eadaf26df948f0fd541f297e2f0bad435aa4bee5c97e4324ad767dacca77e29d

Analysis

max time kernel
141s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
09-05-2023 19:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Abantes.exe
Size

2.7MB
MD5

cd2e58136d3049e9be40ae29f9250c93
SHA1

e97beb8b87d130e5c5745981e3614ed6aa3caae3
SHA256

dac4b5511343cf863832e38886af8a3e1d55529648314eb02cc21fa3979f6419
SHA512

3ad23ad35d23acfa9edc187f443f28c4bb11279472632726f450b10cc09a653e10f4832f9cca44d063ad1259de6c7017ca6ca8f64ed07d302c3b2d06628f0ba7
SSDEEP

49152:yi98eUDa7+tCg3e+zNWZjUDa7+tCg3e+zNWyUDa7+tCg3e+zNWR9Bh:yAC+7+p3ej2+7+p3ejh+7+p3ejDBh

Score

10^/10

discovery evasion exploit persistence ransomware trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

Abantes.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe, C:\\Windows\\Defender\\Abantes.exe"	Abantes.exe

UAC bypass 3 TTPs 1 IoCs
evasion trojan

Bypass User Account Control
T1088

Disabling Security Tools
T1089

Modify Registry
T1112

Processes:

Abantes.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Abantes.exe
Disables Task Manager via registry modification
evasion
Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exe

pid process

3720 netsh.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Abantes.exe

pid	process
3720	netsh.exe

Possible privilege escalation attempt 14 IoCs

exploit

Processes:

takeown.exeicacls.exetakeown.exetakeown.exeicacls.exeicacls.exeicacls.exetakeown.exetakeown.exeicacls.exetakeown.exeicacls.exetakeown.exeicacls.exe

pid	process
3564	takeown.exe
4632	icacls.exe
4844	takeown.exe
3492	takeown.exe
1756	icacls.exe
4936	icacls.exe
216	icacls.exe
3552	takeown.exe
872	takeown.exe
3448	icacls.exe
228	takeown.exe
1412	icacls.exe
4848	takeown.exe
4568	icacls.exe

Sets file execution options in registry 2 TTPs 49 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Abantes.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WindowsAnytimeUpgradeui.exe	Abantes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\StikyNot.exe\Debugger = "C:\\Windows\\Defender\\IFEO.exe"	Abantes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mstsc.exe\Debugger = "C:\\Windows\\Defender\\IFEO.exe"	Abantes.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\chrome.exe	Abantes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\chrome.exe\Debugger = "C:\\Windows\\Defender\\IFEO.exe"	Abantes.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe	Abantes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DVDMaker.exe\Debugger = "C:\\Windows\\Defender\\IFEO.exe"	Abantes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ehshell.exe\Debugger = "C:\\Windows\\Defender\\IFEO.exe"	Abantes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdge.exe\Debugger = "C:\\Windows\\Defender\\IFEO.exe"	Abantes.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\resmon.exe	Abantes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe\Debugger = "C:\\Windows\\Defender\\IFEO.exe"	Abantes.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe	Abantes.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe	Abantes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "C:\\Windows\\Defender\\IFEO.exe"	Abantes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\opera.exe\Debugger = "C:\\Windows\\Defender\\IFEO.exe"	Abantes.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\firefox.exe	Abantes.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp64.exe	Abantes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe\Debugger = "C:\\Windows\\Defender\\IFEO.exe"	Abantes.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mspaint.exe	Abantes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mspaint.exe\Debugger = "C:\\Windows\\Defender\\IFEO.exe"	Abantes.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DVDMaker.exe	Abantes.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xpsrchvw.exe	Abantes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplore.exe\Debugger = "C:\\Windows\\Defender\\IFEO.exe"	Abantes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeCP.exe\Debugger = "C:\\Windows\\Defender\\IFEO.exe"	Abantes.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdge.exe	Abantes.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\calc.exe	Abantes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\calc.exe\Debugger = "C:\\Windows\\Defender\\IFEO.exe"	Abantes.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wmplayer.exe	Abantes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SnippingTool.exe\Debugger = "C:\\Windows\\Defender\\IFEO.exe"	Abantes.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\opera.exe	Abantes.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe	Abantes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe\Debugger = "C:\\Windows\\Defender\\IFEO.exe"	Abantes.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SnippingTool.exe	Abantes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WindowsAnytimeUpgrade.exe\Debugger = "C:\\Windows\\Defender\\IFEO.exe"	Abantes.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeCP.exe	Abantes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp64.exe\Debugger = "C:\\Windows\\Defender\\IFEO.exe"	Abantes.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mstsc.exe	Abantes.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HelpPane.exe	Abantes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HelpPane.exe\Debugger = "C:\\Windows\\Defender\\IFEO.exe"	Abantes.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wordpad.exe	Abantes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WindowsAnytimeUpgradeui.exe\Debugger = "C:\\Windows\\Defender\\IFEO.exe"	Abantes.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WindowsAnytimeUpgrade.exe	Abantes.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\StikyNot.exe	Abantes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xpsrchvw.exe\Debugger = "C:\\Windows\\Defender\\IFEO.exe"	Abantes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wmplayer.exe\Debugger = "C:\\Windows\\Defender\\IFEO.exe"	Abantes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wordpad.exe\Debugger = "C:\\Windows\\Defender\\IFEO.exe"	Abantes.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ehshell.exe	Abantes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\firefox.exe\Debugger = "C:\\Windows\\Defender\\IFEO.exe"	Abantes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\resmon.exe\Debugger = "C:\\Windows\\Defender\\IFEO.exe"	Abantes.exe

Modifies file permissions 1 TTPs 14 IoCs

discovery

File and Directory Permissions Modification

T1222

Processes:

takeown.exeicacls.exeicacls.exetakeown.exetakeown.exetakeown.exeicacls.exetakeown.exetakeown.exetakeown.exeicacls.exeicacls.exeicacls.exeicacls.exe

pid	process
872	takeown.exe
1412	icacls.exe
1756	icacls.exe
4844	takeown.exe
3564	takeown.exe
4848	takeown.exe
216	icacls.exe
228	takeown.exe
3552	takeown.exe
3492	takeown.exe
3448	icacls.exe
4936	icacls.exe
4632	icacls.exe
4568	icacls.exe

Modifies system executable filetype association 2 TTPs 1 IoCs
persistence

Modify Registry
T1112

Change Default File Association
T1042

Processes:

Abantes.exe

description ioc process

Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\DefaultIcon\ = "C:\\Windows\\Defender\\icon.ico" Abantes.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\DefaultIcon\ = "C:\\Windows\\Defender\\icon.ico"	Abantes.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

Abantes.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Abantes.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Abantes.exe

Modifies WinLogon 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

Abantes.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoRestartShell = "0"	Abantes.exe

Drops file in System32 directory 2 IoCs

Processes:

cmd.exe

description	ioc	process
File created	C:\Windows\SysWOW64\en-US\authui.dll.mui	cmd.exe
File opened for modification	C:\Windows\SysWOW64\en-US\authui.dll.mui	cmd.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

Abantes.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper.bmp"	Abantes.exe

Drops file in Windows directory 17 IoCs

Processes:

Abantes.execmd.exe

description	ioc	process
File created	C:\Windows\Defender\cursor.cur	Abantes.exe
File created	C:\Windows\Defender\IFEO.exe	Abantes.exe
File created	C:\Windows\Defender\LogonUi.exe	Abantes.exe
File created	C:\Windows\Defender\authui.dll.mui	Abantes.exe
File opened for modification	C:\Windows\Defender\wallpaper.jpg	Abantes.exe
File created	C:\Windows\Defender\Abantes.exe	Abantes.exe
File created	C:\Windows\Defender\Action.bat	Abantes.exe
File created	C:\Windows\Defender\LogonUIStart.exe	Abantes.exe
File created	C:\Windows\Defender\Payloads.dll	Abantes.exe
File created	C:\Windows\Defender\explorer.exe.mui	Abantes.exe
File opened for modification	C:\Windows\en-US\explorer.exe.mui	cmd.exe
File created	C:\Windows\Defender\logonOverwrite.bat	Abantes.exe
File created	C:\Windows\Defender\icon.ico	Abantes.exe
File created	C:\Windows\Defender\Rules.exe	Abantes.exe
File created	C:\Windows\Defender\data.bin	Abantes.exe
File opened for modification	C:\Windows\Defender\Abantes.exe	Abantes.exe
File opened for modification	C:\Windows\Defender	Abantes.exe

Delays execution with timeout.exe 2 IoCs
evasion

Processes:

timeout.exetimeout.exe

pid process

3768 timeout.exe
1296 timeout.exe
Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

4812 taskkill.exe

pid	process
3768	timeout.exe
1296	timeout.exe

pid	process
4812	taskkill.exe

Modifies Control Panel 16 IoCs

evasion

Processes:

Abantes.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\Cursors\Arrow = "C:\\Windows\\Defender\\cursor.cur"	Abantes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\Cursors\Hand = "C:\\Windows\\Defender\\cursor.cur"	Abantes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\Cursors\SizeNS = "C:\\Windows\\Defender\\cursor.cur"	Abantes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\Cursors\SizeAll = "C:\\Windows\\Defender\\cursor.cur"	Abantes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\Cursors\NWPen = "C:\\Windows\\Defender\\cursor.cur"	Abantes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\Cursors\AppStarting = "C:\\Windows\\Defender\\cursor.cur"	Abantes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\Cursors\UpArrow = "C:\\Windows\\Defender\\cursor.cur"	Abantes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\Cursors\No = "C:\\Windows\\Defender\\cursor.cur"	Abantes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\Cursors\SizeNWSE = "C:\\Windows\\Defender\\cursor.cur"	Abantes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\Cursors\SizeNESW = "C:\\Windows\\Defender\\cursor.cur"	Abantes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\Desktop\WallpaperStyle = "2"	Abantes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\Desktop\TileWallpaper = "0"	Abantes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\Cursors\Help = "C:\\Windows\\Defender\\cursor.cur"	Abantes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\Mouse\MouseTrails = "7"	Abantes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\Cursors\Wait = "C:\\Windows\\Defender\\cursor.cur"	Abantes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\Cursors\SizeWE = "C:\\Windows\\Defender\\cursor.cur"	Abantes.exe

Modifies registry class 2 IoCs

Processes:

Abantes.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\DefaultIcon\ = "C:\\Windows\\Defender\\icon.ico"	Abantes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\DefaultIcon\ = "C:\\Windows\\Defender\\icon.ico"	Abantes.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

Abantes.exe

pid process

1312 Abantes.exe

pid	process
1312	Abantes.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

Abantes.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exeWMIC.exeWMIC.exe

description	pid	process
Token: SeDebugPrivilege	1312	Abantes.exe
Token: SeTakeOwnershipPrivilege	4844	takeown.exe
Token: SeTakeOwnershipPrivilege	228	takeown.exe
Token: SeTakeOwnershipPrivilege	3552	takeown.exe
Token: SeTakeOwnershipPrivilege	872	takeown.exe
Token: SeTakeOwnershipPrivilege	3492	takeown.exe
Token: SeTakeOwnershipPrivilege	4848	takeown.exe
Token: SeIncreaseQuotaPrivilege	4312	WMIC.exe
Token: SeSecurityPrivilege	4312	WMIC.exe
Token: SeTakeOwnershipPrivilege	4312	WMIC.exe
Token: SeLoadDriverPrivilege	4312	WMIC.exe
Token: SeSystemProfilePrivilege	4312	WMIC.exe
Token: SeSystemtimePrivilege	4312	WMIC.exe
Token: SeProfSingleProcessPrivilege	4312	WMIC.exe
Token: SeIncBasePriorityPrivilege	4312	WMIC.exe
Token: SeCreatePagefilePrivilege	4312	WMIC.exe
Token: SeBackupPrivilege	4312	WMIC.exe
Token: SeRestorePrivilege	4312	WMIC.exe
Token: SeShutdownPrivilege	4312	WMIC.exe
Token: SeDebugPrivilege	4312	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4312	WMIC.exe
Token: SeRemoteShutdownPrivilege	4312	WMIC.exe
Token: SeUndockPrivilege	4312	WMIC.exe
Token: SeManageVolumePrivilege	4312	WMIC.exe
Token: 33	4312	WMIC.exe
Token: 34	4312	WMIC.exe
Token: 35	4312	WMIC.exe
Token: 36	4312	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4312	WMIC.exe
Token: SeSecurityPrivilege	4312	WMIC.exe
Token: SeTakeOwnershipPrivilege	4312	WMIC.exe
Token: SeLoadDriverPrivilege	4312	WMIC.exe
Token: SeSystemProfilePrivilege	4312	WMIC.exe
Token: SeSystemtimePrivilege	4312	WMIC.exe
Token: SeProfSingleProcessPrivilege	4312	WMIC.exe
Token: SeIncBasePriorityPrivilege	4312	WMIC.exe
Token: SeCreatePagefilePrivilege	4312	WMIC.exe
Token: SeBackupPrivilege	4312	WMIC.exe
Token: SeRestorePrivilege	4312	WMIC.exe
Token: SeShutdownPrivilege	4312	WMIC.exe
Token: SeDebugPrivilege	4312	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4312	WMIC.exe
Token: SeRemoteShutdownPrivilege	4312	WMIC.exe
Token: SeUndockPrivilege	4312	WMIC.exe
Token: SeManageVolumePrivilege	4312	WMIC.exe
Token: 33	4312	WMIC.exe
Token: 34	4312	WMIC.exe
Token: 35	4312	WMIC.exe
Token: 36	4312	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5104	WMIC.exe
Token: SeSecurityPrivilege	5104	WMIC.exe
Token: SeTakeOwnershipPrivilege	5104	WMIC.exe
Token: SeLoadDriverPrivilege	5104	WMIC.exe
Token: SeSystemProfilePrivilege	5104	WMIC.exe
Token: SeSystemtimePrivilege	5104	WMIC.exe
Token: SeProfSingleProcessPrivilege	5104	WMIC.exe
Token: SeIncBasePriorityPrivilege	5104	WMIC.exe
Token: SeCreatePagefilePrivilege	5104	WMIC.exe
Token: SeBackupPrivilege	5104	WMIC.exe
Token: SeRestorePrivilege	5104	WMIC.exe
Token: SeShutdownPrivilege	5104	WMIC.exe
Token: SeDebugPrivilege	5104	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5104	WMIC.exe
Token: SeRemoteShutdownPrivilege	5104	WMIC.exe

Suspicious use of WriteProcessMemory 63 IoCs

Processes:

Abantes.execmd.exe

description	pid	process	target process
PID 1312 wrote to memory of 4296	1312	Abantes.exe	cmd.exe
PID 1312 wrote to memory of 4296	1312	Abantes.exe	cmd.exe
PID 1312 wrote to memory of 4296	1312	Abantes.exe	cmd.exe
PID 4296 wrote to memory of 4844	4296	cmd.exe	takeown.exe
PID 4296 wrote to memory of 4844	4296	cmd.exe	takeown.exe
PID 4296 wrote to memory of 4844	4296	cmd.exe	takeown.exe
PID 4296 wrote to memory of 216	4296	cmd.exe	icacls.exe
PID 4296 wrote to memory of 216	4296	cmd.exe	icacls.exe
PID 4296 wrote to memory of 216	4296	cmd.exe	icacls.exe
PID 4296 wrote to memory of 228	4296	cmd.exe	takeown.exe
PID 4296 wrote to memory of 228	4296	cmd.exe	takeown.exe
PID 4296 wrote to memory of 228	4296	cmd.exe	takeown.exe
PID 4296 wrote to memory of 1412	4296	cmd.exe	icacls.exe
PID 4296 wrote to memory of 1412	4296	cmd.exe	icacls.exe
PID 4296 wrote to memory of 1412	4296	cmd.exe	icacls.exe
PID 4296 wrote to memory of 3552	4296	cmd.exe	takeown.exe
PID 4296 wrote to memory of 3552	4296	cmd.exe	takeown.exe
PID 4296 wrote to memory of 3552	4296	cmd.exe	takeown.exe
PID 4296 wrote to memory of 872	4296	cmd.exe	takeown.exe
PID 4296 wrote to memory of 872	4296	cmd.exe	takeown.exe
PID 4296 wrote to memory of 872	4296	cmd.exe	takeown.exe
PID 4296 wrote to memory of 3492	4296	cmd.exe	takeown.exe
PID 4296 wrote to memory of 3492	4296	cmd.exe	takeown.exe
PID 4296 wrote to memory of 3492	4296	cmd.exe	takeown.exe
PID 4296 wrote to memory of 3564	4296	cmd.exe	takeown.exe
PID 4296 wrote to memory of 3564	4296	cmd.exe	takeown.exe
PID 4296 wrote to memory of 3564	4296	cmd.exe	takeown.exe
PID 4296 wrote to memory of 4848	4296	cmd.exe	takeown.exe
PID 4296 wrote to memory of 4848	4296	cmd.exe	takeown.exe
PID 4296 wrote to memory of 4848	4296	cmd.exe	takeown.exe
PID 4296 wrote to memory of 1756	4296	cmd.exe	icacls.exe
PID 4296 wrote to memory of 1756	4296	cmd.exe	icacls.exe
PID 4296 wrote to memory of 1756	4296	cmd.exe	icacls.exe
PID 4296 wrote to memory of 3448	4296	cmd.exe	icacls.exe
PID 4296 wrote to memory of 3448	4296	cmd.exe	icacls.exe
PID 4296 wrote to memory of 3448	4296	cmd.exe	icacls.exe
PID 4296 wrote to memory of 4936	4296	cmd.exe	icacls.exe
PID 4296 wrote to memory of 4936	4296	cmd.exe	icacls.exe
PID 4296 wrote to memory of 4936	4296	cmd.exe	icacls.exe
PID 4296 wrote to memory of 4632	4296	cmd.exe	icacls.exe
PID 4296 wrote to memory of 4632	4296	cmd.exe	icacls.exe
PID 4296 wrote to memory of 4632	4296	cmd.exe	icacls.exe
PID 4296 wrote to memory of 4568	4296	cmd.exe	icacls.exe
PID 4296 wrote to memory of 4568	4296	cmd.exe	icacls.exe
PID 4296 wrote to memory of 4568	4296	cmd.exe	icacls.exe
PID 4296 wrote to memory of 4312	4296	cmd.exe	WMIC.exe
PID 4296 wrote to memory of 4312	4296	cmd.exe	WMIC.exe
PID 4296 wrote to memory of 4312	4296	cmd.exe	WMIC.exe
PID 4296 wrote to memory of 5104	4296	cmd.exe	WMIC.exe
PID 4296 wrote to memory of 5104	4296	cmd.exe	WMIC.exe
PID 4296 wrote to memory of 5104	4296	cmd.exe	WMIC.exe
PID 4296 wrote to memory of 3720	4296	cmd.exe	netsh.exe
PID 4296 wrote to memory of 3720	4296	cmd.exe	netsh.exe
PID 4296 wrote to memory of 3720	4296	cmd.exe	netsh.exe
PID 4296 wrote to memory of 4812	4296	cmd.exe	taskkill.exe
PID 4296 wrote to memory of 4812	4296	cmd.exe	taskkill.exe
PID 4296 wrote to memory of 4812	4296	cmd.exe	taskkill.exe
PID 4296 wrote to memory of 3768	4296	cmd.exe	timeout.exe
PID 4296 wrote to memory of 3768	4296	cmd.exe	timeout.exe
PID 4296 wrote to memory of 3768	4296	cmd.exe	timeout.exe
PID 4296 wrote to memory of 1296	4296	cmd.exe	timeout.exe
PID 4296 wrote to memory of 1296	4296	cmd.exe	timeout.exe
PID 4296 wrote to memory of 1296	4296	cmd.exe	timeout.exe

System policy modification 1 TTPs 4 IoCs

evasion

Modify Registry

T1112

Processes:

Abantes.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticecaption = "Welcome To Hell"	Abantes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticetext = "This Computer has been Infected by the Abantes Trojan. Hope You Enjoy."	Abantes.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Abantes.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives = "67108863"	Abantes.exe

C:\Users\Admin\AppData\Local\Temp\Abantes.exe
"C:\Users\Admin\AppData\Local\Temp\Abantes.exe"
1⤵
- Modifies WinLogon for persistence
- UAC bypass
- Sets file execution options in registry
- Modifies system executable filetype association
- Checks whether UAC is enabled
- Modifies WinLogon
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1312
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Windows\Defender\Action.bat""
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:4296
- - C:\Windows\SysWOW64\takeown.exe
    takeown /f logonui.exe
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:4844
- - C:\Windows\SysWOW64\icacls.exe
    icacls logonui.exe /granted Admin:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:216
- - C:\Windows\SysWOW64\takeown.exe
    takeown /f "C:\Windows\System32\en-US" /r /d y
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:228
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Windows\System32\en-US" /granted Admin:F /T /C
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1412
- - C:\Windows\SysWOW64\takeown.exe
    takeown /f explorer.exe
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:3552
- - C:\Windows\SysWOW64\takeown.exe
    takeown /f regedit.exe
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:872
- - C:\Windows\SysWOW64\takeown.exe
    takeown /f HelpPane.exe
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:3492
- - C:\Windows\SysWOW64\takeown.exe
    takeown /f "C:\Windows\Temp" /r /d y
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:3564
- - C:\Windows\SysWOW64\takeown.exe
    takeown /f "C:\Windows\en-US" /r /d y
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:4848
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Windows\Temp" /granted Admin:F /T /C
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1756
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Windows\en-US" /granted Admin:F /T /C
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:3448
- - C:\Windows\SysWOW64\icacls.exe
    icacls regedit.exe /granted Admin:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4936
- - C:\Windows\SysWOW64\icacls.exe
    icacls explorer.exe /granted Admin:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4632
- - C:\Windows\SysWOW64\icacls.exe
    icacls HelpPane.exe /granted Admin:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4568
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic useraccount where name='Admin' set FullName='Abantes Was Here'
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4312
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic useraccount where name='Admin' rename 'Abantes Was Here'
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5104
- - C:\Windows\SysWOW64\netsh.exe
    NetSh Advfirewall set allprofiles state off
    3⤵
    - Modifies Windows Firewall
    PID:3720
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    - Kills process with taskkill
    PID:4812
- - C:\Windows\SysWOW64\timeout.exe
    TIMEOUT 1
    3⤵
    - Delays execution with timeout.exe
    PID:3768
- - C:\Windows\SysWOW64\timeout.exe
    TIMEOUT 2
    3⤵
    - Delays execution with timeout.exe
    PID:1296

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Change Default File Association

T1042

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Defender\Action.bat

Filesize
1KB

MD5
8b3585b4f84496c306b6c082ea6e52ef

SHA1
04bf1cf0f68a571e746fb7c863f71fa70e0e79d3

SHA256
d06d5f8501501af5677b133ff7aa531ccf1bf9b2673a1f26117f0420532b599e

SHA512
733bb98473fc8b3c8f0f96ff5ccec9212c36f7162742ee124d6a0edd0186e171ec61de97a3268663812802c90d29cd1e5077af72e02f550d94d67ebe106c0591

Download Submit
C:\Windows\Defender\authui.dll.mui

Filesize
21KB

MD5
a3a8fb6325f2f4fd31039775be19a9a4

SHA1
dba1acba938c8720b23b992ef77f130b6dbe7428

SHA256
6baf83c2c45f0e3a1a1dedc799cce6adb766dabe25baa847f9dd308aae0218eb

SHA512
9a03528d3b1a6a0bc3fbce6149d1cf6e21fe629c53d1b93954e6147cdfbf95eb272e75dbf906e38a1981706e71f679fda680cdf8601491ba792576c9b54d043e

Download Submit
C:\Windows\Defender\explorer.exe.mui

Filesize
15KB

MD5
39f1a6a8b713fcf30afc03ea3c936f85

SHA1
9209b25730c7896e047e5a4fc1da73c294e55c0e

SHA256
b69b61675531060d350a795a53568ccf19a146060cebb659ebc658a0e8b27fc9

SHA512
82b402b1c94fb8444e9d32f10becad994715667fc36d427faf6ae4f433c8e7025c3ca387e6cae7fb4e14f2e9f36446354c1c2585445fd79e7673b78419232780

Download Submit
memory/1312-133-0x0000000000A50000-0x0000000000D08000-memory.dmp

Filesize
2.7MB

Download
memory/1312-134-0x0000000005DE0000-0x0000000006384000-memory.dmp

Filesize
5.6MB

Download
memory/1312-135-0x0000000005760000-0x00000000057F2000-memory.dmp

Filesize
584KB

Download
memory/1312-136-0x0000000005800000-0x000000000580A000-memory.dmp

Filesize
40KB

Download
memory/1312-137-0x0000000005820000-0x0000000005830000-memory.dmp

Filesize
64KB

Download
memory/1312-161-0x0000000005820000-0x0000000005830000-memory.dmp

Filesize
64KB

Download