Analysis

  • max time kernel
    119s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    01-03-2024 00:00

General

  • Target

    winact.bat

  • Size

    954KB

  • MD5

    65f4fdd243532ebcab61bcf9916623a2

  • SHA1

    de664b1bd89ee8101a651878aa28cd71ae71721e

  • SHA256

    6626cdbc6e4f16638523acfb157386e1294df9829d6b124e385a487c2dcfad90

  • SHA512

    576fb719fcb544e43fdf4843613ac5c81f46451840b928bf0276407b0d0213f859ea8c87f9bf1b345264bd4b0f04d00018a1e0567882474e6bfc5805f688a720

  • SSDEEP

    24576:Lsq0VLxdxvKdEAwEUMxhaZx/U1cWnl0kH:LWLxJEJ4DSTnljH

Score
8/10

Malware Config

Signatures

  • Possible privilege escalation attempt 3 IoCs
  • Modifies file permissions 1 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\winact.bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2228
    • C:\Windows\system32\takeown.exe
      takeown /F C:\Windows\System32\sppsvc.exe
      2⤵
      • Possible privilege escalation attempt
      • Modifies file permissions
      • Suspicious use of AdjustPrivilegeToken
      PID:2124
    • C:\Windows\system32\icacls.exe
      icacls C:\Windows\System32 /grant administrators:F /T
      2⤵
      • Possible privilege escalation attempt
      • Modifies file permissions
      PID:2852
    • C:\Windows\system32\icacls.exe
      icacls C:\Windows\System32\spp /grant administrators:F /T
      2⤵
      • Possible privilege escalation attempt
      • Modifies file permissions
      PID:2892
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -c $acl = Get-Acl 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform'; $rule = New-Object System.Security.AccessControl.RegistryAccessRule ('NT Service\sppsvc','FullControl','ContainerInherit, ObjectInherit','None','Allow'); $acl.SetAccessRule($rule); Set-Acl -Path 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -AclObject $acl
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2944
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -c $acl = Get-Acl 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP'; $rule = New-Object System.Security.AccessControl.RegistryAccessRule ('NT Service\sppsvc','FullControl','ContainerInherit, ObjectInherit','None','Allow'); $acl.SetAccessRule($rule); Set-Acl -Path 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP' -AclObject $acl
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2516
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -c $acl = Get-Acl 'HKLM:\SYSTEM\CurrentControlSet\Services\SPPSVC'; $rule = New-Object System.Security.AccessControl.RegistryAccessRule ('NT Service\sppsvc','FullControl','ContainerInherit, ObjectInherit','None','Allow'); $acl.SetAccessRule($rule); Set-Acl -Path 'HKLM:\SYSTEM\CurrentControlSet\Services\SPPSVC' -AclObject $acl
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2528
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -c $acl = Get-Acl 'HKLM:\SYSTEM\WPA'; $rule = New-Object System.Security.AccessControl.RegistryAccessRule ('NT Service\sppsvc','FullControl','ContainerInherit, ObjectInherit','None','Allow'); $acl.SetAccessRule($rule); Set-Acl -Path 'HKLM:\SYSTEM\WPA' -AclObject $acl
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2388

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

    Filesize

    7KB

    MD5

    ef4fa9d7b3b2fb4b4aff1d4dff2a4318

    SHA1

    0e7390b004386ccf207d40552d619d40efa0a72f

    SHA256

    f21f4290f360a216570df6de51c96e44e80eb38341fc6aaef01de94ec0c37284

    SHA512

    21f36e2a73834a6188f7cbbea50b75e84648190a935518505a98cf103815ea1fbc6d6543e797a4182eb56010952bfb05763cb9ce2134bd41e9ab44657c0e5b94

  • memory/2388-47-0x000007FEF49D0000-0x000007FEF536D000-memory.dmp

    Filesize

    9.6MB

  • memory/2388-46-0x000007FEF49D0000-0x000007FEF536D000-memory.dmp

    Filesize

    9.6MB

  • memory/2388-45-0x00000000025C0000-0x0000000002640000-memory.dmp

    Filesize

    512KB

  • memory/2388-44-0x00000000025C0000-0x0000000002640000-memory.dmp

    Filesize

    512KB

  • memory/2388-43-0x00000000025C0000-0x0000000002640000-memory.dmp

    Filesize

    512KB

  • memory/2388-42-0x000007FEF49D0000-0x000007FEF536D000-memory.dmp

    Filesize

    9.6MB

  • memory/2516-22-0x0000000002860000-0x00000000028E0000-memory.dmp

    Filesize

    512KB

  • memory/2516-24-0x000007FEF49D0000-0x000007FEF536D000-memory.dmp

    Filesize

    9.6MB

  • memory/2516-17-0x000007FEF49D0000-0x000007FEF536D000-memory.dmp

    Filesize

    9.6MB

  • memory/2516-18-0x0000000002860000-0x00000000028E0000-memory.dmp

    Filesize

    512KB

  • memory/2516-19-0x00000000023A0000-0x00000000023A8000-memory.dmp

    Filesize

    32KB

  • memory/2516-20-0x0000000002860000-0x00000000028E0000-memory.dmp

    Filesize

    512KB

  • memory/2516-21-0x000007FEF49D0000-0x000007FEF536D000-memory.dmp

    Filesize

    9.6MB

  • memory/2516-16-0x000000001B1A0000-0x000000001B482000-memory.dmp

    Filesize

    2.9MB

  • memory/2516-23-0x0000000002860000-0x00000000028E0000-memory.dmp

    Filesize

    512KB

  • memory/2528-31-0x00000000024F0000-0x0000000002570000-memory.dmp

    Filesize

    512KB

  • memory/2528-36-0x00000000024FB000-0x0000000002562000-memory.dmp

    Filesize

    412KB

  • memory/2528-30-0x000007FEF5370000-0x000007FEF5D0D000-memory.dmp

    Filesize

    9.6MB

  • memory/2528-32-0x000007FEF5370000-0x000007FEF5D0D000-memory.dmp

    Filesize

    9.6MB

  • memory/2528-33-0x00000000024F0000-0x0000000002570000-memory.dmp

    Filesize

    512KB

  • memory/2528-35-0x000007FEF5370000-0x000007FEF5D0D000-memory.dmp

    Filesize

    9.6MB

  • memory/2528-34-0x00000000024F0000-0x0000000002570000-memory.dmp

    Filesize

    512KB

  • memory/2944-4-0x000000001B300000-0x000000001B5E2000-memory.dmp

    Filesize

    2.9MB

  • memory/2944-8-0x000007FEF5370000-0x000007FEF5D0D000-memory.dmp

    Filesize

    9.6MB

  • memory/2944-10-0x0000000002AA0000-0x0000000002B20000-memory.dmp

    Filesize

    512KB

  • memory/2944-9-0x0000000002AA0000-0x0000000002B20000-memory.dmp

    Filesize

    512KB

  • memory/2944-7-0x000007FEF5370000-0x000007FEF5D0D000-memory.dmp

    Filesize

    9.6MB

  • memory/2944-6-0x0000000002AA4000-0x0000000002AA7000-memory.dmp

    Filesize

    12KB

  • memory/2944-5-0x0000000002320000-0x0000000002328000-memory.dmp

    Filesize

    32KB

  • memory/2944-48-0x0000000002AA0000-0x0000000002B20000-memory.dmp

    Filesize

    512KB