402669dfcc3702db2469446a53e319e258adecc6473a8ea731fee4f2df2cd3af

Analysis

max time kernel
123s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
10/06/2024, 06:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
deleteedge.bat
Size 2KB
Sample240610-hmn8zaeb49
SHA256 402669dfcc3702db2469446a53e319e258adecc6473a8ea731fee4f2df2cd3af
MD5 2b9cdb457b4f1157c02c19687309125c
SHA1 dbe6027c9f2613314a35c426d0edf1d0060c9041
SHA512 5ad14986d43293cea1bf0cf9f29448ede2aa80cc89b538bcfee656855df9e5633278ba92c8e6c7d1caeaad0cf1e388bdfb7b90e9fbdf4b39cd49e4efe57df257
MD5 SHA1 SHA512

Score

8^/10

discovery exploit persistence

Malware Config

Signatures

Modifies Installed Components in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE}	regedit.exe

Possible privilege escalation attempt 4 IoCs

exploit

pid	Process
2988	icacls.exe
1464	takeown.exe
2984	icacls.exe
1052	takeown.exe

Modifies file permissions 1 TTPs 4 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2984	icacls.exe
1052	takeown.exe
2988	icacls.exe
1464	takeown.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
3292	taskkill.exe

Runs .reg file with regedit 1 IoCs

pid	Process
4576	regedit.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3292	taskkill.exe
Token: SeTakeOwnershipPrivilege	1464	takeown.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 4092 wrote to memory of 3292	4092	cmd.exe	82
PID 4092 wrote to memory of 3292	4092	cmd.exe	82
PID 4092 wrote to memory of 3288	4092	cmd.exe	84
PID 4092 wrote to memory of 3288	4092	cmd.exe	84
PID 4092 wrote to memory of 4596	4092	cmd.exe	85
PID 4092 wrote to memory of 4596	4092	cmd.exe	85
PID 4092 wrote to memory of 1464	4092	cmd.exe	86
PID 4092 wrote to memory of 1464	4092	cmd.exe	86
PID 4092 wrote to memory of 2984	4092	cmd.exe	87
PID 4092 wrote to memory of 2984	4092	cmd.exe	87
PID 4092 wrote to memory of 972	4092	cmd.exe	88
PID 4092 wrote to memory of 972	4092	cmd.exe	88
PID 4092 wrote to memory of 3496	4092	cmd.exe	89
PID 4092 wrote to memory of 3496	4092	cmd.exe	89
PID 4092 wrote to memory of 1052	4092	cmd.exe	90
PID 4092 wrote to memory of 1052	4092	cmd.exe	90
PID 4092 wrote to memory of 2988	4092	cmd.exe	91
PID 4092 wrote to memory of 2988	4092	cmd.exe	91
PID 4092 wrote to memory of 3320	4092	cmd.exe	92
PID 4092 wrote to memory of 3320	4092	cmd.exe	92
PID 4092 wrote to memory of 1444	4092	cmd.exe	93
PID 4092 wrote to memory of 1444	4092	cmd.exe	93
PID 4092 wrote to memory of 2908	4092	cmd.exe	94
PID 4092 wrote to memory of 2908	4092	cmd.exe	94
PID 4092 wrote to memory of 4412	4092	cmd.exe	95
PID 4092 wrote to memory of 4412	4092	cmd.exe	95
PID 4092 wrote to memory of 2208	4092	cmd.exe	96
PID 4092 wrote to memory of 2208	4092	cmd.exe	96
PID 4092 wrote to memory of 3452	4092	cmd.exe	97
PID 4092 wrote to memory of 3452	4092	cmd.exe	97
PID 4092 wrote to memory of 2076	4092	cmd.exe	98
PID 4092 wrote to memory of 2076	4092	cmd.exe	98
PID 4092 wrote to memory of 5028	4092	cmd.exe	99
PID 4092 wrote to memory of 5028	4092	cmd.exe	99
PID 4092 wrote to memory of 4576	4092	cmd.exe	100
PID 4092 wrote to memory of 4576	4092	cmd.exe	100
PID 4092 wrote to memory of 3332	4092	cmd.exe	103
PID 4092 wrote to memory of 3332	4092	cmd.exe	103
PID 4092 wrote to memory of 2864	4092	cmd.exe	104
PID 4092 wrote to memory of 2864	4092	cmd.exe	104
PID 4092 wrote to memory of 4200	4092	cmd.exe	105
PID 4092 wrote to memory of 4200	4092	cmd.exe	105
PID 4092 wrote to memory of 3992	4092	cmd.exe	106
PID 4092 wrote to memory of 3992	4092	cmd.exe	106
PID 4092 wrote to memory of 3096	4092	cmd.exe	107
PID 4092 wrote to memory of 3096	4092	cmd.exe	107
PID 4092 wrote to memory of 2492	4092	cmd.exe	108
PID 4092 wrote to memory of 2492	4092	cmd.exe	108

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\deleteedge.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4092
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM msedge.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3292
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo"
  2⤵
  PID:3288
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" set /p=Removing dir C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe"
  2⤵
  PID:4596
- C:\Windows\system32\takeown.exe
  takeown /a /r /d Y /f C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  - Suspicious use of AdjustPrivilegeToken
  PID:1464
- C:\Windows\system32\icacls.exe
  icacls C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe /grant administrators:f /t
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:2984
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo"
  2⤵
  PID:972
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" set /p=Removing dir "C:\Program Files (x86)\Microsoft\Edge""
  2⤵
  PID:3496
- C:\Windows\system32\takeown.exe
  takeown /a /r /d Y /f "C:\Program Files (x86)\Microsoft\Edge"
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:1052
- C:\Windows\system32\icacls.exe
  icacls "C:\Program Files (x86)\Microsoft\Edge" /grant administrators:f /t
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:2988
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo"
  2⤵
  PID:3320
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" set /p=Removing dir "C:\Program Files (x86)\Microsoft\EdgeUpdate""
  2⤵
  PID:1444
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo"
  2⤵
  PID:2908
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" set /p=Removing dir "C:\Program Files (x86)\Microsoft\EdgeCore""
  2⤵
  PID:4412
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo"
  2⤵
  PID:2208
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" set /p=Removing dir "C:\Program Files (x86)\Microsoft\EdgeWebView""
  2⤵
  PID:3452
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo"
  2⤵
  PID:2076
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" set /p=Editting registry"
  2⤵
  PID:5028
- C:\Windows\regedit.exe
  regedit /s RemoveEdge.reg
  2⤵
  - Modifies Installed Components in the registry
  - Runs .reg file with regedit
  PID:4576
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo"
  2⤵
  PID:3332
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" set /p=Removing shortcut "C:\Users\Public\Desktop\Microsoft Edge.lnk""
  2⤵
  PID:2864
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo"
  2⤵
  PID:4200
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" set /p=Removing shortcut "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Edge.lnk""
  2⤵
  PID:3992
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo"
  2⤵
  PID:3096
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" set /p=Removing shortcut "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Microsoft Edge.lnk""
  2⤵
  PID:2492

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RemoveEdge.reg

Path C:\Users\Admin\Desktop\RemoveEdge.reg
Size 263B
SHA256 7cc8c0543a77f3bb508cfc21e86cd957300de4e48c2e1366dc9f1b37ce76a108
MD5 4c8a079090c727bc831413155239b6a2
SHA1 2d595495c067b1784a427d73bc6658167e13a2bb
SHA512 a33df0d82cfe0d770633a43df3acec53d90bd2bbd222182cd1601bbfe62c8a862ca7a30d2e422d325a3fd0fd68d8a4e8090de9b90fa61c791e6756ff655321f4
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads