7f4a62d4627207505489a7b33bc6bc067cb55a55f883d54a337dbd3bde5bcf4f

Analysis

max time kernel
38s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03-10-2022 01:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7f4a62d4627207505489a7b33bc6bc067cb55a55f883d54a337dbd3bde5bcf4f.exe
Size

72KB
MD5

0189d11fef56258412711436079fb236
SHA1

a5e047bab2a836a7fbde9bc74712caa91fddee65
SHA256

7f4a62d4627207505489a7b33bc6bc067cb55a55f883d54a337dbd3bde5bcf4f
SHA512

10653dd1c044541e9cb985459556c61d39ae45ad597d398ea02ede4418c11887a5de0fd71fd5f3b714c252a72e7006b3cccc98e523e7362fd60ca082cb70d2b6
SSDEEP

768:YkLyxhrNQ7/pkcJLXyzAEtSfPpf+drcAC8hhMOuSf+2ME9kv4FMLIWV2gXw:YyyF9MXUAasoQ8h2Zhak4SIWV2qw

Score

8^/10

discovery exploit

Malware Config

Signatures

Possible privilege escalation attempt 2 IoCs
exploit

Processes:

takeown.exeicacls.exe

pid process

600 takeown.exe
1196 icacls.exe
Modifies file permissions 1 TTPs 2 IoCs
discovery

File Permissions Modification
T1222

Processes:

takeown.exeicacls.exe

pid process

600 takeown.exe
1196 icacls.exe

pid	process
600	takeown.exe
1196	icacls.exe

pid	process
600	takeown.exe
1196	icacls.exe

Drops file in System32 directory 2 IoCs

Processes:

7f4a62d4627207505489a7b33bc6bc067cb55a55f883d54a337dbd3bde5bcf4f.exe

description	ioc	process
File created	C:\Windows\SysWOW64\skjc.exe	7f4a62d4627207505489a7b33bc6bc067cb55a55f883d54a337dbd3bde5bcf4f.exe
File opened for modification	C:\Windows\SysWOW64\skjc.exe	7f4a62d4627207505489a7b33bc6bc067cb55a55f883d54a337dbd3bde5bcf4f.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

7f4a62d4627207505489a7b33bc6bc067cb55a55f883d54a337dbd3bde5bcf4f.exe

pid process

1148 7f4a62d4627207505489a7b33bc6bc067cb55a55f883d54a337dbd3bde5bcf4f.exe

pid	process
1148	7f4a62d4627207505489a7b33bc6bc067cb55a55f883d54a337dbd3bde5bcf4f.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

7f4a62d4627207505489a7b33bc6bc067cb55a55f883d54a337dbd3bde5bcf4f.exe

description	pid	process	target process
PID 1148 wrote to memory of 600	1148	7f4a62d4627207505489a7b33bc6bc067cb55a55f883d54a337dbd3bde5bcf4f.exe	takeown.exe
PID 1148 wrote to memory of 600	1148	7f4a62d4627207505489a7b33bc6bc067cb55a55f883d54a337dbd3bde5bcf4f.exe	takeown.exe
PID 1148 wrote to memory of 600	1148	7f4a62d4627207505489a7b33bc6bc067cb55a55f883d54a337dbd3bde5bcf4f.exe	takeown.exe
PID 1148 wrote to memory of 600	1148	7f4a62d4627207505489a7b33bc6bc067cb55a55f883d54a337dbd3bde5bcf4f.exe	takeown.exe
PID 1148 wrote to memory of 1196	1148	7f4a62d4627207505489a7b33bc6bc067cb55a55f883d54a337dbd3bde5bcf4f.exe	icacls.exe
PID 1148 wrote to memory of 1196	1148	7f4a62d4627207505489a7b33bc6bc067cb55a55f883d54a337dbd3bde5bcf4f.exe	icacls.exe
PID 1148 wrote to memory of 1196	1148	7f4a62d4627207505489a7b33bc6bc067cb55a55f883d54a337dbd3bde5bcf4f.exe	icacls.exe
PID 1148 wrote to memory of 1196	1148	7f4a62d4627207505489a7b33bc6bc067cb55a55f883d54a337dbd3bde5bcf4f.exe	icacls.exe

C:\Users\Admin\AppData\Local\Temp\7f4a62d4627207505489a7b33bc6bc067cb55a55f883d54a337dbd3bde5bcf4f.exe
"C:\Users\Admin\AppData\Local\Temp\7f4a62d4627207505489a7b33bc6bc067cb55a55f883d54a337dbd3bde5bcf4f.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1148

C:\Windows\SysWOW64\takeown.exe
C:\Windows\system32\takeown.exe /f "C:\Windows\system32\skjc.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:600

C:\Windows\SysWOW64\icacls.exe
C:\Windows\system32\icacls.exe "C:\Windows\system32\skjc.exe" /grant SYSTEM:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1196

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\skjc.exe
Filesize
72KB

MD5
0189d11fef56258412711436079fb236

SHA1
a5e047bab2a836a7fbde9bc74712caa91fddee65

SHA256
7f4a62d4627207505489a7b33bc6bc067cb55a55f883d54a337dbd3bde5bcf4f

SHA512
10653dd1c044541e9cb985459556c61d39ae45ad597d398ea02ede4418c11887a5de0fd71fd5f3b714c252a72e7006b3cccc98e523e7362fd60ca082cb70d2b6

Download Submit
memory/600-57-0x0000000000000000-mapping.dmp

Download
memory/1148-56-0x0000000074C11000-0x0000000074C13000-memory.dmp

Filesize
8KB

Download
memory/1196-59-0x0000000000000000-mapping.dmp

Download