7ba272e46d744b719f3493417d14eba01f7f254d003a56ecb17b565169d22cf3

General

Target

7ba272e46d744b719f3493417d14eba01f7f254d003a56ecb17b565169d22cf3.exe
Size

40KB
MD5

60974f99bd6bd301e9e109acbb7523b0
SHA1

8f1b6a8686476c1fe84248043380b1238d50f522
SHA256

7ba272e46d744b719f3493417d14eba01f7f254d003a56ecb17b565169d22cf3
SHA512

7bf960f0ac1064cd50540b6c482d8d7c5952e2fef19b93c6537ae19fbdd20b8f69fb697af39904565a702e1c5f128378e2946073a80188b458ec501711a943a0
SSDEEP

768:/zCmqaAlxkOmCsDGQc5nhq3tAVZ3ZJNP:/zb9Oyk7PP

Score

8^/10

discovery exploit

Malware Config

Signatures

Possible privilege escalation attempt 8 IoCs
exploit

Processes:

icacls.exetakeown.exetakeown.exeicacls.exetakeown.exeicacls.exetakeown.exeicacls.exe

pid process

1744 icacls.exe
2040 takeown.exe
4856 takeown.exe
5032 icacls.exe
4864 takeown.exe
3636 icacls.exe
444 takeown.exe
4192 icacls.exe
Modifies file permissions 1 TTPs 8 IoCs
discovery

File Permissions Modification
T1222

Processes:

takeown.exeicacls.exetakeown.exeicacls.exeicacls.exetakeown.exetakeown.exeicacls.exe

pid process

4864 takeown.exe
3636 icacls.exe
444 takeown.exe
4192 icacls.exe
1744 icacls.exe
2040 takeown.exe
4856 takeown.exe
5032 icacls.exe

pid	process
1744	icacls.exe
2040	takeown.exe
4856	takeown.exe
5032	icacls.exe
4864	takeown.exe
3636	icacls.exe
444	takeown.exe
4192	icacls.exe

pid	process
4864	takeown.exe
3636	icacls.exe
444	takeown.exe
4192	icacls.exe
1744	icacls.exe
2040	takeown.exe
4856	takeown.exe
5032	icacls.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

takeown.exetakeown.exetakeown.exetakeown.exe

description	pid	process
Token: SeTakeOwnershipPrivilege	4856	takeown.exe
Token: SeTakeOwnershipPrivilege	4864	takeown.exe
Token: SeTakeOwnershipPrivilege	444	takeown.exe
Token: SeTakeOwnershipPrivilege	2040	takeown.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

7ba272e46d744b719f3493417d14eba01f7f254d003a56ecb17b565169d22cf3.exe

pid process

2864 7ba272e46d744b719f3493417d14eba01f7f254d003a56ecb17b565169d22cf3.exe

pid	process
2864	7ba272e46d744b719f3493417d14eba01f7f254d003a56ecb17b565169d22cf3.exe

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

7ba272e46d744b719f3493417d14eba01f7f254d003a56ecb17b565169d22cf3.exe

description	pid	process	target process
PID 2864 wrote to memory of 4856	2864	7ba272e46d744b719f3493417d14eba01f7f254d003a56ecb17b565169d22cf3.exe	takeown.exe
PID 2864 wrote to memory of 4856	2864	7ba272e46d744b719f3493417d14eba01f7f254d003a56ecb17b565169d22cf3.exe	takeown.exe
PID 2864 wrote to memory of 4856	2864	7ba272e46d744b719f3493417d14eba01f7f254d003a56ecb17b565169d22cf3.exe	takeown.exe
PID 2864 wrote to memory of 5032	2864	7ba272e46d744b719f3493417d14eba01f7f254d003a56ecb17b565169d22cf3.exe	icacls.exe
PID 2864 wrote to memory of 5032	2864	7ba272e46d744b719f3493417d14eba01f7f254d003a56ecb17b565169d22cf3.exe	icacls.exe
PID 2864 wrote to memory of 5032	2864	7ba272e46d744b719f3493417d14eba01f7f254d003a56ecb17b565169d22cf3.exe	icacls.exe
PID 2864 wrote to memory of 4864	2864	7ba272e46d744b719f3493417d14eba01f7f254d003a56ecb17b565169d22cf3.exe	takeown.exe
PID 2864 wrote to memory of 4864	2864	7ba272e46d744b719f3493417d14eba01f7f254d003a56ecb17b565169d22cf3.exe	takeown.exe
PID 2864 wrote to memory of 4864	2864	7ba272e46d744b719f3493417d14eba01f7f254d003a56ecb17b565169d22cf3.exe	takeown.exe
PID 2864 wrote to memory of 3636	2864	7ba272e46d744b719f3493417d14eba01f7f254d003a56ecb17b565169d22cf3.exe	icacls.exe
PID 2864 wrote to memory of 3636	2864	7ba272e46d744b719f3493417d14eba01f7f254d003a56ecb17b565169d22cf3.exe	icacls.exe
PID 2864 wrote to memory of 3636	2864	7ba272e46d744b719f3493417d14eba01f7f254d003a56ecb17b565169d22cf3.exe	icacls.exe
PID 2864 wrote to memory of 444	2864	7ba272e46d744b719f3493417d14eba01f7f254d003a56ecb17b565169d22cf3.exe	takeown.exe
PID 2864 wrote to memory of 444	2864	7ba272e46d744b719f3493417d14eba01f7f254d003a56ecb17b565169d22cf3.exe	takeown.exe
PID 2864 wrote to memory of 444	2864	7ba272e46d744b719f3493417d14eba01f7f254d003a56ecb17b565169d22cf3.exe	takeown.exe
PID 2864 wrote to memory of 4192	2864	7ba272e46d744b719f3493417d14eba01f7f254d003a56ecb17b565169d22cf3.exe	icacls.exe
PID 2864 wrote to memory of 4192	2864	7ba272e46d744b719f3493417d14eba01f7f254d003a56ecb17b565169d22cf3.exe	icacls.exe
PID 2864 wrote to memory of 4192	2864	7ba272e46d744b719f3493417d14eba01f7f254d003a56ecb17b565169d22cf3.exe	icacls.exe
PID 2864 wrote to memory of 2040	2864	7ba272e46d744b719f3493417d14eba01f7f254d003a56ecb17b565169d22cf3.exe	takeown.exe
PID 2864 wrote to memory of 2040	2864	7ba272e46d744b719f3493417d14eba01f7f254d003a56ecb17b565169d22cf3.exe	takeown.exe
PID 2864 wrote to memory of 2040	2864	7ba272e46d744b719f3493417d14eba01f7f254d003a56ecb17b565169d22cf3.exe	takeown.exe
PID 2864 wrote to memory of 1744	2864	7ba272e46d744b719f3493417d14eba01f7f254d003a56ecb17b565169d22cf3.exe	icacls.exe
PID 2864 wrote to memory of 1744	2864	7ba272e46d744b719f3493417d14eba01f7f254d003a56ecb17b565169d22cf3.exe	icacls.exe
PID 2864 wrote to memory of 1744	2864	7ba272e46d744b719f3493417d14eba01f7f254d003a56ecb17b565169d22cf3.exe	icacls.exe

C:\Users\Admin\AppData\Local\Temp\7ba272e46d744b719f3493417d14eba01f7f254d003a56ecb17b565169d22cf3.exe
"C:\Users\Admin\AppData\Local\Temp\7ba272e46d744b719f3493417d14eba01f7f254d003a56ecb17b565169d22cf3.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2864

C:\Windows\SysWOW64\takeown.exe
C:\Windows\System32\takeown.exe /f "C:\Windows\System32\cmd.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:4856

C:\Windows\SysWOW64\icacls.exe
C:\Windows\System32\icacls.exe "C:\Windows\System32\cmd.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:5032

C:\Windows\SysWOW64\takeown.exe
C:\Windows\System32\takeown.exe /f "C:\Windows\System32\ftp.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:4864

C:\Windows\SysWOW64\icacls.exe
C:\Windows\System32\icacls.exe "C:\Windows\System32\ftp.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:3636

C:\Windows\SysWOW64\takeown.exe
C:\Windows\System32\takeown.exe /f "C:\Windows\System32\wscript.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:444

C:\Windows\SysWOW64\icacls.exe
C:\Windows\System32\icacls.exe "C:\Windows\System32\wscript.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:4192

C:\Windows\SysWOW64\icacls.exe
C:\Windows\System32\icacls.exe "C:\Windows\System32\cscript.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1744

C:\Windows\SysWOW64\takeown.exe
C:\Windows\System32\takeown.exe /f "C:\Windows\System32\cscript.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:2040

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File Permissions Modification

1

T1222

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/444-138-0x0000000000000000-mapping.dmp

Download
memory/1744-141-0x0000000000000000-mapping.dmp

Download
memory/2040-140-0x0000000000000000-mapping.dmp

Download
memory/3636-137-0x0000000000000000-mapping.dmp

Download
memory/4192-139-0x0000000000000000-mapping.dmp

Download
memory/4856-134-0x0000000000000000-mapping.dmp

Download
memory/4864-136-0x0000000000000000-mapping.dmp

Download
memory/5032-135-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing