27aa4febcedc406587a418960127412f940c712e967ba25efb35527b286a6c32

General

Target

27aa4febcedc406587a418960127412f940c712e967ba25efb35527b286a6c32.exe
Size

40KB
MD5

69a9c390bb4cacb7c15a055a97935e10
SHA1

9e7bb369d0fc82f4f587c16cbca7252a3306d1b9
SHA256

27aa4febcedc406587a418960127412f940c712e967ba25efb35527b286a6c32
SHA512

88a0ae222264ecb46d883b12f08e3af84d90b2a3b0de142640da88d000c3291a9df195960e8038ddd70805fbcb478aef92b79a39981c92aa9bfe4c3b44b63c9b
SSDEEP

768:/JEbZm8T8kmw+XX4T40KOvBeEKje/HoX1o7N/mT7RIgxuX12GSVUKhRqZLdNg:/JEg8T83XXWvBeEKje/HoX1o7N/mT7RH

Score

8^/10

discovery exploit

Malware Config

Signatures

Possible privilege escalation attempt 8 IoCs
exploit

Processes:

takeown.exeicacls.exetakeown.exeicacls.exetakeown.exeicacls.exeicacls.exetakeown.exe

pid process

1448 takeown.exe
1936 icacls.exe
1812 takeown.exe
1708 icacls.exe
1704 takeown.exe
1940 icacls.exe
240 icacls.exe
944 takeown.exe
Modifies file permissions 1 TTPs 8 IoCs
discovery

File Permissions Modification
T1222

Processes:

icacls.exeicacls.exetakeown.exetakeown.exeicacls.exetakeown.exeicacls.exetakeown.exe

pid process

1940 icacls.exe
240 icacls.exe
944 takeown.exe
1448 takeown.exe
1936 icacls.exe
1812 takeown.exe
1708 icacls.exe
1704 takeown.exe

pid	process
1448	takeown.exe
1936	icacls.exe
1812	takeown.exe
1708	icacls.exe
1704	takeown.exe
1940	icacls.exe
240	icacls.exe
944	takeown.exe

pid	process
1940	icacls.exe
240	icacls.exe
944	takeown.exe
1448	takeown.exe
1936	icacls.exe
1812	takeown.exe
1708	icacls.exe
1704	takeown.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

takeown.exetakeown.exetakeown.exetakeown.exe

description	pid	process
Token: SeTakeOwnershipPrivilege	944	takeown.exe
Token: SeTakeOwnershipPrivilege	1704	takeown.exe
Token: SeTakeOwnershipPrivilege	1448	takeown.exe
Token: SeTakeOwnershipPrivilege	1812	takeown.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

27aa4febcedc406587a418960127412f940c712e967ba25efb35527b286a6c32.exe

pid process

1612 27aa4febcedc406587a418960127412f940c712e967ba25efb35527b286a6c32.exe

pid	process
1612	27aa4febcedc406587a418960127412f940c712e967ba25efb35527b286a6c32.exe

Suspicious use of WriteProcessMemory 32 IoCs

Processes:

27aa4febcedc406587a418960127412f940c712e967ba25efb35527b286a6c32.exe

description	pid	process	target process
PID 1612 wrote to memory of 1812	1612	27aa4febcedc406587a418960127412f940c712e967ba25efb35527b286a6c32.exe	takeown.exe
PID 1612 wrote to memory of 1812	1612	27aa4febcedc406587a418960127412f940c712e967ba25efb35527b286a6c32.exe	takeown.exe
PID 1612 wrote to memory of 1812	1612	27aa4febcedc406587a418960127412f940c712e967ba25efb35527b286a6c32.exe	takeown.exe
PID 1612 wrote to memory of 1812	1612	27aa4febcedc406587a418960127412f940c712e967ba25efb35527b286a6c32.exe	takeown.exe
PID 1612 wrote to memory of 1708	1612	27aa4febcedc406587a418960127412f940c712e967ba25efb35527b286a6c32.exe	icacls.exe
PID 1612 wrote to memory of 1708	1612	27aa4febcedc406587a418960127412f940c712e967ba25efb35527b286a6c32.exe	icacls.exe
PID 1612 wrote to memory of 1708	1612	27aa4febcedc406587a418960127412f940c712e967ba25efb35527b286a6c32.exe	icacls.exe
PID 1612 wrote to memory of 1708	1612	27aa4febcedc406587a418960127412f940c712e967ba25efb35527b286a6c32.exe	icacls.exe
PID 1612 wrote to memory of 1704	1612	27aa4febcedc406587a418960127412f940c712e967ba25efb35527b286a6c32.exe	takeown.exe
PID 1612 wrote to memory of 1704	1612	27aa4febcedc406587a418960127412f940c712e967ba25efb35527b286a6c32.exe	takeown.exe
PID 1612 wrote to memory of 1704	1612	27aa4febcedc406587a418960127412f940c712e967ba25efb35527b286a6c32.exe	takeown.exe
PID 1612 wrote to memory of 1704	1612	27aa4febcedc406587a418960127412f940c712e967ba25efb35527b286a6c32.exe	takeown.exe
PID 1612 wrote to memory of 1940	1612	27aa4febcedc406587a418960127412f940c712e967ba25efb35527b286a6c32.exe	icacls.exe
PID 1612 wrote to memory of 1940	1612	27aa4febcedc406587a418960127412f940c712e967ba25efb35527b286a6c32.exe	icacls.exe
PID 1612 wrote to memory of 1940	1612	27aa4febcedc406587a418960127412f940c712e967ba25efb35527b286a6c32.exe	icacls.exe
PID 1612 wrote to memory of 1940	1612	27aa4febcedc406587a418960127412f940c712e967ba25efb35527b286a6c32.exe	icacls.exe
PID 1612 wrote to memory of 944	1612	27aa4febcedc406587a418960127412f940c712e967ba25efb35527b286a6c32.exe	takeown.exe
PID 1612 wrote to memory of 944	1612	27aa4febcedc406587a418960127412f940c712e967ba25efb35527b286a6c32.exe	takeown.exe
PID 1612 wrote to memory of 944	1612	27aa4febcedc406587a418960127412f940c712e967ba25efb35527b286a6c32.exe	takeown.exe
PID 1612 wrote to memory of 944	1612	27aa4febcedc406587a418960127412f940c712e967ba25efb35527b286a6c32.exe	takeown.exe
PID 1612 wrote to memory of 240	1612	27aa4febcedc406587a418960127412f940c712e967ba25efb35527b286a6c32.exe	icacls.exe
PID 1612 wrote to memory of 240	1612	27aa4febcedc406587a418960127412f940c712e967ba25efb35527b286a6c32.exe	icacls.exe
PID 1612 wrote to memory of 240	1612	27aa4febcedc406587a418960127412f940c712e967ba25efb35527b286a6c32.exe	icacls.exe
PID 1612 wrote to memory of 240	1612	27aa4febcedc406587a418960127412f940c712e967ba25efb35527b286a6c32.exe	icacls.exe
PID 1612 wrote to memory of 1448	1612	27aa4febcedc406587a418960127412f940c712e967ba25efb35527b286a6c32.exe	takeown.exe
PID 1612 wrote to memory of 1448	1612	27aa4febcedc406587a418960127412f940c712e967ba25efb35527b286a6c32.exe	takeown.exe
PID 1612 wrote to memory of 1448	1612	27aa4febcedc406587a418960127412f940c712e967ba25efb35527b286a6c32.exe	takeown.exe
PID 1612 wrote to memory of 1448	1612	27aa4febcedc406587a418960127412f940c712e967ba25efb35527b286a6c32.exe	takeown.exe
PID 1612 wrote to memory of 1936	1612	27aa4febcedc406587a418960127412f940c712e967ba25efb35527b286a6c32.exe	icacls.exe
PID 1612 wrote to memory of 1936	1612	27aa4febcedc406587a418960127412f940c712e967ba25efb35527b286a6c32.exe	icacls.exe
PID 1612 wrote to memory of 1936	1612	27aa4febcedc406587a418960127412f940c712e967ba25efb35527b286a6c32.exe	icacls.exe
PID 1612 wrote to memory of 1936	1612	27aa4febcedc406587a418960127412f940c712e967ba25efb35527b286a6c32.exe	icacls.exe

C:\Users\Admin\AppData\Local\Temp\27aa4febcedc406587a418960127412f940c712e967ba25efb35527b286a6c32.exe
"C:\Users\Admin\AppData\Local\Temp\27aa4febcedc406587a418960127412f940c712e967ba25efb35527b286a6c32.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1612

C:\Windows\SysWOW64\takeown.exe
C:\Windows\System32\takeown.exe /f "C:\Windows\System32\cmd.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:1812

C:\Windows\SysWOW64\icacls.exe
C:\Windows\System32\icacls.exe "C:\Windows\System32\cmd.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1708

C:\Windows\SysWOW64\takeown.exe
C:\Windows\System32\takeown.exe /f "C:\Windows\System32\ftp.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:1704

C:\Windows\SysWOW64\icacls.exe
C:\Windows\System32\icacls.exe "C:\Windows\System32\ftp.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1940

C:\Windows\SysWOW64\icacls.exe
C:\Windows\System32\icacls.exe "C:\Windows\System32\wscript.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:240

C:\Windows\SysWOW64\takeown.exe
C:\Windows\System32\takeown.exe /f "C:\Windows\System32\wscript.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:944

C:\Windows\SysWOW64\takeown.exe
C:\Windows\System32\takeown.exe /f "C:\Windows\System32\cscript.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:1448

C:\Windows\SysWOW64\icacls.exe
C:\Windows\System32\icacls.exe "C:\Windows\System32\cscript.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1936

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File Permissions Modification

1

T1222

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/240-61-0x0000000000000000-mapping.dmp

Download
memory/944-60-0x0000000000000000-mapping.dmp

Download
memory/1448-62-0x0000000000000000-mapping.dmp

Download
memory/1704-58-0x0000000000000000-mapping.dmp

Download
memory/1708-57-0x0000000000000000-mapping.dmp

Download
memory/1812-56-0x0000000000000000-mapping.dmp

Download
memory/1936-63-0x0000000000000000-mapping.dmp

Download
memory/1940-59-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing