feceab91f4a082684f7224426335f37340d38ff8e7b32e0408df186728b8bb64

Analysis

max time kernel
0s
max time network
9s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
30-11-2024 06:01

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

feceab91f4a082684f7224426335f37340d38ff8e7b32e0408df186728b8bb64.exe
Size

50KB
MD5

355c2f89e67e95ad1b458519980a47eb
SHA1

395f5de2c542f7e81b9a5b218f1bbbbbb6d6f835
SHA256

feceab91f4a082684f7224426335f37340d38ff8e7b32e0408df186728b8bb64
SHA512

c22dc9892b7dbd7a3b1c4931a42c921ee76484574951408a6a898f18d0cd911af5db9f1f79efb991ecd8b48d18c5dbd84c21f96ac6a61c9f4cf0984f09c3f234
SSDEEP

1536:985VEH2aNU2o5DX776Nc8mSsQWUYXtJW:9sE2aNU2WDX7+NEUr

Score

8^/10

bootkit discovery exploit persistence upx

Malware Config

Signatures

Possible privilege escalation attempt 4 IoCs

exploit

pid	Process
1492	takeown.exe
3872	icacls.exe
748	takeown.exe
1316	icacls.exe

Modifies file permissions 1 TTPs 4 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1316	icacls.exe
1492	takeown.exe
3872	icacls.exe
748	takeown.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	feceab91f4a082684f7224426335f37340d38ff8e7b32e0408df186728b8bb64.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3136-0-0x00007FF6015B0000-0x00007FF6015E1000-memory.dmp	upx

Kills process with taskkill 2 IoCs

evasion

pid	Process
3972	taskkill.exe
4044	taskkill.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 3136 wrote to memory of 3132	3136	feceab91f4a082684f7224426335f37340d38ff8e7b32e0408df186728b8bb64.exe	84
PID 3136 wrote to memory of 3132	3136	feceab91f4a082684f7224426335f37340d38ff8e7b32e0408df186728b8bb64.exe	84
PID 3136 wrote to memory of 748	3136	feceab91f4a082684f7224426335f37340d38ff8e7b32e0408df186728b8bb64.exe	85
PID 3136 wrote to memory of 748	3136	feceab91f4a082684f7224426335f37340d38ff8e7b32e0408df186728b8bb64.exe	85
PID 3136 wrote to memory of 3872	3136	feceab91f4a082684f7224426335f37340d38ff8e7b32e0408df186728b8bb64.exe	86
PID 3136 wrote to memory of 3872	3136	feceab91f4a082684f7224426335f37340d38ff8e7b32e0408df186728b8bb64.exe	86
PID 3136 wrote to memory of 1492	3136	feceab91f4a082684f7224426335f37340d38ff8e7b32e0408df186728b8bb64.exe	87
PID 3136 wrote to memory of 1492	3136	feceab91f4a082684f7224426335f37340d38ff8e7b32e0408df186728b8bb64.exe	87
PID 3136 wrote to memory of 1316	3136	feceab91f4a082684f7224426335f37340d38ff8e7b32e0408df186728b8bb64.exe	88
PID 3136 wrote to memory of 1316	3136	feceab91f4a082684f7224426335f37340d38ff8e7b32e0408df186728b8bb64.exe	88
PID 3136 wrote to memory of 3972	3136	feceab91f4a082684f7224426335f37340d38ff8e7b32e0408df186728b8bb64.exe	89
PID 3136 wrote to memory of 3972	3136	feceab91f4a082684f7224426335f37340d38ff8e7b32e0408df186728b8bb64.exe	89
PID 3136 wrote to memory of 4044	3136	feceab91f4a082684f7224426335f37340d38ff8e7b32e0408df186728b8bb64.exe	91
PID 3136 wrote to memory of 4044	3136	feceab91f4a082684f7224426335f37340d38ff8e7b32e0408df186728b8bb64.exe	91

C:\Users\Admin\AppData\Local\Temp\feceab91f4a082684f7224426335f37340d38ff8e7b32e0408df186728b8bb64.exe
"C:\Users\Admin\AppData\Local\Temp\feceab91f4a082684f7224426335f37340d38ff8e7b32e0408df186728b8bb64.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of WriteProcessMemory
PID:3136
- C:\Windows\SYSTEM32\manage-bde.exe
  manage-bde -on C: -EncryptionMethod AES-256
  2⤵
  PID:3132
- C:\Windows\SYSTEM32\takeown.exe
  takeown /f D:\ /r /d Y
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:748
- C:\Windows\SYSTEM32\icacls.exe
  icacls D:\ /grant Everyone:F /t /c /l
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:3872
- C:\Windows\SYSTEM32\takeown.exe
  takeown /f C:\ /r /d Y
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:1492
- C:\Windows\SYSTEM32\icacls.exe
  icacls C:\ /grant Everyone:F /t /c /l
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:1316
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /T /IM LsaIso.exe
  2⤵
  - Kills process with taskkill
  PID:3972
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /T /IM svchost.exe
  2⤵
  - Kills process with taskkill
  PID:4044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3136-0-0x00007FF6015B0000-0x00007FF6015E1000-memory.dmp

Filesize
196KB

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads