c9655849ba70d2aeca5ffb803e8104ae1aec5b3b1a28ed732ecec301169f1109

General

Target

c9655849ba70d2aeca5ffb803e8104ae1aec5b3b1a28ed732ecec301169f1109.exe
Size

36KB
MD5

791b1ffd2928745ab4210e0ab5ba6930
SHA1

c4b506fd4fd8d4a310887fef7a01857d9a896e8b
SHA256

c9655849ba70d2aeca5ffb803e8104ae1aec5b3b1a28ed732ecec301169f1109
SHA512

fa0d5e1b5ed743e59fbe3321560a1c235238596149b0ab3e2e8abaea480ea1fef1da2a3a83061b8ca5731420d7130b93be8806d0276615f815c64d5519593fb2
SSDEEP

768:/sk5Y9OiC3gmWbdzKWTUp9yhV7/eklaU10q8rutrwLyk5BSNQCLsOda9mfzPjJrJ:/sQSdzKWTUp9yhV7/eklX10q8rutrwL2

Score

8^/10

discovery exploit

Malware Config

Signatures

Possible privilege escalation attempt 8 IoCs
exploit

Processes:

takeown.exetakeown.exeicacls.exetakeown.exeicacls.exetakeown.exeicacls.exeicacls.exe

pid process

1468 takeown.exe
1340 takeown.exe
676 icacls.exe
996 takeown.exe
1388 icacls.exe
1628 takeown.exe
1212 icacls.exe
1296 icacls.exe
Modifies file permissions 1 TTPs 8 IoCs
discovery

File Permissions Modification
T1222

Processes:

takeown.exeicacls.exetakeown.exeicacls.exetakeown.exeicacls.exeicacls.exetakeown.exe

pid process

1340 takeown.exe
676 icacls.exe
996 takeown.exe
1388 icacls.exe
1628 takeown.exe
1212 icacls.exe
1296 icacls.exe
1468 takeown.exe

pid	process
1468	takeown.exe
1340	takeown.exe
676	icacls.exe
996	takeown.exe
1388	icacls.exe
1628	takeown.exe
1212	icacls.exe
1296	icacls.exe

pid	process
1340	takeown.exe
676	icacls.exe
996	takeown.exe
1388	icacls.exe
1628	takeown.exe
1212	icacls.exe
1296	icacls.exe
1468	takeown.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

takeown.exetakeown.exetakeown.exetakeown.exe

description	pid	process
Token: SeTakeOwnershipPrivilege	996	takeown.exe
Token: SeTakeOwnershipPrivilege	1628	takeown.exe
Token: SeTakeOwnershipPrivilege	1468	takeown.exe
Token: SeTakeOwnershipPrivilege	1340	takeown.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

c9655849ba70d2aeca5ffb803e8104ae1aec5b3b1a28ed732ecec301169f1109.exe

pid process

912 c9655849ba70d2aeca5ffb803e8104ae1aec5b3b1a28ed732ecec301169f1109.exe

pid	process
912	c9655849ba70d2aeca5ffb803e8104ae1aec5b3b1a28ed732ecec301169f1109.exe

Suspicious use of WriteProcessMemory 32 IoCs

Processes:

c9655849ba70d2aeca5ffb803e8104ae1aec5b3b1a28ed732ecec301169f1109.exe

description	pid	process	target process
PID 912 wrote to memory of 996	912	c9655849ba70d2aeca5ffb803e8104ae1aec5b3b1a28ed732ecec301169f1109.exe	takeown.exe
PID 912 wrote to memory of 996	912	c9655849ba70d2aeca5ffb803e8104ae1aec5b3b1a28ed732ecec301169f1109.exe	takeown.exe
PID 912 wrote to memory of 996	912	c9655849ba70d2aeca5ffb803e8104ae1aec5b3b1a28ed732ecec301169f1109.exe	takeown.exe
PID 912 wrote to memory of 996	912	c9655849ba70d2aeca5ffb803e8104ae1aec5b3b1a28ed732ecec301169f1109.exe	takeown.exe
PID 912 wrote to memory of 1388	912	c9655849ba70d2aeca5ffb803e8104ae1aec5b3b1a28ed732ecec301169f1109.exe	icacls.exe
PID 912 wrote to memory of 1388	912	c9655849ba70d2aeca5ffb803e8104ae1aec5b3b1a28ed732ecec301169f1109.exe	icacls.exe
PID 912 wrote to memory of 1388	912	c9655849ba70d2aeca5ffb803e8104ae1aec5b3b1a28ed732ecec301169f1109.exe	icacls.exe
PID 912 wrote to memory of 1388	912	c9655849ba70d2aeca5ffb803e8104ae1aec5b3b1a28ed732ecec301169f1109.exe	icacls.exe
PID 912 wrote to memory of 1628	912	c9655849ba70d2aeca5ffb803e8104ae1aec5b3b1a28ed732ecec301169f1109.exe	takeown.exe
PID 912 wrote to memory of 1628	912	c9655849ba70d2aeca5ffb803e8104ae1aec5b3b1a28ed732ecec301169f1109.exe	takeown.exe
PID 912 wrote to memory of 1628	912	c9655849ba70d2aeca5ffb803e8104ae1aec5b3b1a28ed732ecec301169f1109.exe	takeown.exe
PID 912 wrote to memory of 1628	912	c9655849ba70d2aeca5ffb803e8104ae1aec5b3b1a28ed732ecec301169f1109.exe	takeown.exe
PID 912 wrote to memory of 1212	912	c9655849ba70d2aeca5ffb803e8104ae1aec5b3b1a28ed732ecec301169f1109.exe	icacls.exe
PID 912 wrote to memory of 1212	912	c9655849ba70d2aeca5ffb803e8104ae1aec5b3b1a28ed732ecec301169f1109.exe	icacls.exe
PID 912 wrote to memory of 1212	912	c9655849ba70d2aeca5ffb803e8104ae1aec5b3b1a28ed732ecec301169f1109.exe	icacls.exe
PID 912 wrote to memory of 1212	912	c9655849ba70d2aeca5ffb803e8104ae1aec5b3b1a28ed732ecec301169f1109.exe	icacls.exe
PID 912 wrote to memory of 1468	912	c9655849ba70d2aeca5ffb803e8104ae1aec5b3b1a28ed732ecec301169f1109.exe	takeown.exe
PID 912 wrote to memory of 1468	912	c9655849ba70d2aeca5ffb803e8104ae1aec5b3b1a28ed732ecec301169f1109.exe	takeown.exe
PID 912 wrote to memory of 1468	912	c9655849ba70d2aeca5ffb803e8104ae1aec5b3b1a28ed732ecec301169f1109.exe	takeown.exe
PID 912 wrote to memory of 1468	912	c9655849ba70d2aeca5ffb803e8104ae1aec5b3b1a28ed732ecec301169f1109.exe	takeown.exe
PID 912 wrote to memory of 1296	912	c9655849ba70d2aeca5ffb803e8104ae1aec5b3b1a28ed732ecec301169f1109.exe	icacls.exe
PID 912 wrote to memory of 1296	912	c9655849ba70d2aeca5ffb803e8104ae1aec5b3b1a28ed732ecec301169f1109.exe	icacls.exe
PID 912 wrote to memory of 1296	912	c9655849ba70d2aeca5ffb803e8104ae1aec5b3b1a28ed732ecec301169f1109.exe	icacls.exe
PID 912 wrote to memory of 1296	912	c9655849ba70d2aeca5ffb803e8104ae1aec5b3b1a28ed732ecec301169f1109.exe	icacls.exe
PID 912 wrote to memory of 1340	912	c9655849ba70d2aeca5ffb803e8104ae1aec5b3b1a28ed732ecec301169f1109.exe	takeown.exe
PID 912 wrote to memory of 1340	912	c9655849ba70d2aeca5ffb803e8104ae1aec5b3b1a28ed732ecec301169f1109.exe	takeown.exe
PID 912 wrote to memory of 1340	912	c9655849ba70d2aeca5ffb803e8104ae1aec5b3b1a28ed732ecec301169f1109.exe	takeown.exe
PID 912 wrote to memory of 1340	912	c9655849ba70d2aeca5ffb803e8104ae1aec5b3b1a28ed732ecec301169f1109.exe	takeown.exe
PID 912 wrote to memory of 676	912	c9655849ba70d2aeca5ffb803e8104ae1aec5b3b1a28ed732ecec301169f1109.exe	icacls.exe
PID 912 wrote to memory of 676	912	c9655849ba70d2aeca5ffb803e8104ae1aec5b3b1a28ed732ecec301169f1109.exe	icacls.exe
PID 912 wrote to memory of 676	912	c9655849ba70d2aeca5ffb803e8104ae1aec5b3b1a28ed732ecec301169f1109.exe	icacls.exe
PID 912 wrote to memory of 676	912	c9655849ba70d2aeca5ffb803e8104ae1aec5b3b1a28ed732ecec301169f1109.exe	icacls.exe

C:\Users\Admin\AppData\Local\Temp\c9655849ba70d2aeca5ffb803e8104ae1aec5b3b1a28ed732ecec301169f1109.exe
"C:\Users\Admin\AppData\Local\Temp\c9655849ba70d2aeca5ffb803e8104ae1aec5b3b1a28ed732ecec301169f1109.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:912

C:\Windows\SysWOW64\takeown.exe
C:\Windows\System32\takeown.exe /f "C:\Windows\System32\cmd.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:996

C:\Windows\SysWOW64\icacls.exe
C:\Windows\System32\icacls.exe "C:\Windows\System32\cmd.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1388

C:\Windows\SysWOW64\takeown.exe
C:\Windows\System32\takeown.exe /f "C:\Windows\System32\ftp.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:1628

C:\Windows\SysWOW64\icacls.exe
C:\Windows\System32\icacls.exe "C:\Windows\System32\ftp.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1212

C:\Windows\SysWOW64\icacls.exe
C:\Windows\System32\icacls.exe "C:\Windows\System32\wscript.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1296

C:\Windows\SysWOW64\takeown.exe
C:\Windows\System32\takeown.exe /f "C:\Windows\System32\wscript.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:1468

C:\Windows\SysWOW64\takeown.exe
C:\Windows\System32\takeown.exe /f "C:\Windows\System32\cscript.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:1340

C:\Windows\SysWOW64\icacls.exe
C:\Windows\System32\icacls.exe "C:\Windows\System32\cscript.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:676

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File Permissions Modification

1

T1222

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/676-63-0x0000000000000000-mapping.dmp

Download
memory/996-56-0x0000000000000000-mapping.dmp

Download
memory/1212-59-0x0000000000000000-mapping.dmp

Download
memory/1296-61-0x0000000000000000-mapping.dmp

Download
memory/1340-62-0x0000000000000000-mapping.dmp

Download
memory/1388-57-0x0000000000000000-mapping.dmp

Download
memory/1468-60-0x0000000000000000-mapping.dmp

Download
memory/1628-58-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing