f53c93443e54149f5d1c6be5721b8472b4799d50e9d09bb11e93cc253ab0dc99

General

Target
bluewingemulator.exe
Size 2.1MB
Sample260601-wkbrract2s
SHA256 f53c93443e54149f5d1c6be5721b8472b4799d50e9d09bb11e93cc253ab0dc99
MD5 8b8961b070ba86dcff1e759232de812b
SHA1 015892ae8ba5dba46da802dcbc301aaf82cf4123
SHA512 b7c9083d4bcf0bcc466cfcd9afb45ef7411ab1394656d399bec1c06b1bc657ba773d1290dd4a7560b218ec74dca0543f5503c2a48533e3e4b24df32aeb397374
SSDEEP 49152:K++D0oSKLTmmK9lODbLcXS8Waaq59TxcrrlTl/u6iT:R+kAvi
TLSH
T179A59E0566E803F9E277D1B9C9621607E6B2B8450770AADF03E05E9A1F377A05B3F712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution exploit persistence

Malware Config

Signatures

Possible privilege escalation attempt 12 IoCs

exploit

pid	Process
3648	takeown.exe
380	takeown.exe
2116	icacls.exe
1300	icacls.exe
4672	icacls.exe
2856	icacls.exe
3636	takeown.exe
4860	icacls.exe
3720	takeown.exe
2968	takeown.exe
2656	takeown.exe
868	icacls.exe

Modifies file permissions 1 TTPs 12 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3720	takeown.exe
2968	takeown.exe
4672	icacls.exe
868	icacls.exe
3648	takeown.exe
3636	takeown.exe
4860	icacls.exe
1300	icacls.exe
2656	takeown.exe
2856	icacls.exe
380	takeown.exe
2116	icacls.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Riot Vanguard\vanguard.yaml	bluewingemulator.exe
File created	C:\Program Files\Riot Vanguard\vanguard.yaml	bluewingemulator.exe
File opened for modification	C:\Program Files\Riot Vanguard\vanguard.yaml	bluewingemulator.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4392	schtasks.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1028 wrote to memory of 3720	1028	bluewingemulator.exe	80
PID 1028 wrote to memory of 1300	1028	bluewingemulator.exe	82
PID 1028 wrote to memory of 3844	1028	bluewingemulator.exe	84
PID 1028 wrote to memory of 4424	1028	bluewingemulator.exe	86
PID 1028 wrote to memory of 4392	1028	bluewingemulator.exe	88
PID 1028 wrote to memory of 2968	1028	bluewingemulator.exe	91
PID 1028 wrote to memory of 4672	1028	bluewingemulator.exe	95
PID 1028 wrote to memory of 2656	1028	bluewingemulator.exe	97
PID 1028 wrote to memory of 868	1028	bluewingemulator.exe	100
PID 2724 wrote to memory of 3648	2724	bluewingemulator.exe	104
PID 2724 wrote to memory of 2856	2724	bluewingemulator.exe	106
PID 2724 wrote to memory of 3132	2724	bluewingemulator.exe	108
PID 2724 wrote to memory of 380	2724	bluewingemulator.exe	111
PID 2724 wrote to memory of 3636	2724	bluewingemulator.exe	115
PID 2724 wrote to memory of 4860	2724	bluewingemulator.exe	118
PID 2724 wrote to memory of 2116	2724	bluewingemulator.exe	117

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\bluewingemulator.exe
"C:\Users\Admin\AppData\Local\Temp\bluewingemulator.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1028
- C:\Windows\SYSTEM32\takeown.exe
  takeown /f "C:\Program Files\Riot Vanguard\vanguard.yaml" /a >nul 2>&1
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:3720
- C:\Windows\SYSTEM32\icacls.exe
  icacls "C:\Program Files\Riot Vanguard\vanguard.yaml" /grant Administrators:F /t /c /q >nul 2>&1
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:1300
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /query /tn "VgcYamlGuard"
  2⤵
  PID:3844
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /delete /tn "VgcYamlGuard" /f
  2⤵
  PID:4424
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /create /tn "VgcYamlGuard" /tr "\"C:\Users\Admin\AppData\Local\Temp\bluewingemulator.exe\" --patch-yaml" /sc onstart /ru SYSTEM /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4392
- C:\Windows\SYSTEM32\takeown.exe
  takeown /f "C:\Program Files\Riot Vanguard\vanguard.yaml" /a >nul 2>&1
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:2968
- C:\Windows\SYSTEM32\icacls.exe
  icacls "C:\Program Files\Riot Vanguard\vanguard.yaml" /grant Administrators:F /t /c /q >nul 2>&1
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:4672
- C:\Windows\SYSTEM32\takeown.exe
  takeown /f "C:\Program Files\Riot Vanguard\vanguard.yaml" /a >nul 2>&1
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:2656
- C:\Windows\SYSTEM32\icacls.exe
  icacls "C:\Program Files\Riot Vanguard\vanguard.yaml" /grant Administrators:F /t /c /q >nul 2>&1
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:868

C:\Users\Admin\AppData\Local\Temp\bluewingemulator.exe
"C:\Users\Admin\AppData\Local\Temp\bluewingemulator.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2724
- C:\Windows\system32\takeown.exe
  takeown /f "C:\Program Files\Riot Vanguard\vanguard.yaml" /a >nul 2>&1
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:3648
- C:\Windows\system32\icacls.exe
  icacls "C:\Program Files\Riot Vanguard\vanguard.yaml" /grant Administrators:F /t /c /q >nul 2>&1
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:2856
- C:\Windows\system32\schtasks.exe
  schtasks /query /tn "VgcYamlGuard"
  2⤵
  PID:3132
- C:\Windows\system32\takeown.exe
  takeown /f "C:\Program Files\Riot Vanguard\vanguard.yaml" /a >nul 2>&1
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:380
- C:\Windows\system32\takeown.exe
  takeown /f "C:\Program Files\Riot Vanguard\vanguard.yaml" /a >nul 2>&1
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:3636
- C:\Windows\system32\icacls.exe
  icacls "C:\Program Files\Riot Vanguard\vanguard.yaml" /grant Administrators:F /t /c /q >nul 2>&1
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:2116
- C:\Windows\system32\icacls.exe
  icacls "C:\Program Files\Riot Vanguard\vanguard.yaml" /grant Administrators:F /t /c /q >nul 2>&1
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:4860

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

File and Directory Permissions Modification

1

T1222

Credential Access

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

vanguard.yaml

Path C:\Program Files\Riot Vanguard\vanguard.yaml
Size 173B
SHA256 6a0379629c24895bcc96211c084ce2d466c639faad5065022f503c77807b8c1f
MD5 256b6418cc6eed39cd9170b0d40c2f70
SHA1 47d5a7a48cebe6faf5afc34c945884ed17ac5fd5
SHA512 5a310b05e24b2ad69bece050aafde71791975d36cc4b2fd16da251ed6c55dae18fc1dd1a0c932dcaebd88676d3ea1e383d86052b2b813cd88a8c9e93407f933c
TLSH
T189C08050DDE0D46C34DFB27593027F0D051059591A39047FD15753F89899CB157158F3
MD5 SHA1 SHA512 TLSH

Submit Download

vgc_debug.log

Path C:\vgc_debug.log
Size 191B
SHA256 a48bb6c83d9c1bb910bf00c224c3d5a9e4c4e934bfe0dee4ea00bed83e4ef600
MD5 6015e9d4bf062733004cc329d1bec4c7
SHA1 ea53658784d5cb5b564fbbe01830698cdda7edba
SHA512 f8d7bb3502f5e4faeaa44be6dfdc1fa197a0ba726ccc2dae8409e74a372932616240a560bf5a1adaf512f5c3e56a6494230b699079e23a6aa65d1e349989f2c7
TLSH
T16AC01297721220047943E063DA4DF7E008017A075D5421ACF1ABFECC5106700DFC9930
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads