Analysis
- max time kernel
107s - max time network
109s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system - submitted
09/08/2024, 10:31
Static task
static1
Behavioral task
behavioral1
Sample
run.ps1
Resource
win7-20240729-en
windows7-x64
8 signatures
150 seconds
General
- Target run.ps1
- Size 311B
- Sample240809-mkmdtatbre
- SHA256 0b08e922c4fccd49ab1e5d2224c9d8c05b971a2ac1c915272dd2dcbed1eddff2
- MD5 de044d80b036f10d7676b2ed165ca8e2
- SHA1 d57e04d4b51cbd49cb2970c8b3e3a41b6f390b36
- SHA512 7031caed7a49668b90e772167eaf3ed191b04e7efc6f4d178410cfb22fbb3c87ddd636d3fdf7531d9965100603a0fa610775f47e0b9a78d0e47b3b1c7cf352ff
- MD5 SHA1 SHA512
Malware Config
Signatures
- Possible privilege escalation attempt 2 IoCs
pid Process 2772 takeown.exe 3056 icacls.exe - Modifies file permissions 1 TTPs 2 IoCs
pid Process 2772 takeown.exe 3056 icacls.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\System32\Boot\de-DE\winresume.efi.mui powershell.exe File opened for modification C:\Windows\System32\bg-BG\SyncRes.dll.mui powershell.exe File opened for modification C:\Windows\System32\Boot\es-ES powershell.exe File opened for modification C:\Windows\System32\Boot\fr-FR\winresume.efi.mui powershell.exe File opened for modification C:\Windows\System32\Boot\winresume.exe powershell.exe File opened for modification C:\Windows\System32\Bthprops\@BthpropsNotificationLogo.png powershell.exe File opened for modification C:\Windows\System32\AppV\AppVStreamingUX.exe.config powershell.exe File opened for modification C:\Windows\System32\Boot\it-IT\winresume.efi.mui powershell.exe File opened for modification C:\Windows\System32\Boot\en-US\winload.efi.mui powershell.exe File opened for modification C:\Windows\System32\Boot\es-ES\winresume.exe.mui powershell.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Containers-Client-Manager-merged-Package~31bf3856ad364e35~amd64~en-US~10.0.19041.1.cat powershell.exe File opened for modification C:\Windows\System32\bg-BG\comctl32.dll.mui powershell.exe File opened for modification C:\Windows\System32\Boot\fr-FR\winload.exe.mui powershell.exe File opened for modification C:\Windows\System32\Boot\fr-FR powershell.exe File opened for modification C:\Windows\System32\bg-BG\WWAHost.exe.mui powershell.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Containers-ApplicationGuard-Package~31bf3856ad364e35~amd64~en-US~10.0.19041.867.cat powershell.exe File opened for modification C:\Windows\System32\AppV\AppVStreamingUX.exe powershell.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Containers-Client-Manager-merged-Package~31bf3856ad364e35~amd64~de-DE~10.0.19041.1.cat powershell.exe File opened for modification C:\Windows\System32\am-et powershell.exe File opened for modification C:\Windows\System32\Boot\es-ES\winload.efi.mui powershell.exe File opened for modification C:\Windows\System32\Boot\de-DE\winload.efi.mui powershell.exe File opened for modification C:\Windows\System32\Boot\it-IT powershell.exe File opened for modification C:\Windows\System32\Boot\winload.efi powershell.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Containers-ApplicationGuard-Shared-Package~31bf3856ad364e35~amd64~~10.0.19041.153.cat powershell.exe File opened for modification C:\Windows\System32\AdvancedInstallers powershell.exe File opened for modification C:\Windows\System32\ar-SA\msimsg.dll.mui powershell.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Containers-Client-Guest-Package~31bf3856ad364e35~amd64~~10.0.19041.1288.cat powershell.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Containers-Client-Guest-Package~31bf3856ad364e35~amd64~~10.0.19041.264.cat powershell.exe File opened for modification C:\Windows\System32\AdvancedInstallers\cmiv2.dll powershell.exe File opened for modification C:\Windows\System32\CatRoot\{127D0A1D-4EF2-11D1-8608-00C04FC295EE} powershell.exe File opened for modification C:\Windows\System32\Boot\de-DE\winload.exe.mui powershell.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Containers-Client-Manager-merged-Package~31bf3856ad364e35~amd64~es-ES~10.0.19041.1.cat powershell.exe File opened for modification C:\Windows\System32\AppLocker powershell.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Containers-ApplicationGuard-Shared-Package~31bf3856ad364e35~amd64~~10.0.19041.1266.cat powershell.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Containers-ApplicationGuard-Package~31bf3856ad364e35~amd64~~10.0.19041.1288.cat powershell.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Containers-ApplicationGuard-Shared-merged-Package~31bf3856ad364e35~amd64~en-US~10.0.19041.1.cat powershell.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Containers-ApplicationGuard-Shared-merged-Package~31bf3856ad364e35~amd64~~10.0.19041.1266.cat powershell.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Containers-ApplicationGuard-WOW64-Package~31bf3856ad364e35~amd64~en-US~10.0.19041.1.cat powershell.exe File opened for modification C:\Windows\System32\bg-BG\quickassist.exe.mui powershell.exe File opened for modification C:\Windows\System32\Boot\it-IT\winresume.exe.mui powershell.exe File opened for modification C:\Windows\System32\ar-SA\windows.ui.xaml.dll.mui powershell.exe File opened for modification C:\Windows\System32\bg-BG\comdlg32.dll.mui powershell.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Containers-ApplicationGuard-Package~31bf3856ad364e35~amd64~en-US~10.0.19041.1.cat powershell.exe File opened for modification C:\Windows\System32\Boot\en-US powershell.exe File opened for modification C:\Windows\System32\Boot\fr-FR\winresume.exe.mui powershell.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Containers-ApplicationGuard-Shared-WOW64-Package~31bf3856ad364e35~amd64~en-US~10.0.19041.1.cat powershell.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Containers-ApplicationGuard-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1.cat powershell.exe File opened for modification C:\Windows\System32\appraiser\Appraiser_Data.ini powershell.exe File opened for modification C:\Windows\System32\bg-BG powershell.exe File opened for modification C:\Windows\System32\ar-SA\comctl32.dll.mui powershell.exe File opened for modification C:\Windows\System32\Boot\en-US\winresume.exe.mui powershell.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Containers-ApplicationGuard-Shared-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1.cat powershell.exe File opened for modification C:\Windows\System32\ar-SA\fms.dll.mui powershell.exe File opened for modification C:\Windows\System32\Boot\de-DE\winresume.exe.mui powershell.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Containers-ApplicationGuard-Package~31bf3856ad364e35~amd64~~10.0.19041.264.cat powershell.exe File opened for modification C:\Windows\System32\bg-BG\msimsg.dll.mui powershell.exe File opened for modification C:\Windows\System32\ar-SA\SyncRes.dll.mui powershell.exe File opened for modification C:\Windows\System32\Boot\en-US\winresume.efi.mui powershell.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Containers-Client-Guest-Package~31bf3856ad364e35~amd64~en-US~10.0.19041.867.cat powershell.exe File opened for modification C:\Windows\System32\am-et\RBDS045E.dic powershell.exe File opened for modification C:\Windows\System32\ar-SA\comdlg32.dll.mui powershell.exe File opened for modification C:\Windows\System32\Boot\es-ES\winload.exe.mui powershell.exe File opened for modification C:\Windows\System32\Boot\ja-JP\winresume.exe.mui powershell.exe File opened for modification C:\Windows\System32\Boot\ja-JP powershell.exe -
pid Process 1964 powershell.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1964 powershell.exe 1964 powershell.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1964 powershell.exe Token: SeTakeOwnershipPrivilege 2772 takeown.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1964 wrote to memory of 2772 1964 powershell.exe 84 PID 1964 wrote to memory of 2772 1964 powershell.exe 84 PID 1964 wrote to memory of 3056 1964 powershell.exe 91 PID 1964 wrote to memory of 3056 1964 powershell.exe 91
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\run.ps11⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Windows\system32\takeown.exe"C:\Windows\system32\takeown.exe" /f C:\Windows\System32 /r /d y2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:2772
-
-
C:\Windows\system32\icacls.exe"C:\Windows\system32\icacls.exe" C:\Windows\System32 /grant %USERDOMAIN%\%USERNAME% :F /t2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:3056
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3iznrowa.v22.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- MD5 SHA1 SHA512