2b6266f14d2ed46e921168fd2b4a5510f40c69cd591800d17ae8ca31fcde28c6

Analysis

max time kernel
84s
max time network
72s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
02/03/2024, 20:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Chernobyl.exe
Size 343KB
Sample240302-znvwkshg76
SHA256 2b6266f14d2ed46e921168fd2b4a5510f40c69cd591800d17ae8ca31fcde28c6
MD5 d576e0520faa40435d5bdc66304205f9
SHA1 b99fce6ebd094e2cbc29e1ed4e47360781e86c47
SHA512 6b60a287f3eefbf2c0f2b0f205e88c4ce5a5aad050f59ff5fd1bc8017322039963f51bdd72b0922ec08880ae5da17286c04418c44dd996f0fb7b585f376f4c98
SSDEEP 6144:ab+co0222222222222222222222222222222222222222222222222222222222w:jjkyOZzv4TatsNqaJg
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

discovery evasion exploit persistence trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, cluttscape.exe"	Chernobyl.exe

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Chernobyl.exe

Disables RegEdit via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	Chernobyl.exe

Disables Task Manager via registry modification
evasion

Possible privilege escalation attempt 18 IoCs

exploit

pid	Process
4168	takeown.exe
4540	takeown.exe
2604	takeown.exe
4424	takeown.exe
4484	takeown.exe
212	icacls.exe
1608	icacls.exe
5044	icacls.exe
4980	takeown.exe
3640	takeown.exe
2932	takeown.exe
4364	takeown.exe
3304	takeown.exe
3028	takeown.exe
4904	takeown.exe
2196	takeown.exe
3016	takeown.exe
3276	icacls.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	Chernobyl.exe

Modifies file permissions 1 TTPs 18 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2932	takeown.exe
3028	takeown.exe
3304	takeown.exe
2196	takeown.exe
1608	icacls.exe
5044	icacls.exe
4424	takeown.exe
4484	takeown.exe
4540	takeown.exe
4364	takeown.exe
4904	takeown.exe
2604	takeown.exe
4980	takeown.exe
3016	takeown.exe
3276	icacls.exe
3640	takeown.exe
4168	takeown.exe
212	icacls.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Chernobyl.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Chernobyl.exe

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoRestartShell = "0"	Chernobyl.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\DisableCAD = "1"	Chernobyl.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\kill.ico	Chernobyl.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\cluttscape.exe	Chernobyl.exe
File opened for modification	C:\Windows\cluttscape.exe	Chernobyl.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Unknown\DefaultIcon\ = "C:\\Windows\\SysWow64\\kill.ico"	Chernobyl.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeDebugPrivilege	4784	Chernobyl.exe
Token: SeDebugPrivilege	4784	Chernobyl.exe
Token: SeTakeOwnershipPrivilege	2604	takeown.exe
Token: SeTakeOwnershipPrivilege	4904	takeown.exe
Token: SeTakeOwnershipPrivilege	4980	takeown.exe
Token: SeTakeOwnershipPrivilege	3640	takeown.exe
Token: SeTakeOwnershipPrivilege	2932	takeown.exe
Token: SeTakeOwnershipPrivilege	4424	takeown.exe
Token: SeTakeOwnershipPrivilege	3028	takeown.exe
Token: SeTakeOwnershipPrivilege	4540	takeown.exe
Token: SeTakeOwnershipPrivilege	4484	takeown.exe
Token: SeTakeOwnershipPrivilege	4168	takeown.exe
Token: SeTakeOwnershipPrivilege	4364	takeown.exe
Token: SeTakeOwnershipPrivilege	3304	takeown.exe
Token: SeTakeOwnershipPrivilege	2196	takeown.exe
Token: SeTakeOwnershipPrivilege	3016	takeown.exe
Token: SeShutdownPrivilege	4784	Chernobyl.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4784 wrote to memory of 436	4784	Chernobyl.exe	93
PID 4784 wrote to memory of 436	4784	Chernobyl.exe	93
PID 4784 wrote to memory of 436	4784	Chernobyl.exe	93
PID 4784 wrote to memory of 5076	4784	Chernobyl.exe	95
PID 4784 wrote to memory of 5076	4784	Chernobyl.exe	95
PID 4784 wrote to memory of 5076	4784	Chernobyl.exe	95
PID 4784 wrote to memory of 4384	4784	Chernobyl.exe	97
PID 4784 wrote to memory of 4384	4784	Chernobyl.exe	97
PID 4784 wrote to memory of 4384	4784	Chernobyl.exe	97
PID 4784 wrote to memory of 5104	4784	Chernobyl.exe	100
PID 4784 wrote to memory of 5104	4784	Chernobyl.exe	100
PID 4784 wrote to memory of 5104	4784	Chernobyl.exe	100
PID 436 wrote to memory of 2840	436	cmd.exe	99
PID 436 wrote to memory of 2840	436	cmd.exe	99
PID 436 wrote to memory of 2840	436	cmd.exe	99
PID 4784 wrote to memory of 1720	4784	Chernobyl.exe	102
PID 4784 wrote to memory of 1720	4784	Chernobyl.exe	102
PID 4784 wrote to memory of 1720	4784	Chernobyl.exe	102
PID 4784 wrote to memory of 2848	4784	Chernobyl.exe	104
PID 4784 wrote to memory of 2848	4784	Chernobyl.exe	104
PID 4784 wrote to memory of 2848	4784	Chernobyl.exe	104
PID 4784 wrote to memory of 4216	4784	Chernobyl.exe	106
PID 4784 wrote to memory of 4216	4784	Chernobyl.exe	106
PID 4784 wrote to memory of 4216	4784	Chernobyl.exe	106
PID 4784 wrote to memory of 3908	4784	Chernobyl.exe	108
PID 4784 wrote to memory of 3908	4784	Chernobyl.exe	108
PID 4784 wrote to memory of 3908	4784	Chernobyl.exe	108
PID 5104 wrote to memory of 3420	5104	cmd.exe	110
PID 5104 wrote to memory of 3420	5104	cmd.exe	110
PID 5104 wrote to memory of 3420	5104	cmd.exe	110
PID 4784 wrote to memory of 3344	4784	Chernobyl.exe	111
PID 4784 wrote to memory of 3344	4784	Chernobyl.exe	111
PID 4784 wrote to memory of 3344	4784	Chernobyl.exe	111
PID 4384 wrote to memory of 1280	4384	cmd.exe	113
PID 4384 wrote to memory of 1280	4384	cmd.exe	113
PID 4384 wrote to memory of 1280	4384	cmd.exe	113
PID 4784 wrote to memory of 816	4784	Chernobyl.exe	114
PID 4784 wrote to memory of 816	4784	Chernobyl.exe	114
PID 4784 wrote to memory of 816	4784	Chernobyl.exe	114
PID 1720 wrote to memory of 4492	1720	cmd.exe	116
PID 1720 wrote to memory of 4492	1720	cmd.exe	116
PID 1720 wrote to memory of 4492	1720	cmd.exe	116
PID 4784 wrote to memory of 640	4784	Chernobyl.exe	117
PID 4784 wrote to memory of 640	4784	Chernobyl.exe	117
PID 4784 wrote to memory of 640	4784	Chernobyl.exe	117
PID 4784 wrote to memory of 1776	4784	Chernobyl.exe	120
PID 4784 wrote to memory of 1776	4784	Chernobyl.exe	120
PID 4784 wrote to memory of 1776	4784	Chernobyl.exe	120
PID 5076 wrote to memory of 3108	5076	cmd.exe	119
PID 5076 wrote to memory of 3108	5076	cmd.exe	119
PID 5076 wrote to memory of 3108	5076	cmd.exe	119
PID 2848 wrote to memory of 232	2848	cmd.exe	122
PID 2848 wrote to memory of 232	2848	cmd.exe	122
PID 2848 wrote to memory of 232	2848	cmd.exe	122
PID 4216 wrote to memory of 3112	4216	cmd.exe	123
PID 4216 wrote to memory of 3112	4216	cmd.exe	123
PID 4216 wrote to memory of 3112	4216	cmd.exe	123
PID 3908 wrote to memory of 992	3908	cmd.exe	124
PID 3908 wrote to memory of 992	3908	cmd.exe	124
PID 3908 wrote to memory of 992	3908	cmd.exe	124
PID 3344 wrote to memory of 2196	3344	cmd.exe	125
PID 3344 wrote to memory of 2196	3344	cmd.exe	125
PID 3344 wrote to memory of 2196	3344	cmd.exe	125
PID 816 wrote to memory of 4108	816	cmd.exe	126

System policy modification 1 TTPs 3 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\shutdownwithoutlogon = "0"	Chernobyl.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\UseDefaultTile = "1"	Chernobyl.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Chernobyl.exe

C:\Users\Admin\AppData\Local\Temp\Chernobyl.exe
"C:\Users\Admin\AppData\Local\Temp\Chernobyl.exe"
1⤵
- Modifies WinLogon for persistence
- UAC bypass
- Disables RegEdit via registry modification
- Checks computer location settings
- Checks whether UAC is enabled
- Modifies WinLogon
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4784
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k start RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters && exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:436
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    PID:2840
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k start RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters && exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5076
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    PID:3108
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k start RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters && exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4384
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    PID:1280
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k start RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters && exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5104
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    PID:3420
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k start RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters && exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1720
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    PID:4492
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k start RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters && exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2848
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    PID:232
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k start RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters && exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4216
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    PID:3112
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k start RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters && exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3908
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    PID:992
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k start RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters && exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3344
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    PID:2196
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k start RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters && exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:816
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    PID:4108
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k start RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters && exit
  2⤵
  PID:640
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    PID:928
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k start RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters && exit
  2⤵
  PID:1776
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    PID:3564
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k takeown /f C:\Windows\System32\smss.exe && icacls C:\Windows\System32\smss.exe /grant "%username%:F" && exit
  2⤵
  PID:4552
- - C:\Windows\SysWOW64\takeown.exe
    takeown /f C:\Windows\System32\smss.exe
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:3640
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k takeown /f C:\Windows\System32\csrss.exe && icacls C:\Windows\System32\csrss.exe /grant "%username%:F" && exit
  2⤵
  PID:4224
- - C:\Windows\SysWOW64\takeown.exe
    takeown /f C:\Windows\System32\csrss.exe
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:4904
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k takeown /f C:\Windows\System32\wininit.exe && icacls C:\Windows\System32\wininit.exe /grant "%username%:F" && exit
  2⤵
  PID:452
- - C:\Windows\SysWOW64\takeown.exe
    takeown /f C:\Windows\System32\wininit.exe
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:2932
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k takeown /f C:\Windows\System32\LogonUI.exe && icacls C:\Windows\System32\LogonUI.exe /grant "%username%:F" && exit
  2⤵
  PID:3152
- - C:\Windows\SysWOW64\takeown.exe
    takeown /f C:\Windows\System32\LogonUI.exe
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:2604
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k takeown /f C:\Windows\System32\lsass.exe && icacls C:\Windows\System32\lsass.exe /grant "%username%:F" && exit
  2⤵
  PID:4204
- - C:\Windows\SysWOW64\takeown.exe
    takeown /f C:\Windows\System32\lsass.exe
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:4980
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k takeown /f C:\Windows\System32\services.exe && icacls C:\Windows\System32\services.exe /grant "%username%:F" && exit
  2⤵
  PID:3864
- - C:\Windows\SysWOW64\takeown.exe
    takeown /f C:\Windows\System32\services.exe
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:4424
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k takeown /f C:\Windows\System32\winlogon.exe && icacls C:\Windows\System32\winlogon.exe /grant "%username%:F" && exit
  2⤵
  PID:4852
- - C:\Windows\SysWOW64\takeown.exe
    takeown /f C:\Windows\System32\winlogon.exe
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:3028
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k takeown /f C:\Windows\System32\winload.efi && icacls C:\Windows\System32\winload.efi /grant "%username%:F" && exit
  2⤵
  PID:2020
- - C:\Windows\SysWOW64\takeown.exe
    takeown /f C:\Windows\System32\winload.efi
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:4484
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k takeown /f C:\Windows\System32\winload.exe && icacls C:\Windows\System32\winload.exe /grant "%username%:F" && exit
  2⤵
  PID:2920
- - C:\Windows\SysWOW64\takeown.exe
    takeown /f C:\Windows\System32\winload.exe
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:4540
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k takeown /f C:\Windows\System32\ntoskrnl.exe && icacls C:\Windows\System32\ntoskrnl.exe /grant "%username%:F" && exit
  2⤵
  PID:3852
- - C:\Windows\SysWOW64\takeown.exe
    takeown /f C:\Windows\System32\ntoskrnl.exe
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:4168
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k takeown /f C:\Windows\System32\svchost.exe && icacls C:\Windows\System32\svchost.exe /grant "%username%:F" && exit
  2⤵
  PID:4316
- - C:\Windows\SysWOW64\takeown.exe
    takeown /f C:\Windows\System32\svchost.exe
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:4364
- - C:\Windows\SysWOW64\icacls.exe
    icacls C:\Windows\System32\svchost.exe /grant "Admin:F"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:5044
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k takeown /f C:\Windows\System32\drivers\afunix.sys && icacls C:\Windows\System32\drivers\afunix.sys /grant "%username%:F" && exit
  2⤵
  PID:868
- - C:\Windows\SysWOW64\takeown.exe
    takeown /f C:\Windows\System32\drivers\afunix.sys
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:3304
- - C:\Windows\SysWOW64\icacls.exe
    icacls C:\Windows\System32\drivers\afunix.sys /grant "Admin:F"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:212
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k takeown /f C:\Windows\System32\drivers\gm.dls && icacls C:\Windows\System32\drivers\gm.dls /grant "%username%:F" && exit
  2⤵
  PID:3940
- - C:\Windows\SysWOW64\takeown.exe
    takeown /f C:\Windows\System32\drivers\gm.dls
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:2196
- - C:\Windows\SysWOW64\icacls.exe
    icacls C:\Windows\System32\drivers\gm.dls /grant "Admin:F"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1608
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k takeown /f C:\Windows\System32\drivers\gmreadme.txt && icacls C:\Windows\System32\drivers\gmreadme.txt /grant "%username%:F" && exit
  2⤵
  PID:784
- - C:\Windows\SysWOW64\takeown.exe
    takeown /f C:\Windows\System32\drivers\gmreadme.txt
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:3016
- - C:\Windows\SysWOW64\icacls.exe
    icacls C:\Windows\System32\drivers\gmreadme.txt /grant "Admin:F"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:3276

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

č®↑∩√6◄¶◘♣£☼♠▼5Çœ¼5☻ń²▬ř2ï☻8ï4►č►äε2¶πß▐öσ♂♪í¾╤▄7ó▀♫▌3█ÿń◘35╬6√Ç¶╩π█╧♀½¤σń√×≈►∩▄▄ř◙∩¼◙╚Ÿ╥6█▐↑ž3æ♀šφ▐

Path C:\Users\Admin\Desktop\č®↑∩√6◄¶◘♣£☼♠▼5Çœ¼5☻ń²▬ř2ï☻8ï4►č►äε2¶πß▐öσ♂♪í¾╤▄7ó▀♫▌3█ÿń◘35╬6√Ç¶╩π█╧♀½¤σń√×≈►∩▄▄ř◙∩¼◙╚Ÿ╥6█▐↑ž3æ♀šφ▐
Size 666B
SHA256 ca687b6a7c3d29b566f3e1988b9f877b51d9a83ee25ffe0755a8dcd3eb5f434a
MD5 9e1e5883c74742a497cf5c272ccd2321
SHA1 2cf33e34d08b8e17743a60352baffef4b6f02dee
SHA512 f2284f0c624cc07a65c16f87865bb98aaa176b1d8b45cd4fbcc1143c9c2297fe6b1d4db55ef054be2bc151c8cc25ff4da7c997b7d38dae3dccd2ffe1c3c01a6b
MD5 SHA1 SHA512

Submit Download

memory/4784-0-0x0000000000010000-0x000000000006C000-memory.dmp

Download

memory/4784-1-0x0000000074920000-0x00000000750D0000-memory.dmp

Download

memory/4784-2-0x00000000049E0000-0x0000000004A72000-memory.dmp

Download

memory/4784-3-0x0000000005030000-0x00000000055D4000-memory.dmp

Download

memory/4784-4-0x0000000004DD0000-0x0000000004DE0000-memory.dmp

Download

memory/4784-309-0x0000000005CF0000-0x0000000005CFA000-memory.dmp

Download

memory/4784-310-0x0000000074920000-0x00000000750D0000-memory.dmp

Download

memory/4784-311-0x0000000004DD0000-0x0000000004DE0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads