96b7616af0a65d91510d84b39b04635da4511148e16599d469e112c3e73afd8a

Analysis

max time kernel
38s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04-10-2022 01:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

96b7616af0a65d91510d84b39b04635da4511148e16599d469e112c3e73afd8a.exe
Size

68KB
MD5

076b85a5c833508de41b3cf7292b3c76
SHA1

e6d5db8f4ce19fc52ca3e8994dd983758629ea5a
SHA256

96b7616af0a65d91510d84b39b04635da4511148e16599d469e112c3e73afd8a
SHA512

11f4e94524aea494c5c934f14c60508171f9fce6f48414ae347d9796517b5cd6e208cbd1bb80f5ac2664297af97217556d1098594ecbbb05d779fe34d9f470f8
SSDEEP

768:8AzPQ1mt9KylnlBzvy7HRxlAUc8quFZTOHvPV+uaQGQiERntyuK0dUcqGMkqEKAZ:8ADQEK+qF3FZTOHvPVfY1ERtqGMkGt4v

Score

8^/10

discovery exploit

Malware Config

Signatures

Possible privilege escalation attempt 2 IoCs
exploit

Processes:

takeown.exeicacls.exe

pid process

1392 takeown.exe
876 icacls.exe
Modifies file permissions 1 TTPs 2 IoCs
discovery

File Permissions Modification
T1222

Processes:

takeown.exeicacls.exe

pid process

1392 takeown.exe
876 icacls.exe

pid	process
1392	takeown.exe
876	icacls.exe

pid	process
1392	takeown.exe
876	icacls.exe

Drops file in System32 directory 2 IoCs

Processes:

96b7616af0a65d91510d84b39b04635da4511148e16599d469e112c3e73afd8a.exe

description	ioc	process
File created	C:\Windows\SysWOW64\titqi.exe	96b7616af0a65d91510d84b39b04635da4511148e16599d469e112c3e73afd8a.exe
File opened for modification	C:\Windows\SysWOW64\titqi.exe	96b7616af0a65d91510d84b39b04635da4511148e16599d469e112c3e73afd8a.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

96b7616af0a65d91510d84b39b04635da4511148e16599d469e112c3e73afd8a.exe

pid process

1148 96b7616af0a65d91510d84b39b04635da4511148e16599d469e112c3e73afd8a.exe

pid	process
1148	96b7616af0a65d91510d84b39b04635da4511148e16599d469e112c3e73afd8a.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

96b7616af0a65d91510d84b39b04635da4511148e16599d469e112c3e73afd8a.exe

description	pid	process	target process
PID 1148 wrote to memory of 1392	1148	96b7616af0a65d91510d84b39b04635da4511148e16599d469e112c3e73afd8a.exe	takeown.exe
PID 1148 wrote to memory of 1392	1148	96b7616af0a65d91510d84b39b04635da4511148e16599d469e112c3e73afd8a.exe	takeown.exe
PID 1148 wrote to memory of 1392	1148	96b7616af0a65d91510d84b39b04635da4511148e16599d469e112c3e73afd8a.exe	takeown.exe
PID 1148 wrote to memory of 1392	1148	96b7616af0a65d91510d84b39b04635da4511148e16599d469e112c3e73afd8a.exe	takeown.exe
PID 1148 wrote to memory of 876	1148	96b7616af0a65d91510d84b39b04635da4511148e16599d469e112c3e73afd8a.exe	icacls.exe
PID 1148 wrote to memory of 876	1148	96b7616af0a65d91510d84b39b04635da4511148e16599d469e112c3e73afd8a.exe	icacls.exe
PID 1148 wrote to memory of 876	1148	96b7616af0a65d91510d84b39b04635da4511148e16599d469e112c3e73afd8a.exe	icacls.exe
PID 1148 wrote to memory of 876	1148	96b7616af0a65d91510d84b39b04635da4511148e16599d469e112c3e73afd8a.exe	icacls.exe

C:\Users\Admin\AppData\Local\Temp\96b7616af0a65d91510d84b39b04635da4511148e16599d469e112c3e73afd8a.exe
"C:\Users\Admin\AppData\Local\Temp\96b7616af0a65d91510d84b39b04635da4511148e16599d469e112c3e73afd8a.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1148

C:\Windows\SysWOW64\takeown.exe
C:\Windows\system32\takeown.exe /f "C:\Windows\system32\titqi.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1392

C:\Windows\SysWOW64\icacls.exe
C:\Windows\system32\icacls.exe "C:\Windows\system32\titqi.exe" /grant SYSTEM:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:876

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\titqi.exe
Filesize
68KB

MD5
076b85a5c833508de41b3cf7292b3c76

SHA1
e6d5db8f4ce19fc52ca3e8994dd983758629ea5a

SHA256
96b7616af0a65d91510d84b39b04635da4511148e16599d469e112c3e73afd8a

SHA512
11f4e94524aea494c5c934f14c60508171f9fce6f48414ae347d9796517b5cd6e208cbd1bb80f5ac2664297af97217556d1098594ecbbb05d779fe34d9f470f8

Download Submit
memory/876-59-0x0000000000000000-mapping.dmp

Download
memory/1148-56-0x0000000074C11000-0x0000000074C13000-memory.dmp

Filesize
8KB

Download
memory/1392-57-0x0000000000000000-mapping.dmp

Download