f30ea0f7276100d02319bee64445888af5d784eb12a962ea88f99d2ae4137897

Analysis

max time kernel
122s
max time network
129s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
02/03/2024, 23:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MicrosoftWindowsServicesEtc/GetReady.exe
Size 52KB
Sample240302-3d17dsag33
SHA256 5319958efc38ea81f61854eb9f6c8aee32394d4389e52fe5c1f7f7ef6b261725
MD5 57f3795953dafa8b5e2b24ba5bfad87f
SHA1 47719bd600e7527c355dbdb053e3936379d1b405
SHA512 172006e8deed2766e7fa71e34182b5539309ec8c2ac5f63285724ef8f59864e1159c618c0914eb05692df721794eb4726757b2ccf576f0c78a6567d807cbfb98
SSDEEP 1536:Sn1KqRJ9x3jnIbslu8JFNDfIDIO40nToIfqqjw0:Sn1KUhrIbsTIl4YTBfqQ
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

discovery exploit

Malware Config

Signatures

Possible privilege escalation attempt 4 IoCs

exploit

pid	Process
2612	takeown.exe
2624	icacls.exe
2256	takeown.exe
2560	icacls.exe

Modifies file permissions 1 TTPs 4 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2612	takeown.exe
2624	icacls.exe
2256	takeown.exe
2560	icacls.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2256	takeown.exe
Token: SeTakeOwnershipPrivilege	2612	takeown.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 812 wrote to memory of 2608	812	GetReady.exe	28
PID 812 wrote to memory of 2608	812	GetReady.exe	28
PID 812 wrote to memory of 2608	812	GetReady.exe	28
PID 812 wrote to memory of 2608	812	GetReady.exe	28
PID 2608 wrote to memory of 2256	2608	cmd.exe	30
PID 2608 wrote to memory of 2256	2608	cmd.exe	30
PID 2608 wrote to memory of 2256	2608	cmd.exe	30
PID 2608 wrote to memory of 2560	2608	cmd.exe	31
PID 2608 wrote to memory of 2560	2608	cmd.exe	31
PID 2608 wrote to memory of 2560	2608	cmd.exe	31
PID 2608 wrote to memory of 2612	2608	cmd.exe	32
PID 2608 wrote to memory of 2612	2608	cmd.exe	32
PID 2608 wrote to memory of 2612	2608	cmd.exe	32
PID 2608 wrote to memory of 2624	2608	cmd.exe	33
PID 2608 wrote to memory of 2624	2608	cmd.exe	33
PID 2608 wrote to memory of 2624	2608	cmd.exe	33

C:\Users\Admin\AppData\Local\Temp\MicrosoftWindowsServicesEtc\GetReady.exe
"C:\Users\Admin\AppData\Local\Temp\MicrosoftWindowsServicesEtc\GetReady.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:812
- C:\Windows\system32\cmd.exe
  "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\1\588C.bat C:\Users\Admin\AppData\Local\Temp\MicrosoftWindowsServicesEtc\GetReady.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2608
- - C:\Windows\System32\takeown.exe
    takeown /f taskmgr.exe
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:2256
- - C:\Windows\System32\icacls.exe
    icacls taskmgr.exe /granted "Admin":F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2560
- - C:\Windows\System32\takeown.exe
    takeown /f sethc.exe
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:2612
- - C:\Windows\System32\icacls.exe
    icacls sethc.exe /granted "Admin":F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

588C.bat

Path C:\Users\Admin\AppData\Local\Temp\1\588C.bat
Size 356B
SHA256 3e18de7065154144b54a2f7c179c27b3f27c3cda5871f472f452a8cfc3dc6791
MD5 fe81c1282a808b7a1d0a27d7cccaa624
SHA1 f6afc7b26ead8cdb51b11d59c6e68e5aab265bfa
SHA512 873e226360edc463dd753aedfec7ec60e0d8efac08652245709862b8bd9e6ae85eb6ea6f05d8d2c0ec1c8e7fc1bddeebc5037efcac1ceb5b1f099b49c0a93045
MD5 SHA1 SHA512

Submit Download