6a841320e49a1bff94ef9ad4f84f4a7f362b3b6ffc291ad235b5595f5d080e5c

General

Target

6a841320e49a1bff94ef9ad4f84f4a7f362b3b6ffc291ad235b5595f5d080e5c.exe
Size

60KB
MD5

012c494a688a1391575c07c248fa3670
SHA1

26f1a39284707afdd67d694e4cdaf6aa63067554
SHA256

6a841320e49a1bff94ef9ad4f84f4a7f362b3b6ffc291ad235b5595f5d080e5c
SHA512

feb1086a25290a00fc69f11781a4bb728bb99d07030f0127ccb19d7b22a906be993077d37eb8e6902b0fd90d289dcb2ad6e3a28c25e6a9b7f198f693435770cd
SSDEEP

768:rldDMoa080pMVxmAqEtlYav31/rjFYekDY0PtpXF3jaqz/Nd8GZcl:rldDMI3VEnYav3DsE2tRz/Ntcl

Score

8^/10

discovery exploit

Malware Config

Signatures

Possible privilege escalation attempt 14 IoCs

exploit

Processes:

takeown.exeicacls.exeicacls.exeicacls.exeicacls.exetakeown.exeicacls.exetakeown.exeicacls.exetakeown.exeicacls.exeicacls.exeicacls.exetakeown.exe

pid	process
4256	takeown.exe
3056	icacls.exe
3752	icacls.exe
5076	icacls.exe
3676	icacls.exe
364	takeown.exe
996	icacls.exe
904	takeown.exe
3716	icacls.exe
4552	takeown.exe
4248	icacls.exe
4800	icacls.exe
3020	icacls.exe
2072	takeown.exe

Modifies file permissions 1 TTPs 14 IoCs

discovery

File Permissions Modification

T1222

Processes:

icacls.exeicacls.exeicacls.exeicacls.exetakeown.exetakeown.exeicacls.exetakeown.exeicacls.exetakeown.exeicacls.exetakeown.exeicacls.exeicacls.exe

pid	process
4800	icacls.exe
996	icacls.exe
3716	icacls.exe
4248	icacls.exe
4256	takeown.exe
904	takeown.exe
3056	icacls.exe
4552	takeown.exe
3752	icacls.exe
364	takeown.exe
5076	icacls.exe
2072	takeown.exe
3020	icacls.exe
3676	icacls.exe

Drops file in System32 directory 6 IoCs

Processes:

6a841320e49a1bff94ef9ad4f84f4a7f362b3b6ffc291ad235b5595f5d080e5c.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\ftp.exe	6a841320e49a1bff94ef9ad4f84f4a7f362b3b6ffc291ad235b5595f5d080e5c.exe
File opened for modification	C:\Windows\SysWOW64\wscript.exe	6a841320e49a1bff94ef9ad4f84f4a7f362b3b6ffc291ad235b5595f5d080e5c.exe
File opened for modification	C:\Windows\SysWOW64\cscript.exe	6a841320e49a1bff94ef9ad4f84f4a7f362b3b6ffc291ad235b5595f5d080e5c.exe
File created	\??\c:\windows\SysWOW64\kubi.exe	6a841320e49a1bff94ef9ad4f84f4a7f362b3b6ffc291ad235b5595f5d080e5c.exe
File opened for modification	\??\c:\windows\SysWOW64\kubi.exe	6a841320e49a1bff94ef9ad4f84f4a7f362b3b6ffc291ad235b5595f5d080e5c.exe
File opened for modification	C:\Windows\SysWOW64\cmd.exe	6a841320e49a1bff94ef9ad4f84f4a7f362b3b6ffc291ad235b5595f5d080e5c.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

takeown.exetakeown.exetakeown.exetakeown.exe

description	pid	process
Token: SeTakeOwnershipPrivilege	4256	takeown.exe
Token: SeTakeOwnershipPrivilege	2072	takeown.exe
Token: SeTakeOwnershipPrivilege	904	takeown.exe
Token: SeTakeOwnershipPrivilege	4552	takeown.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

6a841320e49a1bff94ef9ad4f84f4a7f362b3b6ffc291ad235b5595f5d080e5c.exe

pid process

1340 6a841320e49a1bff94ef9ad4f84f4a7f362b3b6ffc291ad235b5595f5d080e5c.exe

pid	process
1340	6a841320e49a1bff94ef9ad4f84f4a7f362b3b6ffc291ad235b5595f5d080e5c.exe

Suspicious use of WriteProcessMemory 42 IoCs

Processes:

6a841320e49a1bff94ef9ad4f84f4a7f362b3b6ffc291ad235b5595f5d080e5c.exe

description	pid	process	target process
PID 1340 wrote to memory of 364	1340	6a841320e49a1bff94ef9ad4f84f4a7f362b3b6ffc291ad235b5595f5d080e5c.exe	takeown.exe
PID 1340 wrote to memory of 364	1340	6a841320e49a1bff94ef9ad4f84f4a7f362b3b6ffc291ad235b5595f5d080e5c.exe	takeown.exe
PID 1340 wrote to memory of 364	1340	6a841320e49a1bff94ef9ad4f84f4a7f362b3b6ffc291ad235b5595f5d080e5c.exe	takeown.exe
PID 1340 wrote to memory of 5076	1340	6a841320e49a1bff94ef9ad4f84f4a7f362b3b6ffc291ad235b5595f5d080e5c.exe	icacls.exe
PID 1340 wrote to memory of 5076	1340	6a841320e49a1bff94ef9ad4f84f4a7f362b3b6ffc291ad235b5595f5d080e5c.exe	icacls.exe
PID 1340 wrote to memory of 5076	1340	6a841320e49a1bff94ef9ad4f84f4a7f362b3b6ffc291ad235b5595f5d080e5c.exe	icacls.exe
PID 1340 wrote to memory of 4256	1340	6a841320e49a1bff94ef9ad4f84f4a7f362b3b6ffc291ad235b5595f5d080e5c.exe	takeown.exe
PID 1340 wrote to memory of 4256	1340	6a841320e49a1bff94ef9ad4f84f4a7f362b3b6ffc291ad235b5595f5d080e5c.exe	takeown.exe
PID 1340 wrote to memory of 4256	1340	6a841320e49a1bff94ef9ad4f84f4a7f362b3b6ffc291ad235b5595f5d080e5c.exe	takeown.exe
PID 1340 wrote to memory of 4800	1340	6a841320e49a1bff94ef9ad4f84f4a7f362b3b6ffc291ad235b5595f5d080e5c.exe	icacls.exe
PID 1340 wrote to memory of 4800	1340	6a841320e49a1bff94ef9ad4f84f4a7f362b3b6ffc291ad235b5595f5d080e5c.exe	icacls.exe
PID 1340 wrote to memory of 4800	1340	6a841320e49a1bff94ef9ad4f84f4a7f362b3b6ffc291ad235b5595f5d080e5c.exe	icacls.exe
PID 1340 wrote to memory of 3056	1340	6a841320e49a1bff94ef9ad4f84f4a7f362b3b6ffc291ad235b5595f5d080e5c.exe	icacls.exe
PID 1340 wrote to memory of 3056	1340	6a841320e49a1bff94ef9ad4f84f4a7f362b3b6ffc291ad235b5595f5d080e5c.exe	icacls.exe
PID 1340 wrote to memory of 3056	1340	6a841320e49a1bff94ef9ad4f84f4a7f362b3b6ffc291ad235b5595f5d080e5c.exe	icacls.exe
PID 1340 wrote to memory of 2072	1340	6a841320e49a1bff94ef9ad4f84f4a7f362b3b6ffc291ad235b5595f5d080e5c.exe	takeown.exe
PID 1340 wrote to memory of 2072	1340	6a841320e49a1bff94ef9ad4f84f4a7f362b3b6ffc291ad235b5595f5d080e5c.exe	takeown.exe
PID 1340 wrote to memory of 2072	1340	6a841320e49a1bff94ef9ad4f84f4a7f362b3b6ffc291ad235b5595f5d080e5c.exe	takeown.exe
PID 1340 wrote to memory of 996	1340	6a841320e49a1bff94ef9ad4f84f4a7f362b3b6ffc291ad235b5595f5d080e5c.exe	icacls.exe
PID 1340 wrote to memory of 996	1340	6a841320e49a1bff94ef9ad4f84f4a7f362b3b6ffc291ad235b5595f5d080e5c.exe	icacls.exe
PID 1340 wrote to memory of 996	1340	6a841320e49a1bff94ef9ad4f84f4a7f362b3b6ffc291ad235b5595f5d080e5c.exe	icacls.exe
PID 1340 wrote to memory of 3020	1340	6a841320e49a1bff94ef9ad4f84f4a7f362b3b6ffc291ad235b5595f5d080e5c.exe	icacls.exe
PID 1340 wrote to memory of 3020	1340	6a841320e49a1bff94ef9ad4f84f4a7f362b3b6ffc291ad235b5595f5d080e5c.exe	icacls.exe
PID 1340 wrote to memory of 3020	1340	6a841320e49a1bff94ef9ad4f84f4a7f362b3b6ffc291ad235b5595f5d080e5c.exe	icacls.exe
PID 1340 wrote to memory of 904	1340	6a841320e49a1bff94ef9ad4f84f4a7f362b3b6ffc291ad235b5595f5d080e5c.exe	takeown.exe
PID 1340 wrote to memory of 904	1340	6a841320e49a1bff94ef9ad4f84f4a7f362b3b6ffc291ad235b5595f5d080e5c.exe	takeown.exe
PID 1340 wrote to memory of 904	1340	6a841320e49a1bff94ef9ad4f84f4a7f362b3b6ffc291ad235b5595f5d080e5c.exe	takeown.exe
PID 1340 wrote to memory of 3676	1340	6a841320e49a1bff94ef9ad4f84f4a7f362b3b6ffc291ad235b5595f5d080e5c.exe	icacls.exe
PID 1340 wrote to memory of 3676	1340	6a841320e49a1bff94ef9ad4f84f4a7f362b3b6ffc291ad235b5595f5d080e5c.exe	icacls.exe
PID 1340 wrote to memory of 3676	1340	6a841320e49a1bff94ef9ad4f84f4a7f362b3b6ffc291ad235b5595f5d080e5c.exe	icacls.exe
PID 1340 wrote to memory of 3716	1340	6a841320e49a1bff94ef9ad4f84f4a7f362b3b6ffc291ad235b5595f5d080e5c.exe	icacls.exe
PID 1340 wrote to memory of 3716	1340	6a841320e49a1bff94ef9ad4f84f4a7f362b3b6ffc291ad235b5595f5d080e5c.exe	icacls.exe
PID 1340 wrote to memory of 3716	1340	6a841320e49a1bff94ef9ad4f84f4a7f362b3b6ffc291ad235b5595f5d080e5c.exe	icacls.exe
PID 1340 wrote to memory of 4552	1340	6a841320e49a1bff94ef9ad4f84f4a7f362b3b6ffc291ad235b5595f5d080e5c.exe	takeown.exe
PID 1340 wrote to memory of 4552	1340	6a841320e49a1bff94ef9ad4f84f4a7f362b3b6ffc291ad235b5595f5d080e5c.exe	takeown.exe
PID 1340 wrote to memory of 4552	1340	6a841320e49a1bff94ef9ad4f84f4a7f362b3b6ffc291ad235b5595f5d080e5c.exe	takeown.exe
PID 1340 wrote to memory of 3752	1340	6a841320e49a1bff94ef9ad4f84f4a7f362b3b6ffc291ad235b5595f5d080e5c.exe	icacls.exe
PID 1340 wrote to memory of 3752	1340	6a841320e49a1bff94ef9ad4f84f4a7f362b3b6ffc291ad235b5595f5d080e5c.exe	icacls.exe
PID 1340 wrote to memory of 3752	1340	6a841320e49a1bff94ef9ad4f84f4a7f362b3b6ffc291ad235b5595f5d080e5c.exe	icacls.exe
PID 1340 wrote to memory of 4248	1340	6a841320e49a1bff94ef9ad4f84f4a7f362b3b6ffc291ad235b5595f5d080e5c.exe	icacls.exe
PID 1340 wrote to memory of 4248	1340	6a841320e49a1bff94ef9ad4f84f4a7f362b3b6ffc291ad235b5595f5d080e5c.exe	icacls.exe
PID 1340 wrote to memory of 4248	1340	6a841320e49a1bff94ef9ad4f84f4a7f362b3b6ffc291ad235b5595f5d080e5c.exe	icacls.exe

C:\Users\Admin\AppData\Local\Temp\6a841320e49a1bff94ef9ad4f84f4a7f362b3b6ffc291ad235b5595f5d080e5c.exe
"C:\Users\Admin\AppData\Local\Temp\6a841320e49a1bff94ef9ad4f84f4a7f362b3b6ffc291ad235b5595f5d080e5c.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1340

C:\Windows\SysWOW64\takeown.exe
C:\Windows\system32\takeown.exe /f "c:\windows\system32\kubi.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:364

C:\Windows\SysWOW64\icacls.exe
C:\Windows\system32\icacls.exe "c:\windows\system32\kubi.exe" /grant SYSTEM:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:5076

C:\Windows\SysWOW64\takeown.exe
C:\Windows\system32\takeown.exe /f "C:\Windows\System32\cmd.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:4256

C:\Windows\SysWOW64\icacls.exe
C:\Windows\system32\icacls.exe "C:\Windows\System32\cmd.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:3056

C:\Windows\SysWOW64\icacls.exe
C:\Windows\system32\icacls.exe "C:\Windows\System32\cmd.exe" /grant SYSTEM:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:4800

C:\Windows\SysWOW64\takeown.exe
C:\Windows\system32\takeown.exe /f "C:\Windows\System32\ftp.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:2072

C:\Windows\SysWOW64\icacls.exe
C:\Windows\system32\icacls.exe "C:\Windows\System32\ftp.exe" /grant SYSTEM:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:996

C:\Windows\SysWOW64\icacls.exe
C:\Windows\system32\icacls.exe "C:\Windows\System32\ftp.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:3020

C:\Windows\SysWOW64\takeown.exe
C:\Windows\system32\takeown.exe /f "C:\Windows\System32\wscript.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:904

C:\Windows\SysWOW64\icacls.exe
C:\Windows\system32\icacls.exe "C:\Windows\System32\wscript.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:3716

C:\Windows\SysWOW64\icacls.exe
C:\Windows\system32\icacls.exe "C:\Windows\System32\wscript.exe" /grant SYSTEM:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:3676

C:\Windows\SysWOW64\takeown.exe
C:\Windows\system32\takeown.exe /f "C:\Windows\System32\cscript.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:4552

C:\Windows\SysWOW64\icacls.exe
C:\Windows\system32\icacls.exe "C:\Windows\System32\cscript.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:4248

C:\Windows\SysWOW64\icacls.exe
C:\Windows\system32\icacls.exe "C:\Windows\System32\cscript.exe" /grant SYSTEM:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:3752

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File Permissions Modification

1

T1222

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\??\c:\windows\SysWOW64\kubi.exe
Filesize
60KB

MD5
012c494a688a1391575c07c248fa3670

SHA1
26f1a39284707afdd67d694e4cdaf6aa63067554

SHA256
6a841320e49a1bff94ef9ad4f84f4a7f362b3b6ffc291ad235b5595f5d080e5c

SHA512
feb1086a25290a00fc69f11781a4bb728bb99d07030f0127ccb19d7b22a906be993077d37eb8e6902b0fd90d289dcb2ad6e3a28c25e6a9b7f198f693435770cd

Download Submit
memory/364-134-0x0000000000000000-mapping.dmp

Download
memory/904-143-0x0000000000000000-mapping.dmp

Download
memory/996-141-0x0000000000000000-mapping.dmp

Download
memory/2072-140-0x0000000000000000-mapping.dmp

Download
memory/3020-142-0x0000000000000000-mapping.dmp

Download
memory/3056-139-0x0000000000000000-mapping.dmp

Download
memory/3676-144-0x0000000000000000-mapping.dmp

Download
memory/3716-145-0x0000000000000000-mapping.dmp

Download
memory/3752-147-0x0000000000000000-mapping.dmp

Download
memory/4248-148-0x0000000000000000-mapping.dmp

Download
memory/4256-137-0x0000000000000000-mapping.dmp

Download
memory/4552-146-0x0000000000000000-mapping.dmp

Download
memory/4800-138-0x0000000000000000-mapping.dmp

Download
memory/5076-135-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads