a5718ae60be15412ad457aad7c602c6b43c40c18bb3ffd9eec26ac20de746620

Analysis

max time kernel
132s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27-05-2024 12:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

blocknotif.bat
Size

555B
MD5

e465a93972419acd0848792edd02f94b
SHA1

b54bcb4eed2495239528a73275b3652e8ae66e0f
SHA256

a5718ae60be15412ad457aad7c602c6b43c40c18bb3ffd9eec26ac20de746620
SHA512

6dca9b63c372add7b335037b5809791e01eb05903ee2c0a6d455745f33c4e5eeb1a4779435362abe2cd8e8980a1f9ecc6250ceb9011b73057d4861efad3d2808

Score

8^/10

discovery exploit

Malware Config

Signatures

Possible privilege escalation attempt 4 IoCs
exploit

Processes:

takeown.exeicacls.exetakeown.exeicacls.exe

pid process

3984 takeown.exe
4172 icacls.exe
628 takeown.exe
1680 icacls.exe
Modifies file permissions 1 TTPs 4 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

takeown.exeicacls.exetakeown.exeicacls.exe

pid process

3984 takeown.exe
4172 icacls.exe
628 takeown.exe
1680 icacls.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

takeown.exetakeown.exe

description pid process

Token: SeTakeOwnershipPrivilege 628 takeown.exe
Token: SeTakeOwnershipPrivilege 3984 takeown.exe

pid	process
3984	takeown.exe
4172	icacls.exe
628	takeown.exe
1680	icacls.exe

pid	process
3984	takeown.exe
4172	icacls.exe
628	takeown.exe
1680	icacls.exe

description	pid	process
Token: SeTakeOwnershipPrivilege	628	takeown.exe
Token: SeTakeOwnershipPrivilege	3984	takeown.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 1476 wrote to memory of 3364	1476	cmd.exe	fsutil.exe
PID 1476 wrote to memory of 3364	1476	cmd.exe	fsutil.exe
PID 1476 wrote to memory of 628	1476	cmd.exe	takeown.exe
PID 1476 wrote to memory of 628	1476	cmd.exe	takeown.exe
PID 1476 wrote to memory of 1680	1476	cmd.exe	icacls.exe
PID 1476 wrote to memory of 1680	1476	cmd.exe	icacls.exe
PID 1476 wrote to memory of 3984	1476	cmd.exe	takeown.exe
PID 1476 wrote to memory of 3984	1476	cmd.exe	takeown.exe
PID 1476 wrote to memory of 4172	1476	cmd.exe	icacls.exe
PID 1476 wrote to memory of 4172	1476	cmd.exe	icacls.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\blocknotif.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1476

C:\Windows\system32\fsutil.exe
fsutil dirty query C:
2⤵
PID:3364

C:\Windows\System32\takeown.exe
takeown /F MusNotification.exe
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:628

C:\Windows\System32\icacls.exe
icacls MusNotification.exe /deny Everyone:(X)
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1680

C:\Windows\System32\takeown.exe
takeown /F MusNotificationUx.exe
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:3984

C:\Windows\System32\icacls.exe
icacls MusNotificationUx.exe /deny Everyone:(X)
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:4172

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads