Analysis
-
max time kernel
54s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system -
submitted
27-11-2024 07:18
Behavioral task
behavioral1
Sample
X.exe
Resource
win11-20241007-en
windows11-21h2-x64
9 signatures
150 seconds
General
-
Target
X.exe
-
Size
102KB
-
MD5
c9e523ca6662a0cd384d139e92b77c9c
-
SHA1
f005e29f97f3c401cc7283d6ae315728a3be9583
-
SHA256
dc714e9375a1d7d28b3ab1869fa24b059e8b4277e15e73b35635131f7dea7643
-
SHA512
3de856c025aa15155bad5407146e85d01e322ab0de8de17c98e4ccf5744e235296bb5bee6c0fec54d2333ba7f2a80f424f57f1259b8899ecf4ddd5aa41d3aa90
-
SSDEEP
1536:2BsPHJyUmkrmihnmAZjaaWDUVnAExfCeTPOW0imYFU47o9Tuui:JfMUm4XQCCD0tPOVvYFx7oZo
Malware Config
Signatures
-
Possible privilege escalation attempt 4 IoCs
Processes:
takeown.exeicacls.exetakeown.exeicacls.exepid Process 1268 takeown.exe 4640 icacls.exe 428 takeown.exe 3908 icacls.exe -
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
-
Modifies file permissions 1 TTPs 4 IoCs
Processes:
takeown.exeicacls.exetakeown.exeicacls.exepid Process 428 takeown.exe 3908 icacls.exe 1268 takeown.exe 4640 icacls.exe -
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
takeown.exedescription ioc Process File opened (read-only) \??\D: takeown.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
X.exedescription ioc Process File opened for modification \??\PhysicalDrive0 X.exe -
Processes:
resource yara_rule behavioral1/memory/2912-0-0x00007FF6DA400000-0x00007FF6DA431000-memory.dmp upx behavioral1/memory/2912-2-0x00007FF6DA400000-0x00007FF6DA431000-memory.dmp upx -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
takeown.exedescription pid Process Token: SeTakeOwnershipPrivilege 428 takeown.exe Token: SeTakeOwnershipPrivilege 428 takeown.exe Token: SeTakeOwnershipPrivilege 428 takeown.exe Token: SeTakeOwnershipPrivilege 428 takeown.exe Token: SeTakeOwnershipPrivilege 428 takeown.exe Token: SeTakeOwnershipPrivilege 428 takeown.exe Token: SeTakeOwnershipPrivilege 428 takeown.exe Token: SeTakeOwnershipPrivilege 428 takeown.exe Token: SeTakeOwnershipPrivilege 428 takeown.exe Token: SeTakeOwnershipPrivilege 428 takeown.exe Token: SeTakeOwnershipPrivilege 428 takeown.exe Token: SeTakeOwnershipPrivilege 428 takeown.exe Token: SeTakeOwnershipPrivilege 428 takeown.exe Token: SeTakeOwnershipPrivilege 428 takeown.exe Token: SeTakeOwnershipPrivilege 428 takeown.exe Token: SeTakeOwnershipPrivilege 428 takeown.exe Token: SeTakeOwnershipPrivilege 428 takeown.exe Token: SeTakeOwnershipPrivilege 428 takeown.exe Token: SeTakeOwnershipPrivilege 428 takeown.exe Token: SeTakeOwnershipPrivilege 428 takeown.exe Token: SeTakeOwnershipPrivilege 428 takeown.exe Token: SeTakeOwnershipPrivilege 428 takeown.exe Token: SeTakeOwnershipPrivilege 428 takeown.exe Token: SeTakeOwnershipPrivilege 428 takeown.exe Token: SeTakeOwnershipPrivilege 428 takeown.exe Token: SeTakeOwnershipPrivilege 428 takeown.exe Token: SeTakeOwnershipPrivilege 428 takeown.exe Token: SeTakeOwnershipPrivilege 428 takeown.exe Token: SeTakeOwnershipPrivilege 428 takeown.exe Token: SeTakeOwnershipPrivilege 428 takeown.exe Token: SeTakeOwnershipPrivilege 428 takeown.exe Token: SeTakeOwnershipPrivilege 428 takeown.exe Token: SeTakeOwnershipPrivilege 428 takeown.exe Token: SeTakeOwnershipPrivilege 428 takeown.exe Token: SeTakeOwnershipPrivilege 428 takeown.exe Token: SeTakeOwnershipPrivilege 428 takeown.exe Token: SeTakeOwnershipPrivilege 428 takeown.exe Token: SeTakeOwnershipPrivilege 428 takeown.exe Token: SeTakeOwnershipPrivilege 428 takeown.exe Token: SeTakeOwnershipPrivilege 428 takeown.exe Token: SeTakeOwnershipPrivilege 428 takeown.exe Token: SeTakeOwnershipPrivilege 428 takeown.exe Token: SeTakeOwnershipPrivilege 428 takeown.exe Token: SeTakeOwnershipPrivilege 428 takeown.exe Token: SeTakeOwnershipPrivilege 428 takeown.exe Token: SeTakeOwnershipPrivilege 428 takeown.exe Token: SeTakeOwnershipPrivilege 428 takeown.exe Token: SeTakeOwnershipPrivilege 428 takeown.exe Token: SeTakeOwnershipPrivilege 428 takeown.exe Token: SeTakeOwnershipPrivilege 428 takeown.exe Token: SeTakeOwnershipPrivilege 428 takeown.exe Token: SeTakeOwnershipPrivilege 428 takeown.exe Token: SeTakeOwnershipPrivilege 428 takeown.exe Token: SeTakeOwnershipPrivilege 428 takeown.exe Token: SeTakeOwnershipPrivilege 428 takeown.exe Token: SeTakeOwnershipPrivilege 428 takeown.exe Token: SeTakeOwnershipPrivilege 428 takeown.exe Token: SeTakeOwnershipPrivilege 428 takeown.exe Token: SeTakeOwnershipPrivilege 428 takeown.exe Token: SeTakeOwnershipPrivilege 428 takeown.exe Token: SeTakeOwnershipPrivilege 428 takeown.exe Token: SeTakeOwnershipPrivilege 428 takeown.exe Token: SeTakeOwnershipPrivilege 428 takeown.exe Token: SeTakeOwnershipPrivilege 428 takeown.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
X.exedescription pid Process procid_target PID 2912 wrote to memory of 1268 2912 X.exe 78 PID 2912 wrote to memory of 1268 2912 X.exe 78 PID 2912 wrote to memory of 4640 2912 X.exe 79 PID 2912 wrote to memory of 4640 2912 X.exe 79 PID 2912 wrote to memory of 428 2912 X.exe 80 PID 2912 wrote to memory of 428 2912 X.exe 80 PID 2912 wrote to memory of 3908 2912 X.exe 81 PID 2912 wrote to memory of 3908 2912 X.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\X.exe"C:\Users\Admin\AppData\Local\Temp\X.exe"1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Windows\SYSTEM32\takeown.exetakeown /f D:\ /r /d Y2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Enumerates connected drives
PID:1268
-
-
C:\Windows\SYSTEM32\icacls.exeicacls D:\ /grant Everyone:F /t /c /l2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:4640
-
-
C:\Windows\SYSTEM32\takeown.exetakeown /f C:\ /r /d Y2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:428
-
-
C:\Windows\SYSTEM32\icacls.exeicacls C:\ /grant Everyone:F /t /c /l2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:3908
-