c539ceb9389cdbd56f7f7c20674daed01f1eb1fdf006ba2fe3a04b3b804e9109

General

Target

c539ceb9389cdbd56f7f7c20674daed01f1eb1fdf006ba2fe3a04b3b804e9109.exe
Size

40KB
MD5

71abec24d2bd240a05598a98436aa680
SHA1

3b2089b35607157d9b430e2d56519780f061ed75
SHA256

c539ceb9389cdbd56f7f7c20674daed01f1eb1fdf006ba2fe3a04b3b804e9109
SHA512

60f7da92fe240dcd13cda5e0291a82715dde8ed2ed7726f2b31da1f6d9d2da750484f5bddbf3c8f3409280297bf79c15d9ec5e5589423288b3ae01db8d9216ec
SSDEEP

768:/ldby8mj5JTr/bjcftyharCb/EoH/JhZj7KA3+Y36WtJvizxxsKhOMYoS3vw8pRh:/P4n/bIftyharCb/EoH/JhZj7KA3+Y3z

Score

8^/10

discovery exploit

Malware Config

Signatures

Possible privilege escalation attempt 8 IoCs
exploit

Processes:

icacls.exetakeown.exetakeown.exeicacls.exeicacls.exetakeown.exeicacls.exetakeown.exe

pid process

3352 icacls.exe
4252 takeown.exe
1428 takeown.exe
4764 icacls.exe
2028 icacls.exe
4844 takeown.exe
4936 icacls.exe
4820 takeown.exe
Modifies file permissions 1 TTPs 8 IoCs
discovery

File Permissions Modification
T1222

Processes:

icacls.exeicacls.exetakeown.exeicacls.exetakeown.exeicacls.exetakeown.exetakeown.exe

pid process

4764 icacls.exe
2028 icacls.exe
4844 takeown.exe
4936 icacls.exe
4820 takeown.exe
3352 icacls.exe
4252 takeown.exe
1428 takeown.exe

pid	process
3352	icacls.exe
4252	takeown.exe
1428	takeown.exe
4764	icacls.exe
2028	icacls.exe
4844	takeown.exe
4936	icacls.exe
4820	takeown.exe

pid	process
4764	icacls.exe
2028	icacls.exe
4844	takeown.exe
4936	icacls.exe
4820	takeown.exe
3352	icacls.exe
4252	takeown.exe
1428	takeown.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

takeown.exetakeown.exetakeown.exetakeown.exe

description	pid	process
Token: SeTakeOwnershipPrivilege	4252	takeown.exe
Token: SeTakeOwnershipPrivilege	4844	takeown.exe
Token: SeTakeOwnershipPrivilege	4820	takeown.exe
Token: SeTakeOwnershipPrivilege	1428	takeown.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

c539ceb9389cdbd56f7f7c20674daed01f1eb1fdf006ba2fe3a04b3b804e9109.exe

pid process

4964 c539ceb9389cdbd56f7f7c20674daed01f1eb1fdf006ba2fe3a04b3b804e9109.exe

pid	process
4964	c539ceb9389cdbd56f7f7c20674daed01f1eb1fdf006ba2fe3a04b3b804e9109.exe

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

c539ceb9389cdbd56f7f7c20674daed01f1eb1fdf006ba2fe3a04b3b804e9109.exe

description	pid	process	target process
PID 4964 wrote to memory of 4844	4964	c539ceb9389cdbd56f7f7c20674daed01f1eb1fdf006ba2fe3a04b3b804e9109.exe	takeown.exe
PID 4964 wrote to memory of 4844	4964	c539ceb9389cdbd56f7f7c20674daed01f1eb1fdf006ba2fe3a04b3b804e9109.exe	takeown.exe
PID 4964 wrote to memory of 4844	4964	c539ceb9389cdbd56f7f7c20674daed01f1eb1fdf006ba2fe3a04b3b804e9109.exe	takeown.exe
PID 4964 wrote to memory of 4936	4964	c539ceb9389cdbd56f7f7c20674daed01f1eb1fdf006ba2fe3a04b3b804e9109.exe	icacls.exe
PID 4964 wrote to memory of 4936	4964	c539ceb9389cdbd56f7f7c20674daed01f1eb1fdf006ba2fe3a04b3b804e9109.exe	icacls.exe
PID 4964 wrote to memory of 4936	4964	c539ceb9389cdbd56f7f7c20674daed01f1eb1fdf006ba2fe3a04b3b804e9109.exe	icacls.exe
PID 4964 wrote to memory of 4820	4964	c539ceb9389cdbd56f7f7c20674daed01f1eb1fdf006ba2fe3a04b3b804e9109.exe	takeown.exe
PID 4964 wrote to memory of 4820	4964	c539ceb9389cdbd56f7f7c20674daed01f1eb1fdf006ba2fe3a04b3b804e9109.exe	takeown.exe
PID 4964 wrote to memory of 4820	4964	c539ceb9389cdbd56f7f7c20674daed01f1eb1fdf006ba2fe3a04b3b804e9109.exe	takeown.exe
PID 4964 wrote to memory of 3352	4964	c539ceb9389cdbd56f7f7c20674daed01f1eb1fdf006ba2fe3a04b3b804e9109.exe	icacls.exe
PID 4964 wrote to memory of 3352	4964	c539ceb9389cdbd56f7f7c20674daed01f1eb1fdf006ba2fe3a04b3b804e9109.exe	icacls.exe
PID 4964 wrote to memory of 3352	4964	c539ceb9389cdbd56f7f7c20674daed01f1eb1fdf006ba2fe3a04b3b804e9109.exe	icacls.exe
PID 4964 wrote to memory of 4252	4964	c539ceb9389cdbd56f7f7c20674daed01f1eb1fdf006ba2fe3a04b3b804e9109.exe	takeown.exe
PID 4964 wrote to memory of 4252	4964	c539ceb9389cdbd56f7f7c20674daed01f1eb1fdf006ba2fe3a04b3b804e9109.exe	takeown.exe
PID 4964 wrote to memory of 4252	4964	c539ceb9389cdbd56f7f7c20674daed01f1eb1fdf006ba2fe3a04b3b804e9109.exe	takeown.exe
PID 4964 wrote to memory of 2028	4964	c539ceb9389cdbd56f7f7c20674daed01f1eb1fdf006ba2fe3a04b3b804e9109.exe	icacls.exe
PID 4964 wrote to memory of 2028	4964	c539ceb9389cdbd56f7f7c20674daed01f1eb1fdf006ba2fe3a04b3b804e9109.exe	icacls.exe
PID 4964 wrote to memory of 2028	4964	c539ceb9389cdbd56f7f7c20674daed01f1eb1fdf006ba2fe3a04b3b804e9109.exe	icacls.exe
PID 4964 wrote to memory of 1428	4964	c539ceb9389cdbd56f7f7c20674daed01f1eb1fdf006ba2fe3a04b3b804e9109.exe	takeown.exe
PID 4964 wrote to memory of 1428	4964	c539ceb9389cdbd56f7f7c20674daed01f1eb1fdf006ba2fe3a04b3b804e9109.exe	takeown.exe
PID 4964 wrote to memory of 1428	4964	c539ceb9389cdbd56f7f7c20674daed01f1eb1fdf006ba2fe3a04b3b804e9109.exe	takeown.exe
PID 4964 wrote to memory of 4764	4964	c539ceb9389cdbd56f7f7c20674daed01f1eb1fdf006ba2fe3a04b3b804e9109.exe	icacls.exe
PID 4964 wrote to memory of 4764	4964	c539ceb9389cdbd56f7f7c20674daed01f1eb1fdf006ba2fe3a04b3b804e9109.exe	icacls.exe
PID 4964 wrote to memory of 4764	4964	c539ceb9389cdbd56f7f7c20674daed01f1eb1fdf006ba2fe3a04b3b804e9109.exe	icacls.exe

C:\Users\Admin\AppData\Local\Temp\c539ceb9389cdbd56f7f7c20674daed01f1eb1fdf006ba2fe3a04b3b804e9109.exe
"C:\Users\Admin\AppData\Local\Temp\c539ceb9389cdbd56f7f7c20674daed01f1eb1fdf006ba2fe3a04b3b804e9109.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4964

C:\Windows\SysWOW64\takeown.exe
C:\Windows\System32\takeown.exe /f "C:\Windows\System32\cmd.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:4844

C:\Windows\SysWOW64\icacls.exe
C:\Windows\System32\icacls.exe "C:\Windows\System32\cmd.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:4936

C:\Windows\SysWOW64\takeown.exe
C:\Windows\System32\takeown.exe /f "C:\Windows\System32\ftp.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:4820

C:\Windows\SysWOW64\icacls.exe
C:\Windows\System32\icacls.exe "C:\Windows\System32\ftp.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:3352

C:\Windows\SysWOW64\takeown.exe
C:\Windows\System32\takeown.exe /f "C:\Windows\System32\wscript.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:4252

C:\Windows\SysWOW64\takeown.exe
C:\Windows\System32\takeown.exe /f "C:\Windows\System32\cscript.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:1428

C:\Windows\SysWOW64\icacls.exe
C:\Windows\System32\icacls.exe "C:\Windows\System32\cscript.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:4764

C:\Windows\SysWOW64\icacls.exe
C:\Windows\System32\icacls.exe "C:\Windows\System32\wscript.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:2028

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File Permissions Modification

1

T1222

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1428-140-0x0000000000000000-mapping.dmp

Download
memory/2028-139-0x0000000000000000-mapping.dmp

Download
memory/3352-137-0x0000000000000000-mapping.dmp

Download
memory/4252-138-0x0000000000000000-mapping.dmp

Download
memory/4764-141-0x0000000000000000-mapping.dmp

Download
memory/4820-136-0x0000000000000000-mapping.dmp

Download
memory/4844-134-0x0000000000000000-mapping.dmp

Download
memory/4936-135-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing