2b6266f14d2ed46e921168fd2b4a5510f40c69cd591800d17ae8ca31fcde28c6

Analysis

max time kernel
26s
max time network
5s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04/03/2024, 04:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d576e0520faa40435d5bdc66304205f9.exe
Size 343KB
Sample240304-eshrlaad38
SHA256 2b6266f14d2ed46e921168fd2b4a5510f40c69cd591800d17ae8ca31fcde28c6
MD5 d576e0520faa40435d5bdc66304205f9
SHA1 b99fce6ebd094e2cbc29e1ed4e47360781e86c47
SHA512 6b60a287f3eefbf2c0f2b0f205e88c4ce5a5aad050f59ff5fd1bc8017322039963f51bdd72b0922ec08880ae5da17286c04418c44dd996f0fb7b585f376f4c98
SSDEEP 6144:ab+co0222222222222222222222222222222222222222222222222222222222w:jjkyOZzv4TatsNqaJg
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

discovery evasion exploit persistence trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, cluttscape.exe"	d576e0520faa40435d5bdc66304205f9.exe

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	d576e0520faa40435d5bdc66304205f9.exe

Disables RegEdit via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	d576e0520faa40435d5bdc66304205f9.exe

Disables Task Manager via registry modification
evasion

Possible privilege escalation attempt 18 IoCs

exploit

pid	Process
4220	takeown.exe
2632	takeown.exe
3216	takeown.exe
1220	icacls.exe
4548	takeown.exe
3356	takeown.exe
5064	icacls.exe
3332	takeown.exe
4628	takeown.exe
3752	icacls.exe
1688	takeown.exe
4848	takeown.exe
2688	takeown.exe
2612	takeown.exe
4368	takeown.exe
740	takeown.exe
2280	icacls.exe
3352	takeown.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation	d576e0520faa40435d5bdc66304205f9.exe

Modifies file permissions 1 TTPs 18 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3752	icacls.exe
740	takeown.exe
5064	icacls.exe
3332	takeown.exe
1220	icacls.exe
3356	takeown.exe
2280	icacls.exe
3216	takeown.exe
3352	takeown.exe
4368	takeown.exe
2632	takeown.exe
4848	takeown.exe
4220	takeown.exe
4548	takeown.exe
2688	takeown.exe
4628	takeown.exe
2612	takeown.exe
1688	takeown.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	d576e0520faa40435d5bdc66304205f9.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	d576e0520faa40435d5bdc66304205f9.exe

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoRestartShell = "0"	d576e0520faa40435d5bdc66304205f9.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\DisableCAD = "1"	d576e0520faa40435d5bdc66304205f9.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\kill.ico	d576e0520faa40435d5bdc66304205f9.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\cluttscape.exe	d576e0520faa40435d5bdc66304205f9.exe
File opened for modification	C:\Windows\cluttscape.exe	d576e0520faa40435d5bdc66304205f9.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Unknown\DefaultIcon\ = "C:\\Windows\\SysWow64\\kill.ico"	d576e0520faa40435d5bdc66304205f9.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeDebugPrivilege	4992	d576e0520faa40435d5bdc66304205f9.exe
Token: SeDebugPrivilege	4992	d576e0520faa40435d5bdc66304205f9.exe
Token: SeTakeOwnershipPrivilege	2688	takeown.exe
Token: SeTakeOwnershipPrivilege	1688	takeown.exe
Token: SeTakeOwnershipPrivilege	3216	takeown.exe
Token: SeTakeOwnershipPrivilege	3352	takeown.exe
Token: SeTakeOwnershipPrivilege	4628	takeown.exe
Token: SeTakeOwnershipPrivilege	2612	takeown.exe
Token: SeTakeOwnershipPrivilege	4368	takeown.exe
Token: SeTakeOwnershipPrivilege	2632	takeown.exe
Token: SeTakeOwnershipPrivilege	4848	takeown.exe
Token: SeTakeOwnershipPrivilege	4220	takeown.exe
Token: SeTakeOwnershipPrivilege	740	takeown.exe
Token: SeTakeOwnershipPrivilege	4548	takeown.exe
Token: SeTakeOwnershipPrivilege	3356	takeown.exe
Token: SeTakeOwnershipPrivilege	3332	takeown.exe
Token: SeShutdownPrivilege	4992	d576e0520faa40435d5bdc66304205f9.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4992 wrote to memory of 4848	4992	d576e0520faa40435d5bdc66304205f9.exe	96
PID 4992 wrote to memory of 4848	4992	d576e0520faa40435d5bdc66304205f9.exe	96
PID 4992 wrote to memory of 4848	4992	d576e0520faa40435d5bdc66304205f9.exe	96
PID 4992 wrote to memory of 5116	4992	d576e0520faa40435d5bdc66304205f9.exe	98
PID 4992 wrote to memory of 5116	4992	d576e0520faa40435d5bdc66304205f9.exe	98
PID 4992 wrote to memory of 5116	4992	d576e0520faa40435d5bdc66304205f9.exe	98
PID 4992 wrote to memory of 2356	4992	d576e0520faa40435d5bdc66304205f9.exe	100
PID 4992 wrote to memory of 2356	4992	d576e0520faa40435d5bdc66304205f9.exe	100
PID 4992 wrote to memory of 2356	4992	d576e0520faa40435d5bdc66304205f9.exe	100
PID 4848 wrote to memory of 4628	4848	cmd.exe	102
PID 4848 wrote to memory of 4628	4848	cmd.exe	102
PID 4848 wrote to memory of 4628	4848	cmd.exe	102
PID 4992 wrote to memory of 2792	4992	d576e0520faa40435d5bdc66304205f9.exe	103
PID 4992 wrote to memory of 2792	4992	d576e0520faa40435d5bdc66304205f9.exe	103
PID 4992 wrote to memory of 2792	4992	d576e0520faa40435d5bdc66304205f9.exe	103
PID 4992 wrote to memory of 1948	4992	d576e0520faa40435d5bdc66304205f9.exe	105
PID 4992 wrote to memory of 1948	4992	d576e0520faa40435d5bdc66304205f9.exe	105
PID 4992 wrote to memory of 1948	4992	d576e0520faa40435d5bdc66304205f9.exe	105
PID 4992 wrote to memory of 4676	4992	d576e0520faa40435d5bdc66304205f9.exe	107
PID 4992 wrote to memory of 4676	4992	d576e0520faa40435d5bdc66304205f9.exe	107
PID 4992 wrote to memory of 4676	4992	d576e0520faa40435d5bdc66304205f9.exe	107
PID 4992 wrote to memory of 2320	4992	d576e0520faa40435d5bdc66304205f9.exe	109
PID 4992 wrote to memory of 2320	4992	d576e0520faa40435d5bdc66304205f9.exe	109
PID 4992 wrote to memory of 2320	4992	d576e0520faa40435d5bdc66304205f9.exe	109
PID 2356 wrote to memory of 992	2356	cmd.exe	111
PID 2356 wrote to memory of 992	2356	cmd.exe	111
PID 2356 wrote to memory of 992	2356	cmd.exe	111
PID 4992 wrote to memory of 1576	4992	d576e0520faa40435d5bdc66304205f9.exe	112
PID 4992 wrote to memory of 1576	4992	d576e0520faa40435d5bdc66304205f9.exe	112
PID 4992 wrote to memory of 1576	4992	d576e0520faa40435d5bdc66304205f9.exe	112
PID 5116 wrote to memory of 1820	5116	cmd.exe	115
PID 5116 wrote to memory of 1820	5116	cmd.exe	115
PID 5116 wrote to memory of 1820	5116	cmd.exe	115
PID 4992 wrote to memory of 64	4992	d576e0520faa40435d5bdc66304205f9.exe	114
PID 4992 wrote to memory of 64	4992	d576e0520faa40435d5bdc66304205f9.exe	114
PID 4992 wrote to memory of 64	4992	d576e0520faa40435d5bdc66304205f9.exe	114
PID 2792 wrote to memory of 3040	2792	cmd.exe	116
PID 2792 wrote to memory of 3040	2792	cmd.exe	116
PID 2792 wrote to memory of 3040	2792	cmd.exe	116
PID 4992 wrote to memory of 632	4992	d576e0520faa40435d5bdc66304205f9.exe	118
PID 4992 wrote to memory of 632	4992	d576e0520faa40435d5bdc66304205f9.exe	118
PID 4992 wrote to memory of 632	4992	d576e0520faa40435d5bdc66304205f9.exe	118
PID 1576 wrote to memory of 876	1576	cmd.exe	119
PID 1576 wrote to memory of 876	1576	cmd.exe	119
PID 1576 wrote to memory of 876	1576	cmd.exe	119
PID 4676 wrote to memory of 3988	4676	cmd.exe	121
PID 4676 wrote to memory of 3988	4676	cmd.exe	121
PID 4676 wrote to memory of 3988	4676	cmd.exe	121
PID 4992 wrote to memory of 1352	4992	d576e0520faa40435d5bdc66304205f9.exe	122
PID 4992 wrote to memory of 1352	4992	d576e0520faa40435d5bdc66304205f9.exe	122
PID 4992 wrote to memory of 1352	4992	d576e0520faa40435d5bdc66304205f9.exe	122
PID 1948 wrote to memory of 4336	1948	cmd.exe	123
PID 1948 wrote to memory of 4336	1948	cmd.exe	123
PID 1948 wrote to memory of 4336	1948	cmd.exe	123
PID 2320 wrote to memory of 2992	2320	cmd.exe	125
PID 2320 wrote to memory of 2992	2320	cmd.exe	125
PID 2320 wrote to memory of 2992	2320	cmd.exe	125
PID 4992 wrote to memory of 972	4992	d576e0520faa40435d5bdc66304205f9.exe	126
PID 4992 wrote to memory of 972	4992	d576e0520faa40435d5bdc66304205f9.exe	126
PID 4992 wrote to memory of 972	4992	d576e0520faa40435d5bdc66304205f9.exe	126
PID 64 wrote to memory of 968	64	cmd.exe	128
PID 64 wrote to memory of 968	64	cmd.exe	128
PID 64 wrote to memory of 968	64	cmd.exe	128
PID 632 wrote to memory of 3452	632	cmd.exe	129

System policy modification 1 TTPs 3 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\shutdownwithoutlogon = "0"	d576e0520faa40435d5bdc66304205f9.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\UseDefaultTile = "1"	d576e0520faa40435d5bdc66304205f9.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	d576e0520faa40435d5bdc66304205f9.exe

C:\Users\Admin\AppData\Local\Temp\d576e0520faa40435d5bdc66304205f9.exe
"C:\Users\Admin\AppData\Local\Temp\d576e0520faa40435d5bdc66304205f9.exe"
1⤵
- Modifies WinLogon for persistence
- UAC bypass
- Disables RegEdit via registry modification
- Checks computer location settings
- Checks whether UAC is enabled
- Modifies WinLogon
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4992
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k start RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters && exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4848
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    PID:4628
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k start RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters && exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5116
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    PID:1820
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k start RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters && exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2356
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    PID:992
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k start RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters && exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2792
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    PID:3040
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k start RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters && exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1948
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    PID:4336
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k start RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters && exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4676
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    PID:3988
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k start RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters && exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2320
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    PID:2992
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k start RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters && exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1576
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    PID:876
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k start RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters && exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:64
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    PID:968
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k start RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters && exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:632
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    PID:3452
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k start RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters && exit
  2⤵
  PID:1352
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    PID:2288
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k start RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters && exit
  2⤵
  PID:972
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    PID:2304
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k takeown /f C:\Windows\System32\smss.exe && icacls C:\Windows\System32\smss.exe /grant "%username%:F" && exit
  2⤵
  PID:4476
- - C:\Windows\SysWOW64\takeown.exe
    takeown /f C:\Windows\System32\smss.exe
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:2688
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k takeown /f C:\Windows\System32\csrss.exe && icacls C:\Windows\System32\csrss.exe /grant "%username%:F" && exit
  2⤵
  PID:4416
- - C:\Windows\SysWOW64\takeown.exe
    takeown /f C:\Windows\System32\csrss.exe
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:1688
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k takeown /f C:\Windows\System32\wininit.exe && icacls C:\Windows\System32\wininit.exe /grant "%username%:F" && exit
  2⤵
  PID:1396
- - C:\Windows\SysWOW64\takeown.exe
    takeown /f C:\Windows\System32\wininit.exe
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:3216
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k takeown /f C:\Windows\System32\LogonUI.exe && icacls C:\Windows\System32\LogonUI.exe /grant "%username%:F" && exit
  2⤵
  PID:4348
- - C:\Windows\SysWOW64\takeown.exe
    takeown /f C:\Windows\System32\LogonUI.exe
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:3352
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k takeown /f C:\Windows\System32\lsass.exe && icacls C:\Windows\System32\lsass.exe /grant "%username%:F" && exit
  2⤵
  PID:1792
- - C:\Windows\SysWOW64\takeown.exe
    takeown /f C:\Windows\System32\lsass.exe
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:4628
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k takeown /f C:\Windows\System32\services.exe && icacls C:\Windows\System32\services.exe /grant "%username%:F" && exit
  2⤵
  PID:776
- - C:\Windows\SysWOW64\takeown.exe
    takeown /f C:\Windows\System32\services.exe
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:2612
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k takeown /f C:\Windows\System32\winlogon.exe && icacls C:\Windows\System32\winlogon.exe /grant "%username%:F" && exit
  2⤵
  PID:2212
- - C:\Windows\SysWOW64\takeown.exe
    takeown /f C:\Windows\System32\winlogon.exe
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:2632
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k takeown /f C:\Windows\System32\winload.efi && icacls C:\Windows\System32\winload.efi /grant "%username%:F" && exit
  2⤵
  PID:2652
- - C:\Windows\SysWOW64\takeown.exe
    takeown /f C:\Windows\System32\winload.efi
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:4368
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k takeown /f C:\Windows\System32\winload.exe && icacls C:\Windows\System32\winload.exe /grant "%username%:F" && exit
  2⤵
  PID:1068
- - C:\Windows\SysWOW64\takeown.exe
    takeown /f C:\Windows\System32\winload.exe
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:4848
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k takeown /f C:\Windows\System32\ntoskrnl.exe && icacls C:\Windows\System32\ntoskrnl.exe /grant "%username%:F" && exit
  2⤵
  PID:404
- - C:\Windows\SysWOW64\takeown.exe
    takeown /f C:\Windows\System32\ntoskrnl.exe
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:4220
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k takeown /f C:\Windows\System32\svchost.exe && icacls C:\Windows\System32\svchost.exe /grant "%username%:F" && exit
  2⤵
  PID:1920
- - C:\Windows\SysWOW64\takeown.exe
    takeown /f C:\Windows\System32\svchost.exe
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:740
- - C:\Windows\SysWOW64\icacls.exe
    icacls C:\Windows\System32\svchost.exe /grant "Admin:F"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1220
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k takeown /f C:\Windows\System32\drivers\afunix.sys && icacls C:\Windows\System32\drivers\afunix.sys /grant "%username%:F" && exit
  2⤵
  PID:4924
- - C:\Windows\SysWOW64\takeown.exe
    takeown /f C:\Windows\System32\drivers\afunix.sys
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:4548
- - C:\Windows\SysWOW64\icacls.exe
    icacls C:\Windows\System32\drivers\afunix.sys /grant "Admin:F"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:5064
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k takeown /f C:\Windows\System32\drivers\gm.dls && icacls C:\Windows\System32\drivers\gm.dls /grant "%username%:F" && exit
  2⤵
  PID:4040
- - C:\Windows\SysWOW64\takeown.exe
    takeown /f C:\Windows\System32\drivers\gm.dls
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:3356
- - C:\Windows\SysWOW64\icacls.exe
    icacls C:\Windows\System32\drivers\gm.dls /grant "Admin:F"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2280
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k takeown /f C:\Windows\System32\drivers\gmreadme.txt && icacls C:\Windows\System32\drivers\gmreadme.txt /grant "%username%:F" && exit
  2⤵
  PID:4676
- - C:\Windows\SysWOW64\takeown.exe
    takeown /f C:\Windows\System32\drivers\gmreadme.txt
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:3332
- - C:\Windows\SysWOW64\icacls.exe
    icacls C:\Windows\System32\drivers\gmreadme.txt /grant "Admin:F"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:3752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3♫█šøœ♥¶►π╔♠φ╧Σõ↑▄čž☼ï╬◘¼█ï♪ö♫—™Ÿσ₧√3éÆ▀▬▲¶♦∩8ä7╩ń5±◘«↑◘ÂÆø▌é¶×☼φ╩½¶Ÿ♀é♠○ě☻ñ○č▲♪œõÂ«75æ▄╧¤♥ε5ñ¤☼↑↕○½

Path C:\Users\Admin\Desktop\3♫█šøœ♥¶►π╔♠φ╧Σõ↑▄čž☼ï╬◘¼█ï♪ö♫—™Ÿσ₧√3éÆ▀▬▲¶♦∩8ä7╩ń5±◘«↑◘ÂÆø▌é¶×☼φ╩½¶Ÿ♀é♠○ě☻ñ○č▲♪œõÂ«75æ▄╧¤♥ε5ñ¤☼↑↕○½
Size 666B
SHA256 ca687b6a7c3d29b566f3e1988b9f877b51d9a83ee25ffe0755a8dcd3eb5f434a
MD5 9e1e5883c74742a497cf5c272ccd2321
SHA1 2cf33e34d08b8e17743a60352baffef4b6f02dee
SHA512 f2284f0c624cc07a65c16f87865bb98aaa176b1d8b45cd4fbcc1143c9c2297fe6b1d4db55ef054be2bc151c8cc25ff4da7c997b7d38dae3dccd2ffe1c3c01a6b
MD5 SHA1 SHA512

Submit Download

memory/4992-0-0x0000000000010000-0x000000000006C000-memory.dmp

Download

memory/4992-2-0x00000000048A0000-0x0000000004932000-memory.dmp

Download

memory/4992-1-0x00000000750E0000-0x0000000075890000-memory.dmp

Download

memory/4992-3-0x0000000004EF0000-0x0000000005494000-memory.dmp

Download

memory/4992-4-0x0000000004990000-0x00000000049A0000-memory.dmp

Download

memory/4992-309-0x0000000004B40000-0x0000000004B4A000-memory.dmp

Download

memory/4992-310-0x00000000750E0000-0x0000000075890000-memory.dmp

Download

memory/4992-311-0x0000000004990000-0x00000000049A0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads