1761e7bf4d98dbe98c9702cae5d591d12e8e58b268080c4e0b95ba29db353888

Analysis

max time kernel
794s
max time network
792s
platform
windows10-2004_x64
resource
win10v2004-20240730-en
resource tags

arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system
submitted
01/08/2024, 04:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Piriform-BlockerKeyVerificator_RunAsAdministrator.cmd
Size 4KB
Sample240801-fa3vgswhpf
SHA256 f7d87d0a3977d9ed4ed6eaa2da2fe2aea9564f58cf062f828dec0aa21d9ec11e
MD5 6ba5c46261ff52e7438f21ccef5f8c7e
SHA1 acdf309fbfebecb7a93b78068fc1498fae4d9e62
SHA512 106b05fbeca31c78e5e5f33cbd62580aac1b4ef781a78ac2cbe80f92eb01f75beeaa480772dcf2f9f2bbea178e681aff2247dd3d08387b35ca507b90b4a5cc43
SSDEEP 96:zGXTD6E4YsQlPtYyjZW0vQH5aROc37gC9r2of6:zeDn4YsQlPtYyjZW0vQH5aROc37gC9rA
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

defense_evasion discovery exploit privilege_escalation

Malware Config

Signatures

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	attrib.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	cmd.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	attrib.exe

Possible privilege escalation attempt 2 IoCs

exploit

pid	Process
2640	takeown.exe
4340	icacls.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2640	takeown.exe
4340	icacls.exe

File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
defense_evasion

Windows File and Directory Permissions Modification
T1222.001

Access Token Manipulation: Create Process with Token 1 TTPs 1 IoCs

defense_evasion privilege_escalation

Create Process with Token

T1134.002

pid	Process
1960	cmd.exe

Delays execution with timeout.exe 2 IoCs

evasion

pid	Process
4308	timeout.exe
2204	timeout.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 1960 wrote to memory of 4136	1960	cmd.exe	84
PID 1960 wrote to memory of 4136	1960	cmd.exe	84
PID 1960 wrote to memory of 4308	1960	cmd.exe	85
PID 1960 wrote to memory of 4308	1960	cmd.exe	85
PID 1960 wrote to memory of 2640	1960	cmd.exe	95
PID 1960 wrote to memory of 2640	1960	cmd.exe	95
PID 1960 wrote to memory of 4340	1960	cmd.exe	96
PID 1960 wrote to memory of 4340	1960	cmd.exe	96
PID 1960 wrote to memory of 1280	1960	cmd.exe	97
PID 1960 wrote to memory of 1280	1960	cmd.exe	97
PID 1960 wrote to memory of 3608	1960	cmd.exe	98
PID 1960 wrote to memory of 3608	1960	cmd.exe	98
PID 1960 wrote to memory of 1972	1960	cmd.exe	99
PID 1960 wrote to memory of 1972	1960	cmd.exe	99
PID 1960 wrote to memory of 2244	1960	cmd.exe	100
PID 1960 wrote to memory of 2244	1960	cmd.exe	100
PID 1960 wrote to memory of 4708	1960	cmd.exe	101
PID 1960 wrote to memory of 4708	1960	cmd.exe	101
PID 1960 wrote to memory of 1456	1960	cmd.exe	102
PID 1960 wrote to memory of 1456	1960	cmd.exe	102
PID 1960 wrote to memory of 2464	1960	cmd.exe	103
PID 1960 wrote to memory of 2464	1960	cmd.exe	103
PID 1960 wrote to memory of 924	1960	cmd.exe	104
PID 1960 wrote to memory of 924	1960	cmd.exe	104
PID 1960 wrote to memory of 1696	1960	cmd.exe	105
PID 1960 wrote to memory of 1696	1960	cmd.exe	105
PID 1960 wrote to memory of 3100	1960	cmd.exe	106
PID 1960 wrote to memory of 3100	1960	cmd.exe	106
PID 1960 wrote to memory of 2412	1960	cmd.exe	107
PID 1960 wrote to memory of 2412	1960	cmd.exe	107
PID 1960 wrote to memory of 4484	1960	cmd.exe	108
PID 1960 wrote to memory of 4484	1960	cmd.exe	108
PID 1960 wrote to memory of 2036	1960	cmd.exe	109
PID 1960 wrote to memory of 2036	1960	cmd.exe	109
PID 1960 wrote to memory of 4312	1960	cmd.exe	110
PID 1960 wrote to memory of 4312	1960	cmd.exe	110
PID 1960 wrote to memory of 2204	1960	cmd.exe	111
PID 1960 wrote to memory of 2204	1960	cmd.exe	111

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
1280	attrib.exe
4312	attrib.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Piriform-BlockerKeyVerificator_RunAsAdministrator.cmd"
1⤵
- Drops file in Drivers directory
- Access Token Manipulation: Create Process with Token
- Suspicious use of WriteProcessMemory
PID:1960
- C:\Windows\system32\fltMC.exe
  fltmc
  2⤵
  PID:4136
- C:\Windows\system32\timeout.exe
  timeout -1
  2⤵
  - Delays execution with timeout.exe
  PID:4308
- C:\Windows\system32\takeown.exe
  takeown /f "C:\Windows\System32\drivers\etc\hosts" /a
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:2640
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\System32\drivers\etc\hosts" /grant administrators:F
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:4340
- C:\Windows\system32\attrib.exe
  attrib -h -r -s "C:\Windows\System32\drivers\etc\hosts"
  2⤵
  - Drops file in Drivers directory
  - Views/modifies file attributes
  PID:1280
- C:\Windows\system32\find.exe
  FIND /C /I "# Piriform Blocker Key Verificator" C:\Windows\system32\drivers\etc\hosts
  2⤵
  PID:3608
- C:\Windows\system32\find.exe
  FIND /C /I "license.piriform.com" C:\Windows\system32\drivers\etc\hosts
  2⤵
  PID:1972
- C:\Windows\system32\find.exe
  FIND /C /I "www.license.piriform.com" C:\Windows\system32\drivers\etc\hosts
  2⤵
  PID:2244
- C:\Windows\system32\find.exe
  FIND /C /I "speccy.piriform.com" C:\Windows\system32\drivers\etc\hosts
  2⤵
  PID:4708
- C:\Windows\system32\find.exe
  FIND /C /I "www.speccy.piriform.com" C:\Windows\system32\drivers\etc\hosts
  2⤵
  PID:1456
- C:\Windows\system32\find.exe
  FIND /C /I "recuva.piriform.com" C:\Windows\system32\drivers\etc\hosts
  2⤵
  PID:2464
- C:\Windows\system32\find.exe
  FIND /C /I "www.recuva.piriform.com" C:\Windows\system32\drivers\etc\hosts
  2⤵
  PID:924
- C:\Windows\system32\find.exe
  FIND /C /I "defraggler.piriform.com" C:\Windows\system32\drivers\etc\hosts
  2⤵
  PID:1696
- C:\Windows\system32\find.exe
  FIND /C /I "www.defraggler.piriform.com" C:\Windows\system32\drivers\etc\hosts
  2⤵
  PID:3100
- C:\Windows\system32\find.exe
  FIND /C /I "ccleaner.piriform.com" C:\Windows\system32\drivers\etc\hosts
  2⤵
  PID:2412
- C:\Windows\system32\find.exe
  FIND /C /I "www.ccleaner.piriform.com" C:\Windows\system32\drivers\etc\hosts
  2⤵
  PID:4484
- C:\Windows\system32\find.exe
  FIND /C /I "license-api.ccleaner.com" C:\Windows\system32\drivers\etc\hosts
  2⤵
  PID:2036
- C:\Windows\system32\attrib.exe
  attrib +h +r +s "C:\Windows\system32\drivers\etc\hosts"
  2⤵
  - Drops file in Drivers directory
  - Views/modifies file attributes
  PID:4312
- C:\Windows\system32\timeout.exe
  timeout -1
  2⤵
  - Delays execution with timeout.exe
  PID:2204

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Access Token Manipulation

T1134

Create Process with Token

T1134.002

Defense Evasion

Access Token Manipulation

T1134

Create Process with Token

T1134.002

File and Directory Permissions Modification

T1222

Windows File and Directory Permissions Modification

T1222.001

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 fd1a1472795deb9f898f0ee8d14be6f39c72a13e09be36aa6b2308f353a4f900
MD5 70809cd25a7156ceaa842a6d11d98fcf
SHA1 52eeef0faf1fb4d76366229fb14d0d5c77489fce
SHA512 e00702864a178e24fa41f6096a7d9e3062257710c6130f94739f1f70bcb83b2973596d9e191909c79e3dc1df2cfc6df2ede24201c44cda2abb8cc46dc6d87a22
MD5 SHA1 SHA512

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 1312905ca1051276ae1e0b8bf811e1a80fdaede690b44979290d14ebcc82e9b0
MD5 79d033feb5668b9617389d58be8f8ead
SHA1 ec216d3223200e427c1fb7bb563cb0af25e3cf61
SHA512 cb0c32963e31db40e2062ba59c5ee476e224f785ae1eb02654169b724d6d302b0a76df431b5471bd2053aba2aadb89c12af93b94960d8b9f3b6c744b425d568f
MD5 SHA1 SHA512

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 4fb35d4656edc4e693d990c67acd21fed25f0e3376e7b946863eadbd02fbbe9c
MD5 3f358de74cf8a61f7e6fbc5e24535ec4
SHA1 598ee1c79f324fb4181489bff2fa7782c18b4334
SHA512 553079ffd0c00961130141bee90b3d7038b94394c4b430838c84164c3f738feb3849ab9ddf87f2eb14c80085e5dce77c0c7844f144c99d0baa82b935cbf448e0
MD5 SHA1 SHA512

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 99942c3c7b073592f0da6eb296fb63daa1e139f05a9bd6dc3685bdb9ef6a2768
MD5 05ede6389e1581ee8d56e468699ecf87
SHA1 40643b63b6f1d95f70469db0e2164197fefba265
SHA512 2b3d1159bd73b5d840b2872d85a25ffef3c5e200c2027166385392ee80889c89aa73a769e1882bec82654f0ff7a353744322024381c7710ffd3ef1ba20b3771d
MD5 SHA1 SHA512

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 8231fa62369f0ab4fb4de709a9f2f8f7092fae9c2aab9a369bf4fadbf031e638
MD5 a3b83bc2bbc323a0fe9591b4f2341f5d
SHA1 12a9049771222e39822293f2e49b5cef56b6f11c
SHA512 96d550687ee82f4b0435906e37646bcd1fa7a9c2f44f6de35868838711064f5c7fa9d6a508383bf4b17472ada1b1e4ea13334b918b6dc7644bf33286768dff8f
MD5 SHA1 SHA512

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 ca72cb1641543719081fb6607ab405add80d99e4c2d1690cd74868164823eb12
MD5 6e1461c4232df9de51d7499c3a5830f5
SHA1 735fc6cfcd8950ffc5dce3c3ba95341532ed6e1f
SHA512 f7d0a50444cde595473285891e8c154e4064ca16754c9d82bf71a17fa0237f43bf9f85818080a24b16de42f3fe3597d412bbdd01faebf08c43470167e8761f00
MD5 SHA1 SHA512

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 492b95567565fb33e4bf5f1ecaeb4be8aee8a20a67c54660f0deda8f6d38ebd8
MD5 276aabf22b1439a4b420d405f7cd71ca
SHA1 bc08f7ee108c533ca754c7a34253122a9a3fd32c
SHA512 aa026f61bfd832578099f42a9dec1b90e8cae01f13cacd027ff6e2a78c9fa8250edcc3434a127393c4d78e050a87f0ae40b79758918f0d2660dd789136e6b4ae
MD5 SHA1 SHA512

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 09103bae19af0841e6ce4687d5108e5c26739bb464e7fd33b5959e235b7b6d6d
MD5 996c623bbabea0c23e55b1a7a3a23460
SHA1 2a7be56aabc8d469ba2e51ce1abc3b2202d44fe8
SHA512 7abb4b9eda2305aada65eabfee06dc6da8a2957edac78b0cceaa7893e41094873b97ff4ea1feb6427313c6c8826e8829989c9ecec9596b728ef4c9f6aa941efa
MD5 SHA1 SHA512

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 37e59dcaa10f3c38eea641c753a8be9c16feab65095857a040c2003d74c9100f
MD5 ad0b57ce666c9c3d169da07aed9af78b
SHA1 e9e4233995efe326c3c627c856fc95b9aefcf9c6
SHA512 6df1ee11a97c6a0d2790c89bdc69d7b9e83defaa7e2a90e0677e2faeaf05c848155e06ee7fc924f7621b09d9b7564c764204b1381f01acafc602d6c19de07caa
MD5 SHA1 SHA512

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 957b94d5a0ad789fc5e6970757f8dc9c246423ea92055ddf60d2844dea745133
MD5 b45200515c29a4beac5d3dcb914a7fc4
SHA1 49b6450f15336ed7f9980c4f5476d81b54fefc29
SHA512 d62555cbc390be0a16ce311c0fbf5876a1f506f25d5bbb4e49640d805db50c17eacba580d53533fa3f1b4fd9210a6c6ca5878d369116d477c30df83472b83c4c
MD5 SHA1 SHA512

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 60282a234ba110d3ed9f1d2018d8828f08aea4231f3c817b23e57f012b7ce55a
MD5 5c91a3889e4a188e80312f93f9881d58
SHA1 d89657fe43a98d45d4af5490b62dd714e26daddc
SHA512 5a112b2236218ed00d31bd7880ba9bd4598689c6ed6715ab71c4e86661a8030cb764c951e59261b2073363d26ff2a2b5125e16cf3215aa40428968b4a776251a
MD5 SHA1 SHA512

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 d1f073bdf8ebc6a227dd6e9244cd5ef23cf6981a87157d3c5f77b0321f91f5e3
MD5 8e01c79df4903471d0b5a822770b3ace
SHA1 72700ce1969e75ee52d6db0811f34a3fa4ff7731
SHA512 3cfcf744c9ccbb583935a340f997ae46fa18d6c1741eea535c502b5b915e2a88725874f84c434997135cb2f64a43f97ff42b9421a83291882d906e226bb4fe7e
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads