Analysis Overview
SHA256
6626cdbc6e4f16638523acfb157386e1294df9829d6b124e385a487c2dcfad90
Threat Level: Likely malicious
The file winact.bat was found to be: Likely malicious.
Malicious Activity Summary
Possible privilege escalation attempt
Modifies file permissions
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-03-01 00:00
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2024-03-01 00:00
Reported
2024-03-01 00:03
Platform
win7-20240221-en
Max time kernel
119s
Max time network
122s
Command Line
Signatures
Possible privilege escalation attempt
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\icacls.exe | N/A |
| N/A | N/A | C:\Windows\system32\takeown.exe | N/A |
| N/A | N/A | C:\Windows\system32\icacls.exe | N/A |
Modifies file permissions
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\takeown.exe | N/A |
| N/A | N/A | C:\Windows\system32\icacls.exe | N/A |
| N/A | N/A | C:\Windows\system32\icacls.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\system32\takeown.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\winact.bat"
C:\Windows\system32\takeown.exe
takeown /F C:\Windows\System32\sppsvc.exe
C:\Windows\system32\icacls.exe
icacls C:\Windows\System32 /grant administrators:F /T
C:\Windows\system32\icacls.exe
icacls C:\Windows\System32\spp /grant administrators:F /T
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -c $acl = Get-Acl 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform'; $rule = New-Object System.Security.AccessControl.RegistryAccessRule ('NT Service\sppsvc','FullControl','ContainerInherit, ObjectInherit','None','Allow'); $acl.SetAccessRule($rule); Set-Acl -Path 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -AclObject $acl
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -c $acl = Get-Acl 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP'; $rule = New-Object System.Security.AccessControl.RegistryAccessRule ('NT Service\sppsvc','FullControl','ContainerInherit, ObjectInherit','None','Allow'); $acl.SetAccessRule($rule); Set-Acl -Path 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP' -AclObject $acl
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -c $acl = Get-Acl 'HKLM:\SYSTEM\CurrentControlSet\Services\SPPSVC'; $rule = New-Object System.Security.AccessControl.RegistryAccessRule ('NT Service\sppsvc','FullControl','ContainerInherit, ObjectInherit','None','Allow'); $acl.SetAccessRule($rule); Set-Acl -Path 'HKLM:\SYSTEM\CurrentControlSet\Services\SPPSVC' -AclObject $acl
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -c $acl = Get-Acl 'HKLM:\SYSTEM\WPA'; $rule = New-Object System.Security.AccessControl.RegistryAccessRule ('NT Service\sppsvc','FullControl','ContainerInherit, ObjectInherit','None','Allow'); $acl.SetAccessRule($rule); Set-Acl -Path 'HKLM:\SYSTEM\WPA' -AclObject $acl
Network
Files
memory/2944-4-0x000000001B300000-0x000000001B5E2000-memory.dmp
memory/2944-5-0x0000000002320000-0x0000000002328000-memory.dmp
memory/2944-6-0x0000000002AA4000-0x0000000002AA7000-memory.dmp
memory/2944-7-0x000007FEF5370000-0x000007FEF5D0D000-memory.dmp
memory/2944-9-0x0000000002AA0000-0x0000000002B20000-memory.dmp
memory/2944-10-0x0000000002AA0000-0x0000000002B20000-memory.dmp
memory/2944-8-0x000007FEF5370000-0x000007FEF5D0D000-memory.dmp
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
| MD5 | ef4fa9d7b3b2fb4b4aff1d4dff2a4318 |
| SHA1 | 0e7390b004386ccf207d40552d619d40efa0a72f |
| SHA256 | f21f4290f360a216570df6de51c96e44e80eb38341fc6aaef01de94ec0c37284 |
| SHA512 | 21f36e2a73834a6188f7cbbea50b75e84648190a935518505a98cf103815ea1fbc6d6543e797a4182eb56010952bfb05763cb9ce2134bd41e9ab44657c0e5b94 |
memory/2516-16-0x000000001B1A0000-0x000000001B482000-memory.dmp
memory/2516-17-0x000007FEF49D0000-0x000007FEF536D000-memory.dmp
memory/2516-18-0x0000000002860000-0x00000000028E0000-memory.dmp
memory/2516-19-0x00000000023A0000-0x00000000023A8000-memory.dmp
memory/2516-20-0x0000000002860000-0x00000000028E0000-memory.dmp
memory/2516-21-0x000007FEF49D0000-0x000007FEF536D000-memory.dmp
memory/2516-22-0x0000000002860000-0x00000000028E0000-memory.dmp
memory/2516-23-0x0000000002860000-0x00000000028E0000-memory.dmp
memory/2516-24-0x000007FEF49D0000-0x000007FEF536D000-memory.dmp
memory/2528-30-0x000007FEF5370000-0x000007FEF5D0D000-memory.dmp
memory/2528-31-0x00000000024F0000-0x0000000002570000-memory.dmp
memory/2528-32-0x000007FEF5370000-0x000007FEF5D0D000-memory.dmp
memory/2528-33-0x00000000024F0000-0x0000000002570000-memory.dmp
memory/2528-35-0x000007FEF5370000-0x000007FEF5D0D000-memory.dmp
memory/2528-34-0x00000000024F0000-0x0000000002570000-memory.dmp
memory/2528-36-0x00000000024FB000-0x0000000002562000-memory.dmp
memory/2388-42-0x000007FEF49D0000-0x000007FEF536D000-memory.dmp
memory/2388-43-0x00000000025C0000-0x0000000002640000-memory.dmp
memory/2388-44-0x00000000025C0000-0x0000000002640000-memory.dmp
memory/2388-45-0x00000000025C0000-0x0000000002640000-memory.dmp
memory/2388-46-0x000007FEF49D0000-0x000007FEF536D000-memory.dmp
memory/2388-47-0x000007FEF49D0000-0x000007FEF536D000-memory.dmp
memory/2944-48-0x0000000002AA0000-0x0000000002B20000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2024-03-01 00:00
Reported
2024-03-01 00:02
Platform
win10v2004-20240226-en
Max time kernel
91s
Max time network
98s
Command Line
Signatures
Possible privilege escalation attempt
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\icacls.exe | N/A |
| N/A | N/A | C:\Windows\system32\icacls.exe | N/A |
| N/A | N/A | C:\Windows\system32\takeown.exe | N/A |
Modifies file permissions
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\icacls.exe | N/A |
| N/A | N/A | C:\Windows\system32\icacls.exe | N/A |
| N/A | N/A | C:\Windows\system32\takeown.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\system32\takeown.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\winact.bat"
C:\Windows\system32\takeown.exe
takeown /F C:\Windows\System32\sppsvc.exe
C:\Windows\system32\icacls.exe
icacls C:\Windows\System32 /grant administrators:F /T
C:\Windows\system32\icacls.exe
icacls C:\Windows\System32\spp /grant administrators:F /T
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -c $acl = Get-Acl 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform'; $rule = New-Object System.Security.AccessControl.RegistryAccessRule ('NT Service\sppsvc','FullControl','ContainerInherit, ObjectInherit','None','Allow'); $acl.SetAccessRule($rule); Set-Acl -Path 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -AclObject $acl
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -c $acl = Get-Acl 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP'; $rule = New-Object System.Security.AccessControl.RegistryAccessRule ('NT Service\sppsvc','FullControl','ContainerInherit, ObjectInherit','None','Allow'); $acl.SetAccessRule($rule); Set-Acl -Path 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP' -AclObject $acl
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -c $acl = Get-Acl 'HKLM:\SYSTEM\CurrentControlSet\Services\SPPSVC'; $rule = New-Object System.Security.AccessControl.RegistryAccessRule ('NT Service\sppsvc','FullControl','ContainerInherit, ObjectInherit','None','Allow'); $acl.SetAccessRule($rule); Set-Acl -Path 'HKLM:\SYSTEM\CurrentControlSet\Services\SPPSVC' -AclObject $acl
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -c $acl = Get-Acl 'HKLM:\SYSTEM\WPA'; $rule = New-Object System.Security.AccessControl.RegistryAccessRule ('NT Service\sppsvc','FullControl','ContainerInherit, ObjectInherit','None','Allow'); $acl.SetAccessRule($rule); Set-Acl -Path 'HKLM:\SYSTEM\WPA' -AclObject $acl
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -c $acl = Get-Acl 'C:\Windows\System32'; $rule = New-Object System.Security.AccessControl.FileSystemAccessRule ('NT Service\sppsvc','FullControl','ContainerInherit, ObjectInherit','None','Allow'); $acl.SetAccessRule($rule); Set-Acl -Path 'C:\Windows\System32' -AclObject $acl
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 79.121.231.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 9.228.82.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 240.221.184.93.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 55.36.223.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 71.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 41.110.16.96.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 241.154.82.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 203.197.79.204.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 26.165.165.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 15.164.165.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 18.134.221.88.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 13.227.111.52.in-addr.arpa | udp |
Files
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4eljoejr.hb0.ps1
| MD5 | d17fe0a3f47be24a6453e9ef58c94641 |
| SHA1 | 6ab83620379fc69f80c0242105ddffd7d98d5d9d |
| SHA256 | 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7 |
| SHA512 | 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82 |
memory/1396-9-0x00000244EB250000-0x00000244EB272000-memory.dmp
memory/1396-10-0x00007FFE7D3A0000-0x00007FFE7DE61000-memory.dmp
memory/1396-11-0x00000244EB2B0000-0x00000244EB2C0000-memory.dmp
memory/1396-12-0x00000244EB2B0000-0x00000244EB2C0000-memory.dmp
memory/1396-15-0x00007FFE7D3A0000-0x00007FFE7DE61000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
| MD5 | 8fe7bd6cd1d64bcdabbf2e2ae72c5a28 |
| SHA1 | 5e1080c3b8cc4c5bffc73ffe6d45fa073335d0de |
| SHA256 | 5054cd4d79ca09e90169cdaee05c1e3dfc5d6fa1ad1275e11fd094521fed3fb8 |
| SHA512 | 658004888ba70fa4a8c4b573d439496532c08b81afdc0b2419187c2ec9f3e42408d9a7c2bd2c73efd06fd5ada7ea57e1bb5d188e57ead32a7c0c900a82099f68 |
memory/4700-22-0x00007FFE7D3A0000-0x00007FFE7DE61000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
| MD5 | 6bacbdfa362c3dabcb200c9accfbd836 |
| SHA1 | 32869e376a77f4a1e609d191fc252c409a04e8ad |
| SHA256 | 395e9885ff8593eb2002301c85919f0aadf6af6fa42b2cb78441e1e926e575a9 |
| SHA512 | 7427d35c4a508641ad0ffbde4d0192ca038c9be4fb5add6b18220db3d8a7b88e59c12c947a888010a9ed36f62af27c1191edfc0619e6d85899692e345ddcdde2 |
memory/4700-28-0x0000018857B30000-0x0000018857B40000-memory.dmp
memory/4700-29-0x0000018857B30000-0x0000018857B40000-memory.dmp
memory/4700-31-0x00007FFE7D3A0000-0x00007FFE7DE61000-memory.dmp
memory/2992-42-0x00007FFE7D3A0000-0x00007FFE7DE61000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
| MD5 | 33f526f6596f73ba293247cc2e790a94 |
| SHA1 | d11d735da502cbb913e257f2bf6456f126d91613 |
| SHA256 | 2af624a2765ef3e28d52862732c34c0f1e0947ca0ea0a1151edd898829577088 |
| SHA512 | 9777f3fa777d3d8aef22c0b4f8f33d95ccf575a44a641b308e222725d093dc6b5794a43ac5458bca8264143a566e472e73204621b63b32019e3e0d95e6ff3591 |
memory/2992-43-0x0000019FFCE30000-0x0000019FFCE40000-memory.dmp
memory/2992-45-0x00007FFE7D3A0000-0x00007FFE7DE61000-memory.dmp
memory/1344-46-0x00007FFE7D3A0000-0x00007FFE7DE61000-memory.dmp
memory/1344-56-0x00000212F61A0000-0x00000212F61B0000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
| MD5 | 9944e1a23780e34a1240b8977eea565d |
| SHA1 | a509b71263e790d800970dbfc7f6255fc9ed256d |
| SHA256 | 1ff2581cf8e69f3ce057ebf7ef736746fc35ee87fbd15baf7846911d97ecfebd |
| SHA512 | ac60f75c8cd7cfc012049dd60c9d9b4d3503e6cf3aa9d3a03ce05dd8caab129a2705a5f65fd71c1cb73ec48243265397cd9eeadd1ccbde813aa3a735ff2eea37 |
memory/1344-58-0x00000212F61A0000-0x00000212F61B0000-memory.dmp
memory/1344-60-0x00007FFE7D3A0000-0x00007FFE7DE61000-memory.dmp
memory/3084-72-0x00000180F47F0000-0x00000180F4800000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
| MD5 | d52a6cabb7897a46bc444de1db94f68a |
| SHA1 | 62427bdd0993afd235fc686b6ea2f8826bb5480e |
| SHA256 | 7f4f3fad38e34c5d655f3017530ca5a62eab4a3bda033db9a240567b1869deec |
| SHA512 | 60f451295f140fbf5371465ecee1fb89e16a61cc1d52578350cf20a989f0a72492dbd942b0edf4f09eef71ea73124711855cdbe551ffd7545ec336de77729ea6 |
memory/3084-70-0x00007FFE7D3A0000-0x00007FFE7DE61000-memory.dmp
memory/3084-73-0x00007FFE7D3A0000-0x00007FFE7DE61000-memory.dmp
memory/3084-74-0x00000180F47F0000-0x00000180F4800000-memory.dmp
memory/3084-75-0x00000180F47F0000-0x00000180F4800000-memory.dmp
memory/3084-77-0x00007FFE7D3A0000-0x00007FFE7DE61000-memory.dmp