def70f9266363ea88b8c3a7a47084b041aa6208f9e7c335be3c08bf341c746b0

Analysis

max time kernel
139s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02-10-2022 10:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

def70f9266363ea88b8c3a7a47084b041aa6208f9e7c335be3c08bf341c746b0.exe
Size

40KB
MD5

5718e56b11e5bfa6bfd6a62b5656d1c0
SHA1

81bc4ab540b5613613284521789ab89ee4f4df5b
SHA256

def70f9266363ea88b8c3a7a47084b041aa6208f9e7c335be3c08bf341c746b0
SHA512

6a8781089239a3e50ad8e5c205e10cc6c9441302b3ae50034d779704c8706b62b1e62701b40faa904e25ef842d15eb2a215ee5c2954ef636cd6cee936dba57e3
SSDEEP

768:/TO+hvTGEfCxzjSGBcvZZrt4qWhv4Co57BNdOviIqmKtwpjJFg7a:/iu7AFkxeyCo5VXODFg7a

Score

8^/10

discovery exploit persistence

Malware Config

Signatures

Possible privilege escalation attempt 2 IoCs
exploit

Processes:

takeown.exeicacls.exe

pid process

4576 takeown.exe
3600 icacls.exe
Modifies file permissions 1 TTPs 2 IoCs
discovery

File Permissions Modification
T1222

Processes:

takeown.exeicacls.exe

pid process

4576 takeown.exe
3600 icacls.exe

pid	process
4576	takeown.exe
3600	icacls.exe

pid	process
4576	takeown.exe
3600	icacls.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

def70f9266363ea88b8c3a7a47084b041aa6208f9e7c335be3c08bf341c746b0.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	def70f9266363ea88b8c3a7a47084b041aa6208f9e7c335be3c08bf341c746b0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\dox = "C:\\Windows\\system32\\mtesy.exe"	def70f9266363ea88b8c3a7a47084b041aa6208f9e7c335be3c08bf341c746b0.exe

Drops file in System32 directory 2 IoCs

Processes:

def70f9266363ea88b8c3a7a47084b041aa6208f9e7c335be3c08bf341c746b0.exe

description	ioc	process
File created	C:\Windows\SysWOW64\mtesy.exe	def70f9266363ea88b8c3a7a47084b041aa6208f9e7c335be3c08bf341c746b0.exe
File opened for modification	C:\Windows\SysWOW64\mtesy.exe	def70f9266363ea88b8c3a7a47084b041aa6208f9e7c335be3c08bf341c746b0.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

def70f9266363ea88b8c3a7a47084b041aa6208f9e7c335be3c08bf341c746b0.exe

pid process

2628 def70f9266363ea88b8c3a7a47084b041aa6208f9e7c335be3c08bf341c746b0.exe

pid	process
2628	def70f9266363ea88b8c3a7a47084b041aa6208f9e7c335be3c08bf341c746b0.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

def70f9266363ea88b8c3a7a47084b041aa6208f9e7c335be3c08bf341c746b0.exe

description	pid	process	target process
PID 2628 wrote to memory of 4576	2628	def70f9266363ea88b8c3a7a47084b041aa6208f9e7c335be3c08bf341c746b0.exe	takeown.exe
PID 2628 wrote to memory of 4576	2628	def70f9266363ea88b8c3a7a47084b041aa6208f9e7c335be3c08bf341c746b0.exe	takeown.exe
PID 2628 wrote to memory of 4576	2628	def70f9266363ea88b8c3a7a47084b041aa6208f9e7c335be3c08bf341c746b0.exe	takeown.exe
PID 2628 wrote to memory of 3600	2628	def70f9266363ea88b8c3a7a47084b041aa6208f9e7c335be3c08bf341c746b0.exe	icacls.exe
PID 2628 wrote to memory of 3600	2628	def70f9266363ea88b8c3a7a47084b041aa6208f9e7c335be3c08bf341c746b0.exe	icacls.exe
PID 2628 wrote to memory of 3600	2628	def70f9266363ea88b8c3a7a47084b041aa6208f9e7c335be3c08bf341c746b0.exe	icacls.exe

C:\Users\Admin\AppData\Local\Temp\def70f9266363ea88b8c3a7a47084b041aa6208f9e7c335be3c08bf341c746b0.exe
"C:\Users\Admin\AppData\Local\Temp\def70f9266363ea88b8c3a7a47084b041aa6208f9e7c335be3c08bf341c746b0.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2628

C:\Windows\SysWOW64\takeown.exe
C:\Windows\system32\takeown.exe /f "C:\Windows\system32\mtesy.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:4576

C:\Windows\SysWOW64\icacls.exe
C:\Windows\system32\icacls.exe "C:\Windows\system32\mtesy.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:3600

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

File Permissions Modification

T1222

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\mtesy.exe
Filesize
40KB

MD5
5718e56b11e5bfa6bfd6a62b5656d1c0

SHA1
81bc4ab540b5613613284521789ab89ee4f4df5b

SHA256
def70f9266363ea88b8c3a7a47084b041aa6208f9e7c335be3c08bf341c746b0

SHA512
6a8781089239a3e50ad8e5c205e10cc6c9441302b3ae50034d779704c8706b62b1e62701b40faa904e25ef842d15eb2a215ee5c2954ef636cd6cee936dba57e3

Download Submit
memory/3600-135-0x0000000000000000-mapping.dmp

Download
memory/4576-134-0x0000000000000000-mapping.dmp

Download