37bef9d9a13d0c1a15a0a3fea74ca6cacdcc0defcbf16c888f6403c8bc56a3c0

Analysis

max time kernel
149s
max time network
122s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 18:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file01.ps1
Size 12KB
Sample260701-xdjpfset4w
SHA256 37bef9d9a13d0c1a15a0a3fea74ca6cacdcc0defcbf16c888f6403c8bc56a3c0
MD5 7df01470b4d48525969a9c71fc8980e5
SHA1 3af549e795c9dfa128b6588b9f531a74e17c8a65
SHA512 f29bcc59991e8fd9dfb037e5eb2f678988fa860d923d8513f224a2118443868865d71581202aed339a27502379945e7d4e6a406a04264161b5980d8152fda901
SSDEEP 192:+vw14EXrIVa9mQ924W0050sgXTMXSD3U/I2SWcblIRjQil6UoFIdM9VlNV14BEpK:O7VsDW37S7U/IJWcblmlboFr4BEpIlr/
TLSH
T1AB52C7116F0161A685B3D739DBE76292FE2F107F92276200B49DC2D02FB052E876DF99
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution exploit ransomware

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4960	powershell.exe
2680	powershell.exe
5308	powershell.exe
2004	PowerShell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	PowerShell.exe

Possible privilege escalation attempt 20 IoCs

exploit

pid	Process
5356	takeown.exe
2568	takeown.exe
5188	takeown.exe
5560	icacls.exe
5476	takeown.exe
2616	takeown.exe
2812	icacls.exe
2020	takeown.exe
1060	icacls.exe
1372	icacls.exe
2216	takeown.exe
704	takeown.exe
4952	icacls.exe
2544	icacls.exe
4420	takeown.exe
4692	icacls.exe
780	icacls.exe
4660	icacls.exe
1480	takeown.exe
5052	icacls.exe

Modifies file permissions 1 TTPs 20 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1372	icacls.exe
780	icacls.exe
2568	takeown.exe
5476	takeown.exe
2544	icacls.exe
1480	takeown.exe
1060	icacls.exe
2216	takeown.exe
4660	icacls.exe
704	takeown.exe
4952	icacls.exe
4420	takeown.exe
5356	takeown.exe
4692	icacls.exe
2812	icacls.exe
5560	icacls.exe
5052	icacls.exe
2616	takeown.exe
2020	takeown.exe
5188	takeown.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\diskpart.exe	PowerShell.exe
File opened for modification	C:\Windows\system32\diskmgmt.msc	PowerShell.exe
File opened for modification	C:\Windows\system32\cleanmgr.exe	PowerShell.exe
File opened for modification	C:\Windows\system32\defrag.exe	PowerShell.exe
File opened for modification	C:\Windows\system32\cipher.exe	PowerShell.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_o5tpprzp.xci.psm1	powershell.exe
File created	C:\Windows\SystemTemp\eyf4fjj0\eyf4fjj0.tmp	powershell.exe
File created	C:\Windows\SystemTemp\eyf4fjj0\eyf4fjj0.0.cs	powershell.exe
File created	C:\Windows\SystemTemp\eyf4fjj0\eyf4fjj0.dll	powershell.exe
File created	C:\Windows\SystemTemp\eyf4fjj0\eyf4fjj0.cmdline	powershell.exe
File created	C:\Windows\SystemTemp\eyf4fjj0\eyf4fjj0.out	powershell.exe
File created	C:\Windows\SystemTemp\eyf4fjj0\eyf4fjj0.err	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_s0tm2sdh.djv.ps1	powershell.exe

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
5056	vssadmin.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2004	PowerShell.exe
2004	PowerShell.exe
2680	powershell.exe
4960	powershell.exe
2680	powershell.exe
4960	powershell.exe
2004	PowerShell.exe
2004	PowerShell.exe
2004	PowerShell.exe
2004	PowerShell.exe
2004	PowerShell.exe
2004	PowerShell.exe
2004	PowerShell.exe
2004	PowerShell.exe
2004	PowerShell.exe
2004	PowerShell.exe
2004	PowerShell.exe
2004	PowerShell.exe
2004	PowerShell.exe
2004	PowerShell.exe
2004	PowerShell.exe
2004	PowerShell.exe
2004	PowerShell.exe
2004	PowerShell.exe
2004	PowerShell.exe
2004	PowerShell.exe
2004	PowerShell.exe
2004	PowerShell.exe
2004	PowerShell.exe
2004	PowerShell.exe
2004	PowerShell.exe
2004	PowerShell.exe
2004	PowerShell.exe
2004	PowerShell.exe
2004	PowerShell.exe
2004	PowerShell.exe
2004	PowerShell.exe
2004	PowerShell.exe
2004	PowerShell.exe
2004	PowerShell.exe
2004	PowerShell.exe
2004	PowerShell.exe
2004	PowerShell.exe
2004	PowerShell.exe
2004	PowerShell.exe
2004	PowerShell.exe
2004	PowerShell.exe
2004	PowerShell.exe
2004	PowerShell.exe
2004	PowerShell.exe
2004	PowerShell.exe
2004	PowerShell.exe
2004	PowerShell.exe
2004	PowerShell.exe
2004	PowerShell.exe
2004	PowerShell.exe
2004	PowerShell.exe
2004	PowerShell.exe
2004	PowerShell.exe
2004	PowerShell.exe
2004	PowerShell.exe
2004	PowerShell.exe
2004	PowerShell.exe
2004	PowerShell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2004	PowerShell.exe
Token: SeTakeOwnershipPrivilege	2004	PowerShell.exe
Token: SeBackupPrivilege	2004	PowerShell.exe
Token: SeRestorePrivilege	2004	PowerShell.exe
Token: SeSecurityPrivilege	2004	PowerShell.exe
Token: SeIncreaseQuotaPrivilege	2004	PowerShell.exe
Token: SeSecurityPrivilege	2004	PowerShell.exe
Token: SeTakeOwnershipPrivilege	2004	PowerShell.exe
Token: SeLoadDriverPrivilege	2004	PowerShell.exe
Token: SeSystemProfilePrivilege	2004	PowerShell.exe
Token: SeSystemtimePrivilege	2004	PowerShell.exe
Token: SeProfSingleProcessPrivilege	2004	PowerShell.exe
Token: SeIncBasePriorityPrivilege	2004	PowerShell.exe
Token: SeCreatePagefilePrivilege	2004	PowerShell.exe
Token: SeBackupPrivilege	2004	PowerShell.exe
Token: SeRestorePrivilege	2004	PowerShell.exe
Token: SeShutdownPrivilege	2004	PowerShell.exe
Token: SeDebugPrivilege	2004	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	2004	PowerShell.exe
Token: SeRemoteShutdownPrivilege	2004	PowerShell.exe
Token: SeUndockPrivilege	2004	PowerShell.exe
Token: SeManageVolumePrivilege	2004	PowerShell.exe
Token: 33	2004	PowerShell.exe
Token: 34	2004	PowerShell.exe
Token: 35	2004	PowerShell.exe
Token: 36	2004	PowerShell.exe
Token: SeIncreaseQuotaPrivilege	2004	PowerShell.exe
Token: SeSecurityPrivilege	2004	PowerShell.exe
Token: SeTakeOwnershipPrivilege	2004	PowerShell.exe
Token: SeLoadDriverPrivilege	2004	PowerShell.exe
Token: SeSystemProfilePrivilege	2004	PowerShell.exe
Token: SeSystemtimePrivilege	2004	PowerShell.exe
Token: SeProfSingleProcessPrivilege	2004	PowerShell.exe
Token: SeIncBasePriorityPrivilege	2004	PowerShell.exe
Token: SeCreatePagefilePrivilege	2004	PowerShell.exe
Token: SeBackupPrivilege	2004	PowerShell.exe
Token: SeRestorePrivilege	2004	PowerShell.exe
Token: SeShutdownPrivilege	2004	PowerShell.exe
Token: SeDebugPrivilege	2004	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	2004	PowerShell.exe
Token: SeRemoteShutdownPrivilege	2004	PowerShell.exe
Token: SeUndockPrivilege	2004	PowerShell.exe
Token: SeManageVolumePrivilege	2004	PowerShell.exe
Token: 33	2004	PowerShell.exe
Token: 34	2004	PowerShell.exe
Token: 35	2004	PowerShell.exe
Token: 36	2004	PowerShell.exe
Token: SeIncreaseQuotaPrivilege	2004	PowerShell.exe
Token: SeSecurityPrivilege	2004	PowerShell.exe
Token: SeTakeOwnershipPrivilege	2004	PowerShell.exe
Token: SeLoadDriverPrivilege	2004	PowerShell.exe
Token: SeSystemProfilePrivilege	2004	PowerShell.exe
Token: SeSystemtimePrivilege	2004	PowerShell.exe
Token: SeProfSingleProcessPrivilege	2004	PowerShell.exe
Token: SeIncBasePriorityPrivilege	2004	PowerShell.exe
Token: SeCreatePagefilePrivilege	2004	PowerShell.exe
Token: SeBackupPrivilege	2004	PowerShell.exe
Token: SeRestorePrivilege	2004	PowerShell.exe
Token: SeShutdownPrivilege	2004	PowerShell.exe
Token: SeDebugPrivilege	2004	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	2004	PowerShell.exe
Token: SeRemoteShutdownPrivilege	2004	PowerShell.exe
Token: SeUndockPrivilege	2004	PowerShell.exe
Token: SeManageVolumePrivilege	2004	PowerShell.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 976	2004	PowerShell.exe	89
PID 976 wrote to memory of 4464	976	csc.exe	90
PID 2004 wrote to memory of 5476	2004	PowerShell.exe	91
PID 2004 wrote to memory of 2544	2004	PowerShell.exe	92
PID 2004 wrote to memory of 1480	2004	PowerShell.exe	93
PID 2004 wrote to memory of 1060	2004	PowerShell.exe	94
PID 2004 wrote to memory of 4420	2004	PowerShell.exe	95
PID 2004 wrote to memory of 5052	2004	PowerShell.exe	96
PID 2004 wrote to memory of 5356	2004	PowerShell.exe	97
PID 2004 wrote to memory of 4692	2004	PowerShell.exe	98
PID 2004 wrote to memory of 2616	2004	PowerShell.exe	99
PID 2004 wrote to memory of 1372	2004	PowerShell.exe	100
PID 2004 wrote to memory of 5056	2004	PowerShell.exe	103
PID 2004 wrote to memory of 4960	2004	PowerShell.exe	104
PID 2004 wrote to memory of 2680	2004	PowerShell.exe	106
PID 5308 wrote to memory of 5520	5308	powershell.exe	110

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\file01.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in Drivers directory
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\gd0s5amg\gd0s5amg.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:976
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1786.tmp" "c:\Users\Admin\AppData\Local\Temp\gd0s5amg\CSCA3B840036D3740AA9D5FE08D37E64DD7.TMP"
    3⤵
    PID:4464
- C:\Windows\system32\takeown.exe
  "C:\Windows\system32\takeown.exe" /F C:\Windows\system32\diskpart.exe /A
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:5476
- C:\Windows\system32\icacls.exe
  "C:\Windows\system32\icacls.exe" C:\Windows\system32\diskpart.exe /grant Administrators:F /t
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:2544
- C:\Windows\system32\takeown.exe
  "C:\Windows\system32\takeown.exe" /F C:\Windows\system32\diskmgmt.msc /A
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:1480
- C:\Windows\system32\icacls.exe
  "C:\Windows\system32\icacls.exe" C:\Windows\system32\diskmgmt.msc /grant Administrators:F /t
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:1060
- C:\Windows\system32\takeown.exe
  "C:\Windows\system32\takeown.exe" /F C:\Windows\system32\cleanmgr.exe /A
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:4420
- C:\Windows\system32\icacls.exe
  "C:\Windows\system32\icacls.exe" C:\Windows\system32\cleanmgr.exe /grant Administrators:F /t
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:5052
- C:\Windows\system32\takeown.exe
  "C:\Windows\system32\takeown.exe" /F C:\Windows\system32\defrag.exe /A
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:5356
- C:\Windows\system32\icacls.exe
  "C:\Windows\system32\icacls.exe" C:\Windows\system32\defrag.exe /grant Administrators:F /t
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:4692
- C:\Windows\system32\takeown.exe
  "C:\Windows\system32\takeown.exe" /F C:\Windows\system32\cipher.exe /A
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:2616
- C:\Windows\system32\icacls.exe
  "C:\Windows\system32\icacls.exe" C:\Windows\system32\cipher.exe /grant Administrators:F /t
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:1372
- C:\Windows\system32\vssadmin.exe
  "C:\Windows\system32\vssadmin.exe" add shadowstorage /for=C: /on=C: /maxsize=10%
  2⤵
  - Interacts with shadow copies
  PID:5056
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -Command "while ($true) { # For each logical disk, set EnableQuota and read-only attributes Get-WmiObject -Class Win32_LogicalDisk -ErrorAction SilentlyContinue | ForEach-Object { # Prevent formatting via WMI by setting VolumeDirty or other flags? Not directly. # Instead, we can dismount and remount? Not effective. # We'll use diskpart script to set readonly attribute on each volume. $drive = $_.DeviceID -replace ":" , "" if ($drive -match "^[CDEFGHIJKLMNOPQRSTUVWXYZ]$") { $script = "select volume $drive`nattributes volume set readonly`n`nexit" $script | diskpart.exe 2>$null } } Start-Sleep -Seconds 60 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4960
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -Command "$vmExtensions = @("*.vhd","*.vhdx","*.vmdk","*.vmx","*.vmsd","*.nvram","*.vmem") $monitorDirs = @() $drives = Get-PSDrive -PSProvider FileSystem | Where-Object { $_.Used -gt 0 } foreach ($drive in $drives) { $root = $drive.Root if ($root -match "^[CD]:\\") { $monitorDirs += Get-ChildItem -Path $root -Recurse -Directory -ErrorAction SilentlyContinue | Where-Object { (Get-ChildItem $_.FullName -Include $vmExtensions -File -ErrorAction SilentlyContinue).Count -gt 0 } | ForEach-Object { $_.FullName } } } $monitorDirs = $monitorDirs | Select-Object -Unique # Use a file system watcher for each directory $watchers = @() foreach ($dir in $monitorDirs) { if (-not (Test-Path $dir)) { continue } $watcher = New-Object System.IO.FileSystemWatcher $watcher.Path = $dir $watcher.IncludeSubdirectories = $true $watcher.EnableRaisingEvents = $true $watcher.Filter = "*.*" $action = { $path = $Event.SourceEventArgs.FullPath $changeType = $Event.SourceEventArgs.ChangeType if ($changeType -in @('Deleted','Changed')) { $ext = [System.IO.Path]::GetExtension($path) if ($ext -in @('.vhd','.vhdx','.vmdk','.vmx','.vmsd','.nvram','.vmem')) { # Restore from latest shadow copy $shadow = (vssadmin list shadows /for=C: | Select-String "Shadow Copy Volume:") -replace ".*Volume: " , "" if ($shadow) { $shadowDrive = $shadow[0] $origPath = $path -replace "^[A-Z]:", $shadowDrive if (Test-Path $origPath) { Copy-Item -Path $origPath -Destination $path -Force -ErrorAction SilentlyContinue # Reapply permissions icacls $path /deny "Everyone:(D)" 2>$null icacls $path /deny "BUILTIN\Users:(D)" 2>$null Set-ItemProperty -Path $path -Name IsReadOnly -Value $true -Force -ErrorAction SilentlyContinue } } } } } Register-ObjectEvent $watcher "Deleted" -Action $action -SupportEvent Register-ObjectEvent $watcher "Changed" -Action $action -SupportEvent $watchers += $watcher } # Keep script running while ($true) { Start-Sleep -Seconds 3600 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2680

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\Windows\Temp\vm_keeper.ps1"
1⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:5308
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Windows\SystemTemp\eyf4fjj0\eyf4fjj0.cmdline"
  2⤵
  PID:5520
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Windows\SystemTemp\RES5957.tmp" "c:\Windows\SystemTemp\eyf4fjj0\CSC84353F8E28F4816B5D62ED7ACD06229.TMP"
    3⤵
    PID:5524
- C:\Windows\system32\takeown.exe
  "C:\Windows\system32\takeown.exe" /F C:\Windows\system32\diskpart.exe /A
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:2216
- C:\Windows\system32\icacls.exe
  "C:\Windows\system32\icacls.exe" C:\Windows\system32\diskpart.exe /grant Administrators:F /t
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:780
- C:\Windows\system32\takeown.exe
  "C:\Windows\system32\takeown.exe" /F C:\Windows\system32\diskmgmt.msc /A
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:2568
- C:\Windows\system32\icacls.exe
  "C:\Windows\system32\icacls.exe" C:\Windows\system32\diskmgmt.msc /grant Administrators:F /t
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:2812
- C:\Windows\system32\takeown.exe
  "C:\Windows\system32\takeown.exe" /F C:\Windows\system32\cleanmgr.exe /A
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:2020
- C:\Windows\system32\icacls.exe
  "C:\Windows\system32\icacls.exe" C:\Windows\system32\cleanmgr.exe /grant Administrators:F /t
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:4660
- C:\Windows\system32\takeown.exe
  "C:\Windows\system32\takeown.exe" /F C:\Windows\system32\defrag.exe /A
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:704
- C:\Windows\system32\icacls.exe
  "C:\Windows\system32\icacls.exe" C:\Windows\system32\defrag.exe /grant Administrators:F /t
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:4952
- C:\Windows\system32\takeown.exe
  "C:\Windows\system32\takeown.exe" /F C:\Windows\system32\cipher.exe /A
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:5188
- C:\Windows\system32\icacls.exe
  "C:\Windows\system32\icacls.exe" C:\Windows\system32\cipher.exe /grant Administrators:F /t
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:5560

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

File and Directory Permissions Modification

T1222

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 952B
SHA256 59f0f405bee9a6626b6a2be82093cc1e5018c8fbe112815838bedc8f81958062
MD5 4feff595990b6df89d0ab2ca94d330c6
SHA1 574ec5a6d5eb0bc7ac0ac4d086aa59f66210dd13
SHA512 3037859bb1b76b7f176778e67d00a9a34cc2d217f85b53cd816b9873dfcc01efb1e677b08cd19c4fda4f5f7a2c8a0e960333f4c8643a55dcbbbaba708b69362d
TLSH
T128116633F3CC8224CC9A403650CEA91537B68BCB40DECE6B7B84D154B86F589DF60260
MD5 SHA1 SHA512 TLSH

Submit Download

RES1786.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES1786.tmp
Size 1KB
SHA256 104aaeacf4e2283917bdcd1bb238b35a4455164e30afbbf407d6c4fb48a223ff
MD5 68fa4b6cef92eabfe4f13e9e6e81b661
SHA1 baae4c5c18a0ae05e598d6b2cb9bea99c1e05d49
SHA512 ac9e07009abfc339304e2351e2ed3c3c0802f8c4607aeb0e313c7c1c1e4a0219bbf103f6d02c7e9f3a2d89c207db505375c72499820bd61e6436d516fc997d72
TLSH
T13D218C05A3EC471FF0735732A9FA172F9174FD64EFA2979B954012282C11204EEE0B72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_eghnkmy5.lnd.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_eghnkmy5.lnd.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

gd0s5amg.dll

Path C:\Users\Admin\AppData\Local\Temp\gd0s5amg\gd0s5amg.dll
Size 4KB
SHA256 503826198b902577216cbd43f1ecbc48eff1b37fd0b286b28a8574dc6dc52e6f
MD5 46bc6e6dde53f1d7991312ca4a082b55
SHA1 ce0573297ce42e5df683f26f3714d91f3f3350ba
SHA512 5f9011fc0d4517a96c9c9de1ccb30dc8198d5eb8ae1f381f19083c7695aa8d5c5a7048b4449367f35b366c6c8e71ca6f8d70c41c99b32c126893604072b7a32e
TLSH
T17F817107ABEC4A66E4B707B8AEF3171217B4F8148F73976F148181692CE52501E36B66
MD5 SHA1 SHA512 TLSH

Submit Download

cipher.exe

Path C:\Windows\System32\cipher.exe
Size 114B
SHA256 92e56d0f9449fdbc7073fbe9d8ecb2592e23d78c257bc05d7e1d337443de60a3
MD5 50a38aa06c706c5a629139ed11093814
SHA1 9387a12799d6d4b8d4cf8fd1b262cc53a7fdd0dd
SHA512 a2da6763ee4466a7b95a689f08e22ba9287b7ecc54cd811826e98403ba579cc724fee96bc3598e7d4416f370529fd8eb379a565dcedd9e324748652b41f182f7
TLSH
T1DBB09B0552201E5956679D1541D65221195D324517104E52362141217844556C5DD6C5
MD5 SHA1 SHA512 TLSH

Submit Download

RES5957.tmp

Path C:\Windows\SystemTemp\RES5957.tmp
Size 1KB
SHA256 cfa5cf6ae90aaa01157cfd1edba9a04cbf32babf460f7780068fd4029c4bed82
MD5 d6687404e57541fa5fa25ad79c8d891d
SHA1 de474d5557f887a773f2e7f282375cf45491852a
SHA512 7b259d8f2c1cce7ffc8e1ec358452fa372425493d834489786457af9446e7cdaf19e5289df75d736731878e74dc0a818d2a09ffea156b116ca5b71e2f158a614
TLSH
T1F6217F4563F8471BF073473068F7472B6628FD61DA7193AA548402652C50544DEB1AB1
MD5 SHA1 SHA512 TLSH

Submit Download

eyf4fjj0.dll

Path C:\Windows\SystemTemp\eyf4fjj0\eyf4fjj0.dll
Size 4KB
SHA256 1e9549c3ac21149503c3236e1dfc624c0c27e5764805b376c5551b33fccc6a8b
MD5 1b7cc7e05c8b7e39fc2d8d695a53aefb
SHA1 a3175df2cd9f1c969be06886e5d177ce765ed438
SHA512 788bfffe6f2a7559f692d699009d48097fc88a3e433e6535161626798a3569a7fbc92ed477d4f86bd2eb848b4e4890a70c00d294a7111137860e7e7eb33f9232
TLSH
T1B7817107A7EC0A23E4FB0774AEF3075217B4F8648F73976F284181292CE56400E62B62
MD5 SHA1 SHA512 TLSH

Submit Download

CSCA3B840036D3740AA9D5FE08D37E64DD7.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\gd0s5amg\CSCA3B840036D3740AA9D5FE08D37E64DD7.TMP
Size 652B
SHA256 ac181496491f74ce888151c7234ac8789cc683b69d52bb2930d6ddd7544d665a
MD5 d0b2456562fb3413be2a469b70b6f8ce
SHA1 21233de8d3a65e5c6111d67bc1f32ddc5d9646ed
SHA512 ba8d11c804a457e9e9f14b2d2f3d07ee4b35cc7283ecfd0ccb374d12e1e264779d98698e991d7017607fe4920fdedfbcb4347a35852c8c4a704fbc7dc1c532f4
TLSH
T1F5F03A09A3F8020EF0F75B31B9F6436391A8FC64DE3293ED144013292C74620D962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

gd0s5amg.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\gd0s5amg\gd0s5amg.0.cs
Size 1KB
SHA256 26054a652faede9cd2916d5f49eadee995cf32be751d45fd7259872d03c1b28a
MD5 8367589081c0c1c1292537dd700d2bfe
SHA1 9ce6d5f6bca1b08e3ae607115de9cd856a4a73e6
SHA512 2256068acc0a617ac87e89e6825a6856568e4538be295a5dd3dd8e07344ccd022699cd8d4e3f4ca2a80aa65f9378f88ae1432cd63127ee97bdf2565a9171b118
TLSH
T1AE31105B936D02614C726394AED8B487ED23002A15FF6921F5DE43A14FA7223DB36E08
MD5 SHA1 SHA512 TLSH

Submit Download

gd0s5amg.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\gd0s5amg\gd0s5amg.cmdline
Size 369B
SHA256 39d0247812a340697cfb21595f8fdad094063dbfea47ae9789f9b34355bae93a
MD5 05575902680c0bd005bfdc74f8107cb1
SHA1 7cfaf42def50e6664fa879fc6b46892593b39f05
SHA512 0cc9ddbab1d5980eea545c907048c685659fadf071b1ec1b5b957a11fcee15fa3c66cfae29586657d67487d57d1bb5f1dff6668e04d53b87b40aa1d4dba30cc2
TLSH
T117E0682FA256C6FD81D9208F2169D4BCCA720A432BC07F845044441DD0270012BE1741
MD5 SHA1 SHA512 TLSH

Submit Download

CSC84353F8E28F4816B5D62ED7ACD06229.TMP

Path \??\c:\Windows\SystemTemp\eyf4fjj0\CSC84353F8E28F4816B5D62ED7ACD06229.TMP
Size 652B
SHA256 3992b4ebe2d061e5a42cdf5fd4599a49f740d7398d2684c8cb2d3e32841ff1ca
MD5 49f0fedc80d37b6a1b85e2d2da3eb935
SHA1 97325300dfb7bbee8e69ee521300c32e04fb416e
SHA512 dd4cd9f97b9f378bafc0e07ef0e971f0ef7a50e055bbb961cc8b017a972b7e8e8e8e8fb533c81c5fc2cbc8fe2b3d66a40b49fb8c5c60ce465ed9ba74a7008a9e
TLSH
T128F05E0963F8030EF4F74B30BDF6436395A8BC64DE32A3ED28400319286451089A2FB2
MD5 SHA1 SHA512 TLSH

Submit Download

eyf4fjj0.cmdline

Path \??\c:\Windows\SystemTemp\eyf4fjj0\eyf4fjj0.cmdline
Size 345B
SHA256 03ecc553eb768d24638fb8a73b054bb69c665450e9701352e987c98710af059c
MD5 40843cf51d1edf873453e0e381e2a449
SHA1 68c5eaff0108f4708bc4018d6bceeda3dd0ccec2
SHA512 b498b0b7e87975aca6e089d444befaf707497677a853000a30221a70e1e4708c15c6f0d69c9de5a5aaf6601deecdefbdcd7c35035df52482181ce68e8c05d48c
TLSH
T185E026BA6229C4BDA9E99907313EC6FCE73353C32041AEA850C50059E06F4870BA27A8
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2004-35-0x00000193711D0000-0x00000193711EE000-memory.dmp

Download

memory/2004-43-0x00007FFE58870000-0x00007FFE59214000-memory.dmp

Download

memory/2004-23-0x00007FFE58870000-0x00007FFE59214000-memory.dmp

Download

memory/2004-24-0x00007FFE58870000-0x00007FFE59214000-memory.dmp

Download

memory/2004-25-0x00007FFE58870000-0x00007FFE59214000-memory.dmp

Download

memory/2004-26-0x00007FFE58870000-0x00007FFE59214000-memory.dmp

Download

memory/2004-27-0x00007FFE58870000-0x00007FFE59214000-memory.dmp

Download

memory/2004-9-0x00007FFE58870000-0x00007FFE59214000-memory.dmp

Download

memory/2004-0-0x00007FFE589FF000-0x00007FFE58A00000-memory.dmp

Download

memory/2004-36-0x00000193711F0000-0x00000193712A2000-memory.dmp

Download

memory/2004-37-0x00000193710B0000-0x00000193710BA000-memory.dmp

Download

memory/2004-38-0x0000019371430000-0x000001937145A000-memory.dmp

Download

memory/2004-39-0x0000019371430000-0x0000019371454000-memory.dmp

Download

memory/2004-41-0x00007FFE58870000-0x00007FFE59214000-memory.dmp

Download

memory/2004-42-0x00007FFE58870000-0x00007FFE59214000-memory.dmp

Download

memory/2004-22-0x0000019370960000-0x0000019370968000-memory.dmp

Download

memory/2004-44-0x00007FFE58870000-0x00007FFE59214000-memory.dmp

Download

memory/2004-45-0x00007FFE58870000-0x00007FFE59214000-memory.dmp

Download

memory/2004-46-0x00007FFE58870000-0x00007FFE59214000-memory.dmp

Download

memory/2004-47-0x00007FFE58870000-0x00007FFE59214000-memory.dmp

Download

memory/2004-48-0x00007FFE58870000-0x00007FFE59214000-memory.dmp

Download

memory/2004-8-0x00007FFE58870000-0x00007FFE59214000-memory.dmp

Download

memory/2004-51-0x0000019372490000-0x00000193724AE000-memory.dmp

Download

memory/2004-7-0x00007FFE58870000-0x00007FFE59214000-memory.dmp

Download

memory/2004-6-0x00007FFE58870000-0x00007FFE59214000-memory.dmp

Download

memory/2004-5-0x00007FFE58870000-0x00007FFE59214000-memory.dmp

Download

memory/2004-4-0x0000019370990000-0x00000193709B2000-memory.dmp

Download

memory/2004-1-0x00007FFE58870000-0x00007FFE59214000-memory.dmp

Download

memory/5308-76-0x000002735C6F0000-0x000002735C6F8000-memory.dmp

Download