Analysis
-
max time kernel
40s -
max time network
61s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system -
submitted
04-10-2024 12:39
Static task
static1
Behavioral task
behavioral1
Sample
main.ps1
Resource
win11-20240802-en
General
-
Target
main.ps1
-
Size
2KB
-
MD5
88aa62867825de94f6a8f43f13d90e7d
-
SHA1
a6d1afe3d21325450278e898d1da914c8da01a7b
-
SHA256
3d608823e5fe78abfec958f0aeff849f6cfba5f8fa1a5a01a0f325308c81f293
-
SHA512
a7ee84e4b5f3cf859bf9239abd891cf0a4ff524fbf37ab98a4d2c7e8752305fb9eb4517464873c7270861866b79e1181c2af452d848888c95f91a071eb68176c
Malware Config
Signatures
-
Possible privilege escalation attempt 18 IoCs
Processes:
icacls.exetakeown.exeicacls.exetakeown.exeicacls.exetakeown.exeicacls.exetakeown.exeicacls.exeicacls.exeicacls.exetakeown.exeicacls.exetakeown.exetakeown.exetakeown.exetakeown.exeicacls.exepid Process 2976 icacls.exe 2548 takeown.exe 1244 icacls.exe 3340 takeown.exe 3968 icacls.exe 1540 takeown.exe 3920 icacls.exe 5644 takeown.exe 1872 icacls.exe 4868 icacls.exe 2844 icacls.exe 2132 takeown.exe 240 icacls.exe 2248 takeown.exe 3996 takeown.exe 5660 takeown.exe 1704 takeown.exe 1748 icacls.exe -
Modifies file permissions 1 TTPs 18 IoCs
Processes:
takeown.exeicacls.exetakeown.exeicacls.exetakeown.exetakeown.exeicacls.exeicacls.exeicacls.exetakeown.exeicacls.exetakeown.exetakeown.exetakeown.exeicacls.exeicacls.exeicacls.exetakeown.exepid Process 1704 takeown.exe 1748 icacls.exe 2132 takeown.exe 240 icacls.exe 3996 takeown.exe 1540 takeown.exe 3920 icacls.exe 1244 icacls.exe 1872 icacls.exe 2248 takeown.exe 2844 icacls.exe 5644 takeown.exe 2548 takeown.exe 5660 takeown.exe 2976 icacls.exe 3968 icacls.exe 4868 icacls.exe 3340 takeown.exe -
File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
-
Drops file in System32 directory 5 IoCs
Processes:
powershell.exedescription ioc Process File opened for modification C:\Windows\System32\regedt32.exe powershell.exe File opened for modification C:\Windows\System32\taskmgr.exe powershell.exe File opened for modification C:\Windows\System32\cmd.exe powershell.exe File opened for modification C:\Windows\System32\control.exe powershell.exe File opened for modification C:\Windows\System32\msconfig.exe powershell.exe -
Drops file in Windows directory 3 IoCs
Processes:
powershell.exedescription ioc Process File opened for modification C:\Windows\explorer.exe powershell.exe File opened for modification C:\Windows\regedit.exe powershell.exe File opened for modification C:\Windows\notepad.exe powershell.exe -
Suspicious behavior: EnumeratesProcesses 38 IoCs
Processes:
powershell.exepid Process 5436 powershell.exe 5436 powershell.exe 5436 powershell.exe 5436 powershell.exe 5436 powershell.exe 5436 powershell.exe 5436 powershell.exe 5436 powershell.exe 5436 powershell.exe 5436 powershell.exe 5436 powershell.exe 5436 powershell.exe 5436 powershell.exe 5436 powershell.exe 5436 powershell.exe 5436 powershell.exe 5436 powershell.exe 5436 powershell.exe 5436 powershell.exe 5436 powershell.exe 5436 powershell.exe 5436 powershell.exe 5436 powershell.exe 5436 powershell.exe 5436 powershell.exe 5436 powershell.exe 5436 powershell.exe 5436 powershell.exe 5436 powershell.exe 5436 powershell.exe 5436 powershell.exe 5436 powershell.exe 5436 powershell.exe 5436 powershell.exe 5436 powershell.exe 5436 powershell.exe 5436 powershell.exe 5436 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
powershell.exetakeown.exedescription pid Process Token: SeDebugPrivilege 5436 powershell.exe Token: SeTakeOwnershipPrivilege 3996 takeown.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
powershell.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exedescription pid Process procid_target PID 5436 wrote to memory of 2124 5436 powershell.exe 79 PID 5436 wrote to memory of 2124 5436 powershell.exe 79 PID 2124 wrote to memory of 3996 2124 cmd.exe 80 PID 2124 wrote to memory of 3996 2124 cmd.exe 80 PID 5436 wrote to memory of 948 5436 powershell.exe 81 PID 5436 wrote to memory of 948 5436 powershell.exe 81 PID 948 wrote to memory of 4868 948 cmd.exe 82 PID 948 wrote to memory of 4868 948 cmd.exe 82 PID 5436 wrote to memory of 3424 5436 powershell.exe 83 PID 5436 wrote to memory of 3424 5436 powershell.exe 83 PID 3424 wrote to memory of 1540 3424 cmd.exe 84 PID 3424 wrote to memory of 1540 3424 cmd.exe 84 PID 5436 wrote to memory of 5620 5436 powershell.exe 85 PID 5436 wrote to memory of 5620 5436 powershell.exe 85 PID 5620 wrote to memory of 3920 5620 cmd.exe 86 PID 5620 wrote to memory of 3920 5620 cmd.exe 86 PID 5436 wrote to memory of 1744 5436 powershell.exe 87 PID 5436 wrote to memory of 1744 5436 powershell.exe 87 PID 1744 wrote to memory of 5660 1744 cmd.exe 88 PID 1744 wrote to memory of 5660 1744 cmd.exe 88 PID 5436 wrote to memory of 3988 5436 powershell.exe 89 PID 5436 wrote to memory of 3988 5436 powershell.exe 89 PID 3988 wrote to memory of 2844 3988 cmd.exe 90 PID 3988 wrote to memory of 2844 3988 cmd.exe 90 PID 5436 wrote to memory of 2760 5436 powershell.exe 91 PID 5436 wrote to memory of 2760 5436 powershell.exe 91 PID 2760 wrote to memory of 5644 2760 cmd.exe 92 PID 2760 wrote to memory of 5644 2760 cmd.exe 92 PID 5436 wrote to memory of 5628 5436 powershell.exe 93 PID 5436 wrote to memory of 5628 5436 powershell.exe 93 PID 5628 wrote to memory of 2976 5628 cmd.exe 94 PID 5628 wrote to memory of 2976 5628 cmd.exe 94 PID 5436 wrote to memory of 2896 5436 powershell.exe 95 PID 5436 wrote to memory of 2896 5436 powershell.exe 95 PID 2896 wrote to memory of 2548 2896 cmd.exe 96 PID 2896 wrote to memory of 2548 2896 cmd.exe 96 PID 5436 wrote to memory of 1980 5436 powershell.exe 97 PID 5436 wrote to memory of 1980 5436 powershell.exe 97 PID 1980 wrote to memory of 1244 1980 cmd.exe 98 PID 1980 wrote to memory of 1244 1980 cmd.exe 98 PID 5436 wrote to memory of 3408 5436 powershell.exe 99 PID 5436 wrote to memory of 3408 5436 powershell.exe 99 PID 3408 wrote to memory of 1704 3408 cmd.exe 100 PID 3408 wrote to memory of 1704 3408 cmd.exe 100 PID 5436 wrote to memory of 3376 5436 powershell.exe 101 PID 5436 wrote to memory of 3376 5436 powershell.exe 101 PID 3376 wrote to memory of 1748 3376 cmd.exe 102 PID 3376 wrote to memory of 1748 3376 cmd.exe 102 PID 5436 wrote to memory of 3216 5436 powershell.exe 103 PID 5436 wrote to memory of 3216 5436 powershell.exe 103 PID 3216 wrote to memory of 2132 3216 cmd.exe 104 PID 3216 wrote to memory of 2132 3216 cmd.exe 104 PID 5436 wrote to memory of 2380 5436 powershell.exe 105 PID 5436 wrote to memory of 2380 5436 powershell.exe 105 PID 2380 wrote to memory of 240 2380 cmd.exe 106 PID 2380 wrote to memory of 240 2380 cmd.exe 106 PID 5436 wrote to memory of 3884 5436 powershell.exe 107 PID 5436 wrote to memory of 3884 5436 powershell.exe 107 PID 3884 wrote to memory of 3340 3884 cmd.exe 108 PID 3884 wrote to memory of 3340 3884 cmd.exe 108 PID 5436 wrote to memory of 3356 5436 powershell.exe 109 PID 5436 wrote to memory of 3356 5436 powershell.exe 109 PID 3356 wrote to memory of 1872 3356 cmd.exe 110 PID 3356 wrote to memory of 1872 3356 cmd.exe 110
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\main.ps11⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5436 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c takeown /F C:\Windows\System32\fr-FR\fms.dll.mui2⤵
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Windows\system32\takeown.exetakeown /F C:\Windows\System32\fr-FR\fms.dll.mui3⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:3996
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c icacls C:\Windows\System32\fr-FR\fms.dll.mui /grant administrators:F2⤵
- Suspicious use of WriteProcessMemory
PID:948 -
C:\Windows\system32\icacls.exeicacls C:\Windows\System32\fr-FR\fms.dll.mui /grant administrators:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:4868
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c takeown /F "C:\Windows\explorer.exe" /A /R /D Y2⤵
- Suspicious use of WriteProcessMemory
PID:3424 -
C:\Windows\system32\takeown.exetakeown /F "C:\Windows\explorer.exe" /A /R /D Y3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1540
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c icacls "C:\Windows\explorer.exe" /grant administrators:F /T2⤵
- Suspicious use of WriteProcessMemory
PID:5620 -
C:\Windows\system32\icacls.exeicacls "C:\Windows\explorer.exe" /grant administrators:F /T3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:3920
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c takeown /F "C:\Windows\System32\taskmgr.exe" /A /R /D Y2⤵
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Windows\system32\takeown.exetakeown /F "C:\Windows\System32\taskmgr.exe" /A /R /D Y3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:5660
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c icacls "C:\Windows\System32\taskmgr.exe" /grant administrators:F /T2⤵
- Suspicious use of WriteProcessMemory
PID:3988 -
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32\taskmgr.exe" /grant administrators:F /T3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:2844
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c takeown /F "C:\Windows\System32\cmd.exe" /A /R /D Y2⤵
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Windows\system32\takeown.exetakeown /F "C:\Windows\System32\cmd.exe" /A /R /D Y3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:5644
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c icacls "C:\Windows\System32\cmd.exe" /grant administrators:F /T2⤵
- Suspicious use of WriteProcessMemory
PID:5628 -
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32\cmd.exe" /grant administrators:F /T3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:2976
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c takeown /F "C:\Windows\regedit.exe" /A /R /D Y2⤵
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Windows\system32\takeown.exetakeown /F "C:\Windows\regedit.exe" /A /R /D Y3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:2548
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c icacls "C:\Windows\regedit.exe" /grant administrators:F /T2⤵
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Windows\system32\icacls.exeicacls "C:\Windows\regedit.exe" /grant administrators:F /T3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1244
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c takeown /F "C:\Windows\notepad.exe" /A /R /D Y2⤵
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\Windows\system32\takeown.exetakeown /F "C:\Windows\notepad.exe" /A /R /D Y3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1704
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c icacls "C:\Windows\notepad.exe" /grant administrators:F /T2⤵
- Suspicious use of WriteProcessMemory
PID:3376 -
C:\Windows\system32\icacls.exeicacls "C:\Windows\notepad.exe" /grant administrators:F /T3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1748
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c takeown /F "C:\Windows\System32\control.exe" /A /R /D Y2⤵
- Suspicious use of WriteProcessMemory
PID:3216 -
C:\Windows\system32\takeown.exetakeown /F "C:\Windows\System32\control.exe" /A /R /D Y3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:2132
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c icacls "C:\Windows\System32\control.exe" /grant administrators:F /T2⤵
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32\control.exe" /grant administrators:F /T3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:240
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c takeown /F "C:\Windows\System32\msconfig.exe" /A /R /D Y2⤵
- Suspicious use of WriteProcessMemory
PID:3884 -
C:\Windows\system32\takeown.exetakeown /F "C:\Windows\System32\msconfig.exe" /A /R /D Y3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:3340
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c icacls "C:\Windows\System32\msconfig.exe" /grant administrators:F /T2⤵
- Suspicious use of WriteProcessMemory
PID:3356 -
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32\msconfig.exe" /grant administrators:F /T3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1872
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c takeown /F "C:\Windows\System32\regedt32.exe" /A /R /D Y2⤵PID:1188
-
C:\Windows\system32\takeown.exetakeown /F "C:\Windows\System32\regedt32.exe" /A /R /D Y3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:2248
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c icacls "C:\Windows\System32\regedt32.exe" /grant administrators:F /T2⤵PID:3020
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32\regedt32.exe" /grant administrators:F /T3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:3968
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82