2b6266f14d2ed46e921168fd2b4a5510f40c69cd591800d17ae8ca31fcde28c6

Analysis

max time kernel
56s
max time network
15s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
02/03/2024, 20:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Chernobyl.exe
Size 343KB
Sample240302-znvwkshg76
SHA256 2b6266f14d2ed46e921168fd2b4a5510f40c69cd591800d17ae8ca31fcde28c6
MD5 d576e0520faa40435d5bdc66304205f9
SHA1 b99fce6ebd094e2cbc29e1ed4e47360781e86c47
SHA512 6b60a287f3eefbf2c0f2b0f205e88c4ce5a5aad050f59ff5fd1bc8017322039963f51bdd72b0922ec08880ae5da17286c04418c44dd996f0fb7b585f376f4c98
SSDEEP 6144:ab+co0222222222222222222222222222222222222222222222222222222222w:jjkyOZzv4TatsNqaJg
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

discovery evasion exploit persistence trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, cluttscape.exe"	Chernobyl.exe

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Chernobyl.exe

Disables RegEdit via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-647252928-2816094679-1307623958-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	Chernobyl.exe

Disables Task Manager via registry modification
evasion

Possible privilege escalation attempt 18 IoCs

exploit

pid	Process
3044	takeown.exe
4968	takeown.exe
1544	takeown.exe
3588	takeown.exe
3924	icacls.exe
236	takeown.exe
788	takeown.exe
1368	takeown.exe
4588	takeown.exe
1252	icacls.exe
3848	icacls.exe
3316	takeown.exe
2144	takeown.exe
388	takeown.exe
1112	icacls.exe
3556	takeown.exe
1636	takeown.exe
1144	takeown.exe

Modifies file permissions 1 TTPs 18 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1636	takeown.exe
1544	takeown.exe
3588	takeown.exe
3316	takeown.exe
3556	takeown.exe
1144	takeown.exe
236	takeown.exe
388	takeown.exe
1252	icacls.exe
1112	icacls.exe
3848	icacls.exe
4588	takeown.exe
1368	takeown.exe
4968	takeown.exe
3044	takeown.exe
2144	takeown.exe
3924	icacls.exe
788	takeown.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Chernobyl.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Chernobyl.exe

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoRestartShell = "0"	Chernobyl.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\DisableCAD = "1"	Chernobyl.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\kill.ico	Chernobyl.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\cluttscape.exe	Chernobyl.exe
File opened for modification	C:\Windows\cluttscape.exe	Chernobyl.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Unknown\DefaultIcon\ = "C:\\Windows\\SysWow64\\kill.ico"	Chernobyl.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeDebugPrivilege	4944	Chernobyl.exe
Token: SeDebugPrivilege	4944	Chernobyl.exe
Token: SeTakeOwnershipPrivilege	4588	takeown.exe
Token: SeTakeOwnershipPrivilege	1368	takeown.exe
Token: SeTakeOwnershipPrivilege	788	takeown.exe
Token: SeTakeOwnershipPrivilege	4968	takeown.exe
Token: SeTakeOwnershipPrivilege	3044	takeown.exe
Token: SeTakeOwnershipPrivilege	3316	takeown.exe
Token: SeTakeOwnershipPrivilege	2144	takeown.exe
Token: SeTakeOwnershipPrivilege	1636	takeown.exe
Token: SeTakeOwnershipPrivilege	3556	takeown.exe
Token: SeTakeOwnershipPrivilege	1144	takeown.exe
Token: SeTakeOwnershipPrivilege	1544	takeown.exe
Token: SeTakeOwnershipPrivilege	3588	takeown.exe
Token: SeTakeOwnershipPrivilege	236	takeown.exe
Token: SeTakeOwnershipPrivilege	388	takeown.exe
Token: SeShutdownPrivilege	4944	Chernobyl.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4944 wrote to memory of 1708	4944	Chernobyl.exe	84
PID 4944 wrote to memory of 1708	4944	Chernobyl.exe	84
PID 4944 wrote to memory of 1708	4944	Chernobyl.exe	84
PID 4944 wrote to memory of 4256	4944	Chernobyl.exe	86
PID 4944 wrote to memory of 4256	4944	Chernobyl.exe	86
PID 4944 wrote to memory of 4256	4944	Chernobyl.exe	86
PID 4944 wrote to memory of 2648	4944	Chernobyl.exe	88
PID 4944 wrote to memory of 2648	4944	Chernobyl.exe	88
PID 4944 wrote to memory of 2648	4944	Chernobyl.exe	88
PID 1708 wrote to memory of 3472	1708	cmd.exe	90
PID 1708 wrote to memory of 3472	1708	cmd.exe	90
PID 1708 wrote to memory of 3472	1708	cmd.exe	90
PID 4944 wrote to memory of 4592	4944	Chernobyl.exe	91
PID 4944 wrote to memory of 4592	4944	Chernobyl.exe	91
PID 4944 wrote to memory of 4592	4944	Chernobyl.exe	91
PID 4944 wrote to memory of 3736	4944	Chernobyl.exe	93
PID 4944 wrote to memory of 3736	4944	Chernobyl.exe	93
PID 4944 wrote to memory of 3736	4944	Chernobyl.exe	93
PID 4944 wrote to memory of 3844	4944	Chernobyl.exe	95
PID 4944 wrote to memory of 3844	4944	Chernobyl.exe	95
PID 4944 wrote to memory of 3844	4944	Chernobyl.exe	95
PID 4944 wrote to memory of 4956	4944	Chernobyl.exe	97
PID 4944 wrote to memory of 4956	4944	Chernobyl.exe	97
PID 4944 wrote to memory of 4956	4944	Chernobyl.exe	97
PID 4944 wrote to memory of 1044	4944	Chernobyl.exe	99
PID 4944 wrote to memory of 1044	4944	Chernobyl.exe	99
PID 4944 wrote to memory of 1044	4944	Chernobyl.exe	99
PID 4944 wrote to memory of 1756	4944	Chernobyl.exe	101
PID 4944 wrote to memory of 1756	4944	Chernobyl.exe	101
PID 4944 wrote to memory of 1756	4944	Chernobyl.exe	101
PID 4944 wrote to memory of 4500	4944	Chernobyl.exe	103
PID 4944 wrote to memory of 4500	4944	Chernobyl.exe	103
PID 4944 wrote to memory of 4500	4944	Chernobyl.exe	103
PID 4944 wrote to memory of 2664	4944	Chernobyl.exe	105
PID 4944 wrote to memory of 2664	4944	Chernobyl.exe	105
PID 4944 wrote to memory of 2664	4944	Chernobyl.exe	105
PID 4256 wrote to memory of 3332	4256	cmd.exe	106
PID 4256 wrote to memory of 3332	4256	cmd.exe	106
PID 4256 wrote to memory of 3332	4256	cmd.exe	106
PID 4944 wrote to memory of 3396	4944	Chernobyl.exe	108
PID 4944 wrote to memory of 3396	4944	Chernobyl.exe	108
PID 4944 wrote to memory of 3396	4944	Chernobyl.exe	108
PID 4592 wrote to memory of 4296	4592	cmd.exe	110
PID 4592 wrote to memory of 4296	4592	cmd.exe	110
PID 4592 wrote to memory of 4296	4592	cmd.exe	110
PID 2648 wrote to memory of 4320	2648	cmd.exe	111
PID 2648 wrote to memory of 4320	2648	cmd.exe	111
PID 2648 wrote to memory of 4320	2648	cmd.exe	111
PID 3844 wrote to memory of 3500	3844	cmd.exe	112
PID 3844 wrote to memory of 3500	3844	cmd.exe	112
PID 3844 wrote to memory of 3500	3844	cmd.exe	112
PID 4956 wrote to memory of 1768	4956	cmd.exe	113
PID 4956 wrote to memory of 1768	4956	cmd.exe	113
PID 4956 wrote to memory of 1768	4956	cmd.exe	113
PID 3736 wrote to memory of 4020	3736	cmd.exe	114
PID 3736 wrote to memory of 4020	3736	cmd.exe	114
PID 3736 wrote to memory of 4020	3736	cmd.exe	114
PID 1044 wrote to memory of 1184	1044	cmd.exe	115
PID 1044 wrote to memory of 1184	1044	cmd.exe	115
PID 1044 wrote to memory of 1184	1044	cmd.exe	115
PID 2664 wrote to memory of 3668	2664	cmd.exe	116
PID 2664 wrote to memory of 3668	2664	cmd.exe	116
PID 2664 wrote to memory of 3668	2664	cmd.exe	116
PID 1756 wrote to memory of 4364	1756	cmd.exe	118

System policy modification 1 TTPs 3 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\shutdownwithoutlogon = "0"	Chernobyl.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\UseDefaultTile = "1"	Chernobyl.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Chernobyl.exe

C:\Users\Admin\AppData\Local\Temp\Chernobyl.exe
"C:\Users\Admin\AppData\Local\Temp\Chernobyl.exe"
1⤵
- Modifies WinLogon for persistence
- UAC bypass
- Disables RegEdit via registry modification
- Checks whether UAC is enabled
- Modifies WinLogon
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4944
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k start RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters && exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1708
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    PID:3472
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k start RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters && exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4256
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    PID:3332
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k start RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters && exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2648
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    PID:4320
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k start RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters && exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4592
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    PID:4296
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k start RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters && exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3736
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    PID:4020
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k start RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters && exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3844
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    PID:3500
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k start RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters && exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4956
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    PID:1768
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k start RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters && exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1044
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    PID:1184
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k start RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters && exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1756
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    PID:4364
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k start RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters && exit
  2⤵
  PID:4500
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    PID:3848
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k start RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters && exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2664
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    PID:3668
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k start RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters && exit
  2⤵
  PID:3396
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    PID:3792
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k takeown /f C:\Windows\System32\smss.exe && icacls C:\Windows\System32\smss.exe /grant "%username%:F" && exit
  2⤵
  PID:4532
- - C:\Windows\SysWOW64\takeown.exe
    takeown /f C:\Windows\System32\smss.exe
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:788
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k takeown /f C:\Windows\System32\csrss.exe && icacls C:\Windows\System32\csrss.exe /grant "%username%:F" && exit
  2⤵
  PID:3268
- - C:\Windows\SysWOW64\takeown.exe
    takeown /f C:\Windows\System32\csrss.exe
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:4588
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k takeown /f C:\Windows\System32\wininit.exe && icacls C:\Windows\System32\wininit.exe /grant "%username%:F" && exit
  2⤵
  PID:1956
- - C:\Windows\SysWOW64\takeown.exe
    takeown /f C:\Windows\System32\wininit.exe
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:1368
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k takeown /f C:\Windows\System32\LogonUI.exe && icacls C:\Windows\System32\LogonUI.exe /grant "%username%:F" && exit
  2⤵
  PID:3208
- - C:\Windows\SysWOW64\takeown.exe
    takeown /f C:\Windows\System32\LogonUI.exe
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:4968
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k takeown /f C:\Windows\System32\lsass.exe && icacls C:\Windows\System32\lsass.exe /grant "%username%:F" && exit
  2⤵
  PID:852
- - C:\Windows\SysWOW64\takeown.exe
    takeown /f C:\Windows\System32\lsass.exe
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:2144
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k takeown /f C:\Windows\System32\services.exe && icacls C:\Windows\System32\services.exe /grant "%username%:F" && exit
  2⤵
  PID:2920
- - C:\Windows\SysWOW64\takeown.exe
    takeown /f C:\Windows\System32\services.exe
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:3044
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k takeown /f C:\Windows\System32\winlogon.exe && icacls C:\Windows\System32\winlogon.exe /grant "%username%:F" && exit
  2⤵
  PID:4576
- - C:\Windows\SysWOW64\takeown.exe
    takeown /f C:\Windows\System32\winlogon.exe
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:3316
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k takeown /f C:\Windows\System32\winload.efi && icacls C:\Windows\System32\winload.efi /grant "%username%:F" && exit
  2⤵
  PID:4548
- - C:\Windows\SysWOW64\takeown.exe
    takeown /f C:\Windows\System32\winload.efi
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:1144
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k takeown /f C:\Windows\System32\winload.exe && icacls C:\Windows\System32\winload.exe /grant "%username%:F" && exit
  2⤵
  PID:2912
- - C:\Windows\SysWOW64\takeown.exe
    takeown /f C:\Windows\System32\winload.exe
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:1636
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k takeown /f C:\Windows\System32\ntoskrnl.exe && icacls C:\Windows\System32\ntoskrnl.exe /grant "%username%:F" && exit
  2⤵
  PID:4292
- - C:\Windows\SysWOW64\takeown.exe
    takeown /f C:\Windows\System32\ntoskrnl.exe
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:1544
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k takeown /f C:\Windows\System32\svchost.exe && icacls C:\Windows\System32\svchost.exe /grant "%username%:F" && exit
  2⤵
  PID:4792
- - C:\Windows\SysWOW64\takeown.exe
    takeown /f C:\Windows\System32\svchost.exe
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:3556
- - C:\Windows\SysWOW64\icacls.exe
    icacls C:\Windows\System32\svchost.exe /grant "Admin:F"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:3924
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k takeown /f C:\Windows\System32\drivers\afunix.sys && icacls C:\Windows\System32\drivers\afunix.sys /grant "%username%:F" && exit
  2⤵
  PID:2376
- - C:\Windows\SysWOW64\takeown.exe
    takeown /f C:\Windows\System32\drivers\afunix.sys
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:236
- - C:\Windows\SysWOW64\icacls.exe
    icacls C:\Windows\System32\drivers\afunix.sys /grant "Admin:F"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:3848
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k takeown /f C:\Windows\System32\drivers\gm.dls && icacls C:\Windows\System32\drivers\gm.dls /grant "%username%:F" && exit
  2⤵
  PID:1768
- - C:\Windows\SysWOW64\takeown.exe
    takeown /f C:\Windows\System32\drivers\gm.dls
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:388
- - C:\Windows\SysWOW64\icacls.exe
    icacls C:\Windows\System32\drivers\gm.dls /grant "Admin:F"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1112
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k takeown /f C:\Windows\System32\drivers\gmreadme.txt && icacls C:\Windows\System32\drivers\gmreadme.txt /grant "%username%:F" && exit
  2⤵
  PID:5068
- - C:\Windows\SysWOW64\takeown.exe
    takeown /f C:\Windows\System32\drivers\gmreadme.txt
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:3588
- - C:\Windows\SysWOW64\icacls.exe
    icacls C:\Windows\System32\drivers\gmreadme.txt /grant "Admin:F"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1252

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

∞∩—╠õŸ±•ßó¥╧╬—₧í7↕£♣¶¥◙☼í•◙╚éě♣•¢Â╤╥™ž¶8ž▄7♪♂☼↑Ÿ•—¥ńě☺↑í²—☺¼9▬∞╠♣1ßåœ╠íï—◄π▼☺∩∩éå╥♠í«8₧9▲♥1◙▬4—☺²♥▄8

Path C:\Users\Admin\Desktop\∞∩—╠õŸ±•ßó¥╧╬—₧í7↕£♣¶¥◙☼í•◙╚éě♣•¢Â╤╥™ž¶8ž▄7♪♂☼↑Ÿ•—¥ńě☺↑í²—☺¼9▬∞╠♣1ßåœ╠íï—◄π▼☺∩∩éå╥♠í«8₧9▲♥1◙▬4—☺²♥▄8
Size 666B
SHA256 ca687b6a7c3d29b566f3e1988b9f877b51d9a83ee25ffe0755a8dcd3eb5f434a
MD5 9e1e5883c74742a497cf5c272ccd2321
SHA1 2cf33e34d08b8e17743a60352baffef4b6f02dee
SHA512 f2284f0c624cc07a65c16f87865bb98aaa176b1d8b45cd4fbcc1143c9c2297fe6b1d4db55ef054be2bc151c8cc25ff4da7c997b7d38dae3dccd2ffe1c3c01a6b
MD5 SHA1 SHA512

Submit Download

memory/4944-0-0x0000000000270000-0x00000000002CC000-memory.dmp

Download

memory/4944-1-0x0000000074700000-0x0000000074EB1000-memory.dmp

Download

memory/4944-2-0x0000000004D40000-0x0000000004DD2000-memory.dmp

Download

memory/4944-3-0x0000000005390000-0x0000000005936000-memory.dmp

Download

memory/4944-4-0x0000000004E50000-0x0000000004E60000-memory.dmp

Download

memory/4944-309-0x0000000005070000-0x000000000507A000-memory.dmp

Download

memory/4944-310-0x0000000074700000-0x0000000074EB1000-memory.dmp

Download

memory/4944-311-0x0000000004E50000-0x0000000004E60000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads