Analysis
-
max time kernel
67s -
max time network
43s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
03-06-2022 05:41
Static task
static1
Behavioral task
behavioral1
Sample
sample.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
sample.exe
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
sample.exe
-
Size
232KB
-
MD5
cebcd8313ba1ac74b30bc1c81a3a3a8f
-
SHA1
529a5e8f55a418db2ea054dc17bd63eaf6603b99
-
SHA256
1fd2d0c7d504be306ecaaf6e852142ca053950c386e3fd6ee8a1f2138ed89312
-
SHA512
6a9b3d4be974fcaa987f264db24d547254175b55b0df7767aacbae1890344b412a22819b2aab7da1e9f6aefaf665a2c32b6495d1872e4b67a83b30416701d3c3
Score
7/10
Malware Config
Signatures
-
Modifies file permissions 1 TTPs 14 IoCs
Processes:
takeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exepid process 584 takeown.exe 1760 takeown.exe 588 takeown.exe 1992 takeown.exe 1472 takeown.exe 1128 takeown.exe 776 takeown.exe 1564 takeown.exe 1504 takeown.exe 1860 takeown.exe 1572 takeown.exe 1596 takeown.exe 1368 takeown.exe 1348 takeown.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
sample.exedescription pid process Token: SeDebugPrivilege 2036 sample.exe -
Suspicious use of WriteProcessMemory 42 IoCs
Processes:
sample.exedescription pid process target process PID 2036 wrote to memory of 1572 2036 sample.exe takeown.exe PID 2036 wrote to memory of 1572 2036 sample.exe takeown.exe PID 2036 wrote to memory of 1572 2036 sample.exe takeown.exe PID 2036 wrote to memory of 588 2036 sample.exe takeown.exe PID 2036 wrote to memory of 588 2036 sample.exe takeown.exe PID 2036 wrote to memory of 588 2036 sample.exe takeown.exe PID 2036 wrote to memory of 1596 2036 sample.exe takeown.exe PID 2036 wrote to memory of 1596 2036 sample.exe takeown.exe PID 2036 wrote to memory of 1596 2036 sample.exe takeown.exe PID 2036 wrote to memory of 1368 2036 sample.exe takeown.exe PID 2036 wrote to memory of 1368 2036 sample.exe takeown.exe PID 2036 wrote to memory of 1368 2036 sample.exe takeown.exe PID 2036 wrote to memory of 1348 2036 sample.exe takeown.exe PID 2036 wrote to memory of 1348 2036 sample.exe takeown.exe PID 2036 wrote to memory of 1348 2036 sample.exe takeown.exe PID 2036 wrote to memory of 776 2036 sample.exe takeown.exe PID 2036 wrote to memory of 776 2036 sample.exe takeown.exe PID 2036 wrote to memory of 776 2036 sample.exe takeown.exe PID 2036 wrote to memory of 1564 2036 sample.exe takeown.exe PID 2036 wrote to memory of 1564 2036 sample.exe takeown.exe PID 2036 wrote to memory of 1564 2036 sample.exe takeown.exe PID 2036 wrote to memory of 1992 2036 sample.exe takeown.exe PID 2036 wrote to memory of 1992 2036 sample.exe takeown.exe PID 2036 wrote to memory of 1992 2036 sample.exe takeown.exe PID 2036 wrote to memory of 1472 2036 sample.exe takeown.exe PID 2036 wrote to memory of 1472 2036 sample.exe takeown.exe PID 2036 wrote to memory of 1472 2036 sample.exe takeown.exe PID 2036 wrote to memory of 1128 2036 sample.exe takeown.exe PID 2036 wrote to memory of 1128 2036 sample.exe takeown.exe PID 2036 wrote to memory of 1128 2036 sample.exe takeown.exe PID 2036 wrote to memory of 1504 2036 sample.exe takeown.exe PID 2036 wrote to memory of 1504 2036 sample.exe takeown.exe PID 2036 wrote to memory of 1504 2036 sample.exe takeown.exe PID 2036 wrote to memory of 1860 2036 sample.exe takeown.exe PID 2036 wrote to memory of 1860 2036 sample.exe takeown.exe PID 2036 wrote to memory of 1860 2036 sample.exe takeown.exe PID 2036 wrote to memory of 584 2036 sample.exe takeown.exe PID 2036 wrote to memory of 584 2036 sample.exe takeown.exe PID 2036 wrote to memory of 584 2036 sample.exe takeown.exe PID 2036 wrote to memory of 1760 2036 sample.exe takeown.exe PID 2036 wrote to memory of 1760 2036 sample.exe takeown.exe PID 2036 wrote to memory of 1760 2036 sample.exe takeown.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\sample.exe"C:\Users\Admin\AppData\Local\Temp\sample.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\takeown.exe"C:\Windows\System32\takeown.exe" /f C:\Users\Admin\deployment.properties2⤵
- Modifies file permissions
-
C:\Windows\System32\takeown.exe"C:\Windows\System32\takeown.exe" /f C:\Users\Admin\NTUSER.DAT2⤵
- Modifies file permissions
-
C:\Windows\System32\takeown.exe"C:\Windows\System32\takeown.exe" /f C:\Users\Admin\ntuser.dat.LOG12⤵
- Modifies file permissions
-
C:\Windows\System32\takeown.exe"C:\Windows\System32\takeown.exe" /f C:\Users\Admin\ntuser.dat.LOG22⤵
- Modifies file permissions
-
C:\Windows\System32\takeown.exe"C:\Windows\System32\takeown.exe" /f C:\Users\Admin\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf2⤵
- Modifies file permissions
-
C:\Windows\System32\takeown.exe"C:\Windows\System32\takeown.exe" /f C:\Users\Admin\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms2⤵
- Modifies file permissions
-
C:\Windows\System32\takeown.exe"C:\Windows\System32\takeown.exe" /f C:\Users\Admin\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms2⤵
- Modifies file permissions
-
C:\Windows\System32\takeown.exe"C:\Windows\System32\takeown.exe" /f C:\Users\Admin\ntuser.ini2⤵
- Modifies file permissions
-
C:\Windows\System32\takeown.exe"C:\Windows\System32\takeown.exe" /f C:\Users\Admin\AppData\Local\GDIPFONTCACHEV1.DAT2⤵
- Modifies file permissions
-
C:\Windows\System32\takeown.exe"C:\Windows\System32\takeown.exe" /f C:\Users\Admin\AppData\Local\IconCache.db2⤵
- Modifies file permissions
-
C:\Windows\System32\takeown.exe"C:\Windows\System32\takeown.exe" /f C:\Users\Admin\AppData\Local\Adobe\Acrobat\9.0\Cache\AcroFnt09.lst2⤵
- Modifies file permissions
-
C:\Windows\System32\takeown.exe"C:\Windows\System32\takeown.exe" /f C:\Users\Admin\AppData\Local\Adobe\Color\ACECache10.lst2⤵
- Modifies file permissions
-
C:\Windows\System32\takeown.exe"C:\Windows\System32\takeown.exe" /f C:\Users\Admin\AppData\Local\Adobe\Color\Profiles\wscRGB.icc2⤵
- Modifies file permissions
-
C:\Windows\System32\takeown.exe"C:\Windows\System32\takeown.exe" /f C:\Users\Admin\AppData\Local\Adobe\Color\Profiles\wsRGB.icc2⤵
- Modifies file permissions
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/584-76-0x0000000000000000-mapping.dmp
-
memory/588-64-0x0000000000000000-mapping.dmp
-
memory/776-68-0x0000000000000000-mapping.dmp
-
memory/1128-72-0x0000000000000000-mapping.dmp
-
memory/1348-67-0x0000000000000000-mapping.dmp
-
memory/1368-66-0x0000000000000000-mapping.dmp
-
memory/1472-71-0x0000000000000000-mapping.dmp
-
memory/1504-73-0x0000000000000000-mapping.dmp
-
memory/1564-69-0x0000000000000000-mapping.dmp
-
memory/1572-63-0x0000000000000000-mapping.dmp
-
memory/1596-65-0x0000000000000000-mapping.dmp
-
memory/1760-77-0x0000000000000000-mapping.dmp
-
memory/1860-74-0x0000000000000000-mapping.dmp
-
memory/1992-70-0x0000000000000000-mapping.dmp
-
memory/2036-61-0x000007FEF6DE0000-0x000007FEF6F0A000-memory.dmpFilesize
1.2MB
-
memory/2036-75-0x000000001B1C6000-0x000000001B1E5000-memory.dmpFilesize
124KB
-
memory/2036-54-0x0000000000880000-0x00000000008BE000-memory.dmpFilesize
248KB
-
memory/2036-60-0x000007FEF3590000-0x000007FEF3FE0000-memory.dmpFilesize
10.3MB
-
memory/2036-59-0x000007FEEE500000-0x000007FEEF44D000-memory.dmpFilesize
15.3MB
-
memory/2036-58-0x000007FEF3FE0000-0x000007FEF41C8000-memory.dmpFilesize
1.9MB
-
memory/2036-57-0x000007FEF41D0000-0x000007FEF4E0F000-memory.dmpFilesize
12.2MB
-
memory/2036-62-0x000007FEF2B00000-0x000007FEF338C000-memory.dmpFilesize
8.5MB
-
memory/2036-56-0x000007FEFBD81000-0x000007FEFBD83000-memory.dmpFilesize
8KB
-
memory/2036-55-0x000007FEF4E10000-0x000007FEF6398000-memory.dmpFilesize
21.5MB
-
memory/2036-78-0x000007FEF4E10000-0x000007FEF6398000-memory.dmpFilesize
21.5MB
-
memory/2036-79-0x000007FEF41D0000-0x000007FEF4E0F000-memory.dmpFilesize
12.2MB
-
memory/2036-80-0x000007FEF3FE0000-0x000007FEF41C8000-memory.dmpFilesize
1.9MB
-
memory/2036-81-0x000007FEEE500000-0x000007FEEF44D000-memory.dmpFilesize
15.3MB
-
memory/2036-82-0x000000001B1C6000-0x000000001B1E5000-memory.dmpFilesize
124KB