ba1460c7db6d6b4ce1acdcd533a0c31ff6a58b79207e35a2fe8f4a02dbef1ad4

Resubmissions

19-03-2023 20:59

230319-zszqbscb6z 8

Analysis

max time kernel
97s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20230220-es
resource tags

arch:x64arch:x86image:win10v2004-20230220-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
19-03-2023 20:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cmd.bat.ps1
Size

85B
MD5

16516dc452a82d806ca6ee7c5e27caa8
SHA1

285ccd3a98cda64133672b6574ef3a4297844c6d
SHA256

ba1460c7db6d6b4ce1acdcd533a0c31ff6a58b79207e35a2fe8f4a02dbef1ad4
SHA512

b9a12a9b6c6a50ebaa3fcd0f40fc8e1c8ac7f339bbd44ded9c729cc38945f015e6afce4a85e3910502fe794e9a7970ac5c86673712c362294a440718ef2d80ac

Score

8^/10

discovery exploit

Malware Config

Signatures

Possible privilege escalation attempt 2 IoCs
exploit

Processes:

takeown.exeicacls.exe

pid process

3272 takeown.exe
4076 icacls.exe
Modifies file permissions 1 TTPs 2 IoCs
discovery

File Permissions Modification
T1222

Processes:

takeown.exeicacls.exe

pid process

3272 takeown.exe
4076 icacls.exe
Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

1920 taskkill.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid process

2828 powershell.exe
2828 powershell.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

powershell.exetakeown.exetaskkill.exe

description pid process

Token: SeDebugPrivilege 2828 powershell.exe
Token: SeTakeOwnershipPrivilege 3272 takeown.exe
Token: SeDebugPrivilege 1920 taskkill.exe

pid	process
3272	takeown.exe
4076	icacls.exe

pid	process
3272	takeown.exe
4076	icacls.exe

pid	process
1920	taskkill.exe

pid	process
2828	powershell.exe
2828	powershell.exe

description	pid	process
Token: SeDebugPrivilege	2828	powershell.exe
Token: SeTakeOwnershipPrivilege	3272	takeown.exe
Token: SeDebugPrivilege	1920	taskkill.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

powershell.exe

description	pid	process	target process
PID 2828 wrote to memory of 3272	2828	powershell.exe	takeown.exe
PID 2828 wrote to memory of 3272	2828	powershell.exe	takeown.exe
PID 2828 wrote to memory of 4076	2828	powershell.exe	icacls.exe
PID 2828 wrote to memory of 4076	2828	powershell.exe	icacls.exe
PID 2828 wrote to memory of 1920	2828	powershell.exe	taskkill.exe
PID 2828 wrote to memory of 1920	2828	powershell.exe	taskkill.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\cmd.bat.ps1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2828

C:\Windows\system32\takeown.exe
"C:\Windows\system32\takeown.exe" /f C:\Windows\System32
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:3272

C:\Windows\system32\icacls.exe
"C:\Windows\system32\icacls.exe" C:\Windows\System32
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:4076

C:\Windows\system32\taskkill.exe
"C:\Windows\system32\taskkill.exe" /f /im csrss.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1920

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ygqhkwvb.eaq.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/2828-133-0x0000022C73DE0000-0x0000022C73E62000-memory.dmp

Filesize
520KB

Download
memory/2828-139-0x0000022C5AA60000-0x0000022C5AA82000-memory.dmp

Filesize
136KB

Download
memory/2828-144-0x0000022C5A9E0000-0x0000022C5A9F0000-memory.dmp

Filesize
64KB

Download
memory/2828-145-0x0000022C742A0000-0x0000022C743A2000-memory.dmp

Filesize
1.0MB

Download
memory/2828-147-0x0000022C73040000-0x0000022C73050000-memory.dmp

Filesize
64KB

Download
memory/2828-146-0x0000022C73040000-0x0000022C73050000-memory.dmp

Filesize
64KB

Download
memory/2828-148-0x0000022C73040000-0x0000022C73050000-memory.dmp

Filesize
64KB

Download
memory/2828-151-0x0000022C73E70000-0x0000022C7408C000-memory.dmp

Filesize
2.1MB

Download