27aa4febcedc406587a418960127412f940c712e967ba25efb35527b286a6c32

General

Target

27aa4febcedc406587a418960127412f940c712e967ba25efb35527b286a6c32.exe
Size

40KB
MD5

69a9c390bb4cacb7c15a055a97935e10
SHA1

9e7bb369d0fc82f4f587c16cbca7252a3306d1b9
SHA256

27aa4febcedc406587a418960127412f940c712e967ba25efb35527b286a6c32
SHA512

88a0ae222264ecb46d883b12f08e3af84d90b2a3b0de142640da88d000c3291a9df195960e8038ddd70805fbcb478aef92b79a39981c92aa9bfe4c3b44b63c9b
SSDEEP

768:/JEbZm8T8kmw+XX4T40KOvBeEKje/HoX1o7N/mT7RIgxuX12GSVUKhRqZLdNg:/JEg8T83XXWvBeEKje/HoX1o7N/mT7RH

Score

8^/10

discovery exploit

Malware Config

Signatures

Possible privilege escalation attempt 8 IoCs
exploit

Processes:

takeown.exeicacls.exetakeown.exeicacls.exetakeown.exeicacls.exetakeown.exeicacls.exe

pid process

1432 takeown.exe
1892 icacls.exe
476 takeown.exe
2292 icacls.exe
2692 takeown.exe
4272 icacls.exe
556 takeown.exe
1192 icacls.exe
Modifies file permissions 1 TTPs 8 IoCs
discovery

File Permissions Modification
T1222

Processes:

icacls.exetakeown.exeicacls.exetakeown.exeicacls.exetakeown.exeicacls.exetakeown.exe

pid process

1892 icacls.exe
476 takeown.exe
2292 icacls.exe
2692 takeown.exe
4272 icacls.exe
556 takeown.exe
1192 icacls.exe
1432 takeown.exe

pid	process
1432	takeown.exe
1892	icacls.exe
476	takeown.exe
2292	icacls.exe
2692	takeown.exe
4272	icacls.exe
556	takeown.exe
1192	icacls.exe

pid	process
1892	icacls.exe
476	takeown.exe
2292	icacls.exe
2692	takeown.exe
4272	icacls.exe
556	takeown.exe
1192	icacls.exe
1432	takeown.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

takeown.exetakeown.exetakeown.exetakeown.exe

description	pid	process
Token: SeTakeOwnershipPrivilege	476	takeown.exe
Token: SeTakeOwnershipPrivilege	556	takeown.exe
Token: SeTakeOwnershipPrivilege	2692	takeown.exe
Token: SeTakeOwnershipPrivilege	1432	takeown.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

27aa4febcedc406587a418960127412f940c712e967ba25efb35527b286a6c32.exe

pid process

5048 27aa4febcedc406587a418960127412f940c712e967ba25efb35527b286a6c32.exe

pid	process
5048	27aa4febcedc406587a418960127412f940c712e967ba25efb35527b286a6c32.exe

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

27aa4febcedc406587a418960127412f940c712e967ba25efb35527b286a6c32.exe

description	pid	process	target process
PID 5048 wrote to memory of 2692	5048	27aa4febcedc406587a418960127412f940c712e967ba25efb35527b286a6c32.exe	takeown.exe
PID 5048 wrote to memory of 2692	5048	27aa4febcedc406587a418960127412f940c712e967ba25efb35527b286a6c32.exe	takeown.exe
PID 5048 wrote to memory of 2692	5048	27aa4febcedc406587a418960127412f940c712e967ba25efb35527b286a6c32.exe	takeown.exe
PID 5048 wrote to memory of 4272	5048	27aa4febcedc406587a418960127412f940c712e967ba25efb35527b286a6c32.exe	icacls.exe
PID 5048 wrote to memory of 4272	5048	27aa4febcedc406587a418960127412f940c712e967ba25efb35527b286a6c32.exe	icacls.exe
PID 5048 wrote to memory of 4272	5048	27aa4febcedc406587a418960127412f940c712e967ba25efb35527b286a6c32.exe	icacls.exe
PID 5048 wrote to memory of 556	5048	27aa4febcedc406587a418960127412f940c712e967ba25efb35527b286a6c32.exe	takeown.exe
PID 5048 wrote to memory of 556	5048	27aa4febcedc406587a418960127412f940c712e967ba25efb35527b286a6c32.exe	takeown.exe
PID 5048 wrote to memory of 556	5048	27aa4febcedc406587a418960127412f940c712e967ba25efb35527b286a6c32.exe	takeown.exe
PID 5048 wrote to memory of 1192	5048	27aa4febcedc406587a418960127412f940c712e967ba25efb35527b286a6c32.exe	icacls.exe
PID 5048 wrote to memory of 1192	5048	27aa4febcedc406587a418960127412f940c712e967ba25efb35527b286a6c32.exe	icacls.exe
PID 5048 wrote to memory of 1192	5048	27aa4febcedc406587a418960127412f940c712e967ba25efb35527b286a6c32.exe	icacls.exe
PID 5048 wrote to memory of 1432	5048	27aa4febcedc406587a418960127412f940c712e967ba25efb35527b286a6c32.exe	takeown.exe
PID 5048 wrote to memory of 1432	5048	27aa4febcedc406587a418960127412f940c712e967ba25efb35527b286a6c32.exe	takeown.exe
PID 5048 wrote to memory of 1432	5048	27aa4febcedc406587a418960127412f940c712e967ba25efb35527b286a6c32.exe	takeown.exe
PID 5048 wrote to memory of 1892	5048	27aa4febcedc406587a418960127412f940c712e967ba25efb35527b286a6c32.exe	icacls.exe
PID 5048 wrote to memory of 1892	5048	27aa4febcedc406587a418960127412f940c712e967ba25efb35527b286a6c32.exe	icacls.exe
PID 5048 wrote to memory of 1892	5048	27aa4febcedc406587a418960127412f940c712e967ba25efb35527b286a6c32.exe	icacls.exe
PID 5048 wrote to memory of 476	5048	27aa4febcedc406587a418960127412f940c712e967ba25efb35527b286a6c32.exe	takeown.exe
PID 5048 wrote to memory of 476	5048	27aa4febcedc406587a418960127412f940c712e967ba25efb35527b286a6c32.exe	takeown.exe
PID 5048 wrote to memory of 476	5048	27aa4febcedc406587a418960127412f940c712e967ba25efb35527b286a6c32.exe	takeown.exe
PID 5048 wrote to memory of 2292	5048	27aa4febcedc406587a418960127412f940c712e967ba25efb35527b286a6c32.exe	icacls.exe
PID 5048 wrote to memory of 2292	5048	27aa4febcedc406587a418960127412f940c712e967ba25efb35527b286a6c32.exe	icacls.exe
PID 5048 wrote to memory of 2292	5048	27aa4febcedc406587a418960127412f940c712e967ba25efb35527b286a6c32.exe	icacls.exe

C:\Users\Admin\AppData\Local\Temp\27aa4febcedc406587a418960127412f940c712e967ba25efb35527b286a6c32.exe
"C:\Users\Admin\AppData\Local\Temp\27aa4febcedc406587a418960127412f940c712e967ba25efb35527b286a6c32.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5048

C:\Windows\SysWOW64\takeown.exe
C:\Windows\System32\takeown.exe /f "C:\Windows\System32\cmd.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:2692

C:\Windows\SysWOW64\icacls.exe
C:\Windows\System32\icacls.exe "C:\Windows\System32\cmd.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:4272

C:\Windows\SysWOW64\takeown.exe
C:\Windows\System32\takeown.exe /f "C:\Windows\System32\ftp.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:556

C:\Windows\SysWOW64\icacls.exe
C:\Windows\System32\icacls.exe "C:\Windows\System32\ftp.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1192

C:\Windows\SysWOW64\takeown.exe
C:\Windows\System32\takeown.exe /f "C:\Windows\System32\wscript.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:1432

C:\Windows\SysWOW64\icacls.exe
C:\Windows\System32\icacls.exe "C:\Windows\System32\wscript.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1892

C:\Windows\SysWOW64\takeown.exe
C:\Windows\System32\takeown.exe /f "C:\Windows\System32\cscript.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:476

C:\Windows\SysWOW64\icacls.exe
C:\Windows\System32\icacls.exe "C:\Windows\System32\cscript.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:2292

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File Permissions Modification

1

T1222

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/476-140-0x0000000000000000-mapping.dmp

Download
memory/556-136-0x0000000000000000-mapping.dmp

Download
memory/1192-137-0x0000000000000000-mapping.dmp

Download
memory/1432-138-0x0000000000000000-mapping.dmp

Download
memory/1892-139-0x0000000000000000-mapping.dmp

Download
memory/2292-141-0x0000000000000000-mapping.dmp

Download
memory/2692-134-0x0000000000000000-mapping.dmp

Download
memory/4272-135-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing