Analysis
-
max time kernel
40s -
max time network
1s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
30-11-2024 06:01
Behavioral task
behavioral1
Sample
feceab91f4a082684f7224426335f37340d38ff8e7b32e0408df186728b8bb64.exe
Resource
win7-20240903-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
feceab91f4a082684f7224426335f37340d38ff8e7b32e0408df186728b8bb64.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
feceab91f4a082684f7224426335f37340d38ff8e7b32e0408df186728b8bb64.exe
-
Size
50KB
-
MD5
355c2f89e67e95ad1b458519980a47eb
-
SHA1
395f5de2c542f7e81b9a5b218f1bbbbbb6d6f835
-
SHA256
feceab91f4a082684f7224426335f37340d38ff8e7b32e0408df186728b8bb64
-
SHA512
c22dc9892b7dbd7a3b1c4931a42c921ee76484574951408a6a898f18d0cd911af5db9f1f79efb991ecd8b48d18c5dbd84c21f96ac6a61c9f4cf0984f09c3f234
-
SSDEEP
1536:985VEH2aNU2o5DX776Nc8mSsQWUYXtJW:9sE2aNU2WDX7+NEUr
Malware Config
Signatures
-
Possible privilege escalation attempt 4 IoCs
pid Process 2060 takeown.exe 304 icacls.exe 2400 icacls.exe 320 takeown.exe -
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
-
Modifies file permissions 1 TTPs 4 IoCs
pid Process 2060 takeown.exe 304 icacls.exe 2400 icacls.exe 320 takeown.exe -
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\D: takeown.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 feceab91f4a082684f7224426335f37340d38ff8e7b32e0408df186728b8bb64.exe -
resource yara_rule behavioral1/memory/2488-0-0x000000013FFA0000-0x000000013FFD1000-memory.dmp upx behavioral1/memory/2488-3-0x000000013FFA0000-0x000000013FFD1000-memory.dmp upx -
Kills process with taskkill 2 IoCs
pid Process 1400 taskkill.exe 1972 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 320 takeown.exe Token: SeDebugPrivilege 1972 taskkill.exe Token: SeDebugPrivilege 1400 taskkill.exe Token: SeTakeOwnershipPrivilege 320 takeown.exe Token: SeTakeOwnershipPrivilege 320 takeown.exe Token: SeTakeOwnershipPrivilege 320 takeown.exe Token: SeTakeOwnershipPrivilege 320 takeown.exe Token: SeTakeOwnershipPrivilege 320 takeown.exe Token: SeTakeOwnershipPrivilege 320 takeown.exe Token: SeTakeOwnershipPrivilege 320 takeown.exe Token: SeTakeOwnershipPrivilege 320 takeown.exe Token: SeTakeOwnershipPrivilege 320 takeown.exe Token: SeTakeOwnershipPrivilege 320 takeown.exe Token: SeTakeOwnershipPrivilege 320 takeown.exe Token: SeTakeOwnershipPrivilege 320 takeown.exe Token: SeTakeOwnershipPrivilege 320 takeown.exe Token: SeTakeOwnershipPrivilege 320 takeown.exe Token: SeTakeOwnershipPrivilege 320 takeown.exe Token: SeTakeOwnershipPrivilege 320 takeown.exe Token: SeTakeOwnershipPrivilege 320 takeown.exe Token: SeTakeOwnershipPrivilege 320 takeown.exe Token: SeTakeOwnershipPrivilege 320 takeown.exe Token: SeTakeOwnershipPrivilege 320 takeown.exe Token: SeTakeOwnershipPrivilege 320 takeown.exe Token: SeTakeOwnershipPrivilege 320 takeown.exe Token: SeTakeOwnershipPrivilege 320 takeown.exe Token: SeTakeOwnershipPrivilege 320 takeown.exe Token: SeTakeOwnershipPrivilege 320 takeown.exe Token: SeTakeOwnershipPrivilege 320 takeown.exe Token: SeTakeOwnershipPrivilege 320 takeown.exe Token: SeTakeOwnershipPrivilege 320 takeown.exe Token: SeTakeOwnershipPrivilege 320 takeown.exe Token: SeTakeOwnershipPrivilege 320 takeown.exe Token: SeTakeOwnershipPrivilege 320 takeown.exe Token: SeTakeOwnershipPrivilege 320 takeown.exe Token: SeTakeOwnershipPrivilege 320 takeown.exe Token: SeTakeOwnershipPrivilege 320 takeown.exe Token: SeTakeOwnershipPrivilege 320 takeown.exe Token: SeTakeOwnershipPrivilege 320 takeown.exe Token: SeTakeOwnershipPrivilege 320 takeown.exe Token: SeTakeOwnershipPrivilege 320 takeown.exe Token: SeTakeOwnershipPrivilege 320 takeown.exe Token: SeTakeOwnershipPrivilege 320 takeown.exe Token: SeTakeOwnershipPrivilege 320 takeown.exe Token: SeTakeOwnershipPrivilege 320 takeown.exe Token: SeTakeOwnershipPrivilege 320 takeown.exe Token: SeTakeOwnershipPrivilege 320 takeown.exe Token: SeTakeOwnershipPrivilege 320 takeown.exe Token: SeTakeOwnershipPrivilege 320 takeown.exe Token: SeTakeOwnershipPrivilege 320 takeown.exe Token: SeTakeOwnershipPrivilege 320 takeown.exe Token: SeTakeOwnershipPrivilege 320 takeown.exe Token: SeTakeOwnershipPrivilege 320 takeown.exe Token: SeTakeOwnershipPrivilege 320 takeown.exe Token: SeTakeOwnershipPrivilege 320 takeown.exe Token: SeTakeOwnershipPrivilege 320 takeown.exe Token: SeTakeOwnershipPrivilege 320 takeown.exe Token: SeTakeOwnershipPrivilege 320 takeown.exe Token: SeTakeOwnershipPrivilege 320 takeown.exe Token: SeTakeOwnershipPrivilege 320 takeown.exe Token: SeTakeOwnershipPrivilege 320 takeown.exe Token: SeTakeOwnershipPrivilege 320 takeown.exe Token: SeTakeOwnershipPrivilege 320 takeown.exe Token: SeTakeOwnershipPrivilege 320 takeown.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 2488 wrote to memory of 2504 2488 feceab91f4a082684f7224426335f37340d38ff8e7b32e0408df186728b8bb64.exe 32 PID 2488 wrote to memory of 2504 2488 feceab91f4a082684f7224426335f37340d38ff8e7b32e0408df186728b8bb64.exe 32 PID 2488 wrote to memory of 2504 2488 feceab91f4a082684f7224426335f37340d38ff8e7b32e0408df186728b8bb64.exe 32 PID 2488 wrote to memory of 2060 2488 feceab91f4a082684f7224426335f37340d38ff8e7b32e0408df186728b8bb64.exe 33 PID 2488 wrote to memory of 2060 2488 feceab91f4a082684f7224426335f37340d38ff8e7b32e0408df186728b8bb64.exe 33 PID 2488 wrote to memory of 2060 2488 feceab91f4a082684f7224426335f37340d38ff8e7b32e0408df186728b8bb64.exe 33 PID 2488 wrote to memory of 304 2488 feceab91f4a082684f7224426335f37340d38ff8e7b32e0408df186728b8bb64.exe 34 PID 2488 wrote to memory of 304 2488 feceab91f4a082684f7224426335f37340d38ff8e7b32e0408df186728b8bb64.exe 34 PID 2488 wrote to memory of 304 2488 feceab91f4a082684f7224426335f37340d38ff8e7b32e0408df186728b8bb64.exe 34 PID 2488 wrote to memory of 320 2488 feceab91f4a082684f7224426335f37340d38ff8e7b32e0408df186728b8bb64.exe 35 PID 2488 wrote to memory of 320 2488 feceab91f4a082684f7224426335f37340d38ff8e7b32e0408df186728b8bb64.exe 35 PID 2488 wrote to memory of 320 2488 feceab91f4a082684f7224426335f37340d38ff8e7b32e0408df186728b8bb64.exe 35 PID 2488 wrote to memory of 2400 2488 feceab91f4a082684f7224426335f37340d38ff8e7b32e0408df186728b8bb64.exe 36 PID 2488 wrote to memory of 2400 2488 feceab91f4a082684f7224426335f37340d38ff8e7b32e0408df186728b8bb64.exe 36 PID 2488 wrote to memory of 2400 2488 feceab91f4a082684f7224426335f37340d38ff8e7b32e0408df186728b8bb64.exe 36 PID 2488 wrote to memory of 1972 2488 feceab91f4a082684f7224426335f37340d38ff8e7b32e0408df186728b8bb64.exe 37 PID 2488 wrote to memory of 1972 2488 feceab91f4a082684f7224426335f37340d38ff8e7b32e0408df186728b8bb64.exe 37 PID 2488 wrote to memory of 1972 2488 feceab91f4a082684f7224426335f37340d38ff8e7b32e0408df186728b8bb64.exe 37 PID 2488 wrote to memory of 1400 2488 feceab91f4a082684f7224426335f37340d38ff8e7b32e0408df186728b8bb64.exe 38 PID 2488 wrote to memory of 1400 2488 feceab91f4a082684f7224426335f37340d38ff8e7b32e0408df186728b8bb64.exe 38 PID 2488 wrote to memory of 1400 2488 feceab91f4a082684f7224426335f37340d38ff8e7b32e0408df186728b8bb64.exe 38
Processes
-
C:\Users\Admin\AppData\Local\Temp\feceab91f4a082684f7224426335f37340d38ff8e7b32e0408df186728b8bb64.exe"C:\Users\Admin\AppData\Local\Temp\feceab91f4a082684f7224426335f37340d38ff8e7b32e0408df186728b8bb64.exe"1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Windows\system32\manage-bde.exemanage-bde -on C: -EncryptionMethod AES-2562⤵PID:2504
-
-
C:\Windows\system32\takeown.exetakeown /f D:\ /r /d Y2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Enumerates connected drives
PID:2060
-
-
C:\Windows\system32\icacls.exeicacls D:\ /grant Everyone:F /t /c /l2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:304
-
-
C:\Windows\system32\takeown.exetakeown /f C:\ /r /d Y2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:320
-
-
C:\Windows\system32\icacls.exeicacls C:\ /grant Everyone:F /t /c /l2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:2400
-
-
C:\Windows\system32\taskkill.exetaskkill /F /T /IM LsaIso.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1972
-
-
C:\Windows\system32\taskkill.exetaskkill /F /T /IM svchost.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1400
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵PID:1404
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵PID:2860
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵PID:1512
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵PID:1880
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵PID:1164
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵PID:988
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵PID:1712
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵PID:1748
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵PID:1736
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵PID:2296