
memory/924-66-0x00000000029E0000-0x0000000002A60000-memory.dmp

Filesize
512KB

Download
memory/924-67-0x00000000029E0000-0x0000000002A60000-memory.dmp

Filesize
512KB

Download
memory/924-68-0x00000000029E0000-0x0000000002A60000-memory.dmp

Filesize
512KB

Download