3ff5f6704d9f18875770f787439b5bbd7e4b1a28401d73da79de86a1b0ba8ecf

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
05-07-2024 12:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

123.bat
Size

971B
MD5

84da054b2dcf27a08d137148f70aaeb3
SHA1

1a47062307e9692940a446c6e34befccd7cfe682
SHA256

3ff5f6704d9f18875770f787439b5bbd7e4b1a28401d73da79de86a1b0ba8ecf
SHA512

c41ad98ecbad00a511c1684e14aecb7cbdf3d13b66b3ac9ffaacb2a1af2216f86bd61fad043eeb0e527f397e59088fd7aa3158479141217444c01042c71b0fe9

Score

8^/10

discovery exploit

Malware Config

Signatures

Possible privilege escalation attempt 2 IoCs
exploit

Processes:

takeown.exeicacls.exe

pid process

2672 takeown.exe
3092 icacls.exe
Modifies file permissions 1 TTPs 2 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

takeown.exeicacls.exe

pid process

2672 takeown.exe
3092 icacls.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

takeown.exe

description pid process

Token: SeTakeOwnershipPrivilege 2672 takeown.exe

pid	process
2672	takeown.exe
3092	icacls.exe

pid	process
2672	takeown.exe
3092	icacls.exe

description	pid	process
Token: SeTakeOwnershipPrivilege	2672	takeown.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 868 wrote to memory of 2672	868	cmd.exe	takeown.exe
PID 868 wrote to memory of 2672	868	cmd.exe	takeown.exe
PID 868 wrote to memory of 3092	868	cmd.exe	icacls.exe
PID 868 wrote to memory of 3092	868	cmd.exe	icacls.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\123.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:868

C:\Windows\system32\takeown.exe
takeown /f C:\Windows\System32 /a /r /d y
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:2672

C:\Windows\system32\icacls.exe
icacls C:\Windows\System32 /grant ╨É╨┤╨╝╨╕╨╜╨╕╤ü╤é╤Ç╨░╤é╨╛╤Ç╤ï:F /t
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:3092

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads