dd55905f8fe4508b83843cacbfb939a26f28f6e13bd1e67a5d9439846ad0be17

Analysis

max time kernel
143s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
14/02/2024, 12:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9baf063d8dd7a22a52642c7eabc33b19.exe
Size 33KB
Sample240214-prphvsad6t
SHA256 dd55905f8fe4508b83843cacbfb939a26f28f6e13bd1e67a5d9439846ad0be17
MD5 9baf063d8dd7a22a52642c7eabc33b19
SHA1 a5d4047f5ba6aca4f5c5ef51112c4d4951f88232
SHA512 248ed029897b9c800b41beb6f6cd990d5b15c5612b80bce8300054e18c776e5d400a56c9f799f283c9f5ea111dd9f6cda752c448e5e8a6547fa32cec52a4c6a7
SSDEEP 768:Ed2yO/m2lFquFYkC7nzXkYPMWR1+9aw2oNjUUrMhgcDO9:Ed2yOe2YkCzzhPMQc9B267rwE9
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

discovery exploit

Malware Config

Signatures

Possible privilege escalation attempt 2 IoCs

exploit

pid	Process
4244	icacls.exe
4488	takeown.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4488	takeown.exe
4244	icacls.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\ole.dll	9baf063d8dd7a22a52642c7eabc33b19.exe
File created	C:\Windows\SysWOW64\imm32.dll.log	9baf063d8dd7a22a52642c7eabc33b19.exe
File opened for modification	C:\Windows\SysWOW64\imm32.dll.log	9baf063d8dd7a22a52642c7eabc33b19.exe
File created	C:\Windows\SysWOW64\imm32.dll	9baf063d8dd7a22a52642c7eabc33b19.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
1224	taskkill.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1664	9baf063d8dd7a22a52642c7eabc33b19.exe
1664	9baf063d8dd7a22a52642c7eabc33b19.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1664	9baf063d8dd7a22a52642c7eabc33b19.exe
Token: SeDebugPrivilege	1224	taskkill.exe
Token: SeTakeOwnershipPrivilege	4488	takeown.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1664	9baf063d8dd7a22a52642c7eabc33b19.exe
1664	9baf063d8dd7a22a52642c7eabc33b19.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1664 wrote to memory of 1224	1664	9baf063d8dd7a22a52642c7eabc33b19.exe	84
PID 1664 wrote to memory of 1224	1664	9baf063d8dd7a22a52642c7eabc33b19.exe	84
PID 1664 wrote to memory of 1224	1664	9baf063d8dd7a22a52642c7eabc33b19.exe	84
PID 1664 wrote to memory of 4488	1664	9baf063d8dd7a22a52642c7eabc33b19.exe	87
PID 1664 wrote to memory of 4488	1664	9baf063d8dd7a22a52642c7eabc33b19.exe	87
PID 1664 wrote to memory of 4488	1664	9baf063d8dd7a22a52642c7eabc33b19.exe	87
PID 1664 wrote to memory of 4244	1664	9baf063d8dd7a22a52642c7eabc33b19.exe	89
PID 1664 wrote to memory of 4244	1664	9baf063d8dd7a22a52642c7eabc33b19.exe	89
PID 1664 wrote to memory of 4244	1664	9baf063d8dd7a22a52642c7eabc33b19.exe	89
PID 1664 wrote to memory of 1336	1664	9baf063d8dd7a22a52642c7eabc33b19.exe	94
PID 1664 wrote to memory of 1336	1664	9baf063d8dd7a22a52642c7eabc33b19.exe	94
PID 1664 wrote to memory of 1336	1664	9baf063d8dd7a22a52642c7eabc33b19.exe	94

C:\Users\Admin\AppData\Local\Temp\9baf063d8dd7a22a52642c7eabc33b19.exe
"C:\Users\Admin\AppData\Local\Temp\9baf063d8dd7a22a52642c7eabc33b19.exe"
1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1664
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM NVCAgent.npc
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1224
- C:\Windows\SysWOW64\takeown.exe
  takeown /F C:\Windows\system32\imm32.dll
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  - Suspicious use of AdjustPrivilegeToken
  PID:4488
- C:\Windows\SysWOW64\icacls.exe
  icacls C:\Windows\system32\imm32.dll /grant administrators:f
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:4244
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c c:\clr_e579d49.bat
  2⤵
  PID:1336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_sfdg6587621d~.tmp

Path C:\Users\Admin\AppData\Local\Temp\_sfdg6587621d~.tmp
Size 143KB
SHA256 ad52a0d1011fa4a137a4cc2812b2c459542911c0e1464c5698828d80e9835c3e
MD5 4d6c2379f33bf8fa570eca6ed9696189
SHA1 09c05f9b78771914a853db4719faf101f882ce78
SHA512 a1e3bfe8701fd2e3f7f7e5f12a064611f8da8808f9385b39c127833569671c0a9a3a68f012c8548e740c8fcdafd7345618bdccd1173c4b5357e13ad64c2d8c30
SSDEEP 3072:MfO+/BD8Gf2AeZJhJirgq/e6ryRorncmDH2ejupbs6mh2m5sHhkoKs:PZJAg16rYo7cdG+bJmh2m5sH+
MD5 SHA1 SHA512 SSDEEP

Submit Download

clr_e579d49.bat

Path \??\c:\clr_e579d49.bat
Size 210B
SHA256 570775f10d1c0ab9f0591a6a3bf677d9797ea2d8c23ce2f363277bdd65b3ddfb
MD5 ace2220ca1e5c94ccd4931f81497d3ab
SHA1 127327e1773b92335475493108d7e8e5dfc7fe8b
SHA512 e1158065511510f6747002e9a9a95432cb2f23d805b5c357234ad44b3174549c6af963071564dc70c4edf5ea39966e3247cba10ef91592ec573b4ca74500abb7
MD5 SHA1 SHA512

Submit Download

memory/1664-0-0x0000000000400000-0x0000000000425000-memory.dmp

Download

memory/1664-1-0x00000000004E0000-0x00000000004E1000-memory.dmp

Download

memory/1664-11-0x00000000778F0000-0x0000000077915000-memory.dmp

Download

memory/1664-12-0x0000000000400000-0x0000000000425000-memory.dmp

Download