Analysis

  • max time kernel
    40s
  • max time network
    61s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240802-en
  • resource tags

    arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    04-10-2024 12:39

General

  • Target

    main.ps1

  • Size

    2KB

  • MD5

    88aa62867825de94f6a8f43f13d90e7d

  • SHA1

    a6d1afe3d21325450278e898d1da914c8da01a7b

  • SHA256

    3d608823e5fe78abfec958f0aeff849f6cfba5f8fa1a5a01a0f325308c81f293

  • SHA512

    a7ee84e4b5f3cf859bf9239abd891cf0a4ff524fbf37ab98a4d2c7e8752305fb9eb4517464873c7270861866b79e1181c2af452d848888c95f91a071eb68176c

Malware Config

Signatures

  • Possible privilege escalation attempt 18 IoCs
  • Modifies file permissions 1 TTPs 18 IoCs
  • File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
  • Drops file in System32 directory 5 IoCs
  • Drops file in Windows directory 3 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Suspicious behavior: EnumeratesProcesses 38 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\main.ps1
    1⤵
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Command and Scripting Interpreter: PowerShell
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5436
    • C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /c takeown /F C:\Windows\System32\fr-FR\fms.dll.mui
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2124
      • C:\Windows\system32\takeown.exe
        takeown /F C:\Windows\System32\fr-FR\fms.dll.mui
        3⤵
        • Possible privilege escalation attempt
        • Modifies file permissions
        • Suspicious use of AdjustPrivilegeToken
        PID:3996
    • C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /c icacls C:\Windows\System32\fr-FR\fms.dll.mui /grant administrators:F
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:948
      • C:\Windows\system32\icacls.exe
        icacls C:\Windows\System32\fr-FR\fms.dll.mui /grant administrators:F
        3⤵
        • Possible privilege escalation attempt
        • Modifies file permissions
        PID:4868
    • C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /c takeown /F "C:\Windows\explorer.exe" /A /R /D Y
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3424
      • C:\Windows\system32\takeown.exe
        takeown /F "C:\Windows\explorer.exe" /A /R /D Y
        3⤵
        • Possible privilege escalation attempt
        • Modifies file permissions
        PID:1540
    • C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /c icacls "C:\Windows\explorer.exe" /grant administrators:F /T
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:5620
      • C:\Windows\system32\icacls.exe
        icacls "C:\Windows\explorer.exe" /grant administrators:F /T
        3⤵
        • Possible privilege escalation attempt
        • Modifies file permissions
        PID:3920
    • C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /c takeown /F "C:\Windows\System32\taskmgr.exe" /A /R /D Y
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1744
      • C:\Windows\system32\takeown.exe
        takeown /F "C:\Windows\System32\taskmgr.exe" /A /R /D Y
        3⤵
        • Possible privilege escalation attempt
        • Modifies file permissions
        PID:5660
    • C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /c icacls "C:\Windows\System32\taskmgr.exe" /grant administrators:F /T
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3988
      • C:\Windows\system32\icacls.exe
        icacls "C:\Windows\System32\taskmgr.exe" /grant administrators:F /T
        3⤵
        • Possible privilege escalation attempt
        • Modifies file permissions
        PID:2844
    • C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /c takeown /F "C:\Windows\System32\cmd.exe" /A /R /D Y
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2760
      • C:\Windows\system32\takeown.exe
        takeown /F "C:\Windows\System32\cmd.exe" /A /R /D Y
        3⤵
        • Possible privilege escalation attempt
        • Modifies file permissions
        PID:5644
    • C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /c icacls "C:\Windows\System32\cmd.exe" /grant administrators:F /T
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:5628
      • C:\Windows\system32\icacls.exe
        icacls "C:\Windows\System32\cmd.exe" /grant administrators:F /T
        3⤵
        • Possible privilege escalation attempt
        • Modifies file permissions
        PID:2976
    • C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /c takeown /F "C:\Windows\regedit.exe" /A /R /D Y
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2896
      • C:\Windows\system32\takeown.exe
        takeown /F "C:\Windows\regedit.exe" /A /R /D Y
        3⤵
        • Possible privilege escalation attempt
        • Modifies file permissions
        PID:2548
    • C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /c icacls "C:\Windows\regedit.exe" /grant administrators:F /T
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1980
      • C:\Windows\system32\icacls.exe
        icacls "C:\Windows\regedit.exe" /grant administrators:F /T
        3⤵
        • Possible privilege escalation attempt
        • Modifies file permissions
        PID:1244
    • C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /c takeown /F "C:\Windows\notepad.exe" /A /R /D Y
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3408
      • C:\Windows\system32\takeown.exe
        takeown /F "C:\Windows\notepad.exe" /A /R /D Y
        3⤵
        • Possible privilege escalation attempt
        • Modifies file permissions
        PID:1704
    • C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /c icacls "C:\Windows\notepad.exe" /grant administrators:F /T
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3376
      • C:\Windows\system32\icacls.exe
        icacls "C:\Windows\notepad.exe" /grant administrators:F /T
        3⤵
        • Possible privilege escalation attempt
        • Modifies file permissions
        PID:1748
    • C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /c takeown /F "C:\Windows\System32\control.exe" /A /R /D Y
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3216
      • C:\Windows\system32\takeown.exe
        takeown /F "C:\Windows\System32\control.exe" /A /R /D Y
        3⤵
        • Possible privilege escalation attempt
        • Modifies file permissions
        PID:2132
    • C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /c icacls "C:\Windows\System32\control.exe" /grant administrators:F /T
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2380
      • C:\Windows\system32\icacls.exe
        icacls "C:\Windows\System32\control.exe" /grant administrators:F /T
        3⤵
        • Possible privilege escalation attempt
        • Modifies file permissions
        PID:240
    • C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /c takeown /F "C:\Windows\System32\msconfig.exe" /A /R /D Y
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3884
      • C:\Windows\system32\takeown.exe
        takeown /F "C:\Windows\System32\msconfig.exe" /A /R /D Y
        3⤵
        • Possible privilege escalation attempt
        • Modifies file permissions
        PID:3340
    • C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /c icacls "C:\Windows\System32\msconfig.exe" /grant administrators:F /T
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3356
      • C:\Windows\system32\icacls.exe
        icacls "C:\Windows\System32\msconfig.exe" /grant administrators:F /T
        3⤵
        • Possible privilege escalation attempt
        • Modifies file permissions
        PID:1872
    • C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /c takeown /F "C:\Windows\System32\regedt32.exe" /A /R /D Y
      2⤵
        PID:1188
        • C:\Windows\system32\takeown.exe
          takeown /F "C:\Windows\System32\regedt32.exe" /A /R /D Y
          3⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          PID:2248
      • C:\Windows\system32\cmd.exe
        "C:\Windows\system32\cmd.exe" /c icacls "C:\Windows\System32\regedt32.exe" /grant administrators:F /T
        2⤵
          PID:3020
          • C:\Windows\system32\icacls.exe
            icacls "C:\Windows\System32\regedt32.exe" /grant administrators:F /T
            3⤵
            • Possible privilege escalation attempt
            • Modifies file permissions
            PID:3968

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rbxgg0di.hec.ps1

        Filesize

        60B

        MD5

        d17fe0a3f47be24a6453e9ef58c94641

        SHA1

        6ab83620379fc69f80c0242105ddffd7d98d5d9d

        SHA256

        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

        SHA512

        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

      • memory/5436-0-0x00007FFAF1F63000-0x00007FFAF1F65000-memory.dmp

        Filesize

        8KB

      • memory/5436-1-0x0000021F67420000-0x0000021F67442000-memory.dmp

        Filesize

        136KB

      • memory/5436-10-0x00007FFAF1F60000-0x00007FFAF2A22000-memory.dmp

        Filesize

        10.8MB

      • memory/5436-11-0x00007FFAF1F60000-0x00007FFAF2A22000-memory.dmp

        Filesize

        10.8MB

      • memory/5436-12-0x00007FFAF1F60000-0x00007FFAF2A22000-memory.dmp

        Filesize

        10.8MB

      • memory/5436-13-0x00007FFAF1F63000-0x00007FFAF1F65000-memory.dmp

        Filesize

        8KB

      • memory/5436-14-0x00007FFAF1F60000-0x00007FFAF2A22000-memory.dmp

        Filesize

        10.8MB

      • memory/5436-15-0x00007FFAF1F60000-0x00007FFAF2A22000-memory.dmp

        Filesize

        10.8MB

      • memory/5436-16-0x00007FFAF1F60000-0x00007FFAF2A22000-memory.dmp

        Filesize

        10.8MB