c9655849ba70d2aeca5ffb803e8104ae1aec5b3b1a28ed732ecec301169f1109

General

Target

c9655849ba70d2aeca5ffb803e8104ae1aec5b3b1a28ed732ecec301169f1109.exe
Size

36KB
MD5

791b1ffd2928745ab4210e0ab5ba6930
SHA1

c4b506fd4fd8d4a310887fef7a01857d9a896e8b
SHA256

c9655849ba70d2aeca5ffb803e8104ae1aec5b3b1a28ed732ecec301169f1109
SHA512

fa0d5e1b5ed743e59fbe3321560a1c235238596149b0ab3e2e8abaea480ea1fef1da2a3a83061b8ca5731420d7130b93be8806d0276615f815c64d5519593fb2
SSDEEP

768:/sk5Y9OiC3gmWbdzKWTUp9yhV7/eklaU10q8rutrwLyk5BSNQCLsOda9mfzPjJrJ:/sQSdzKWTUp9yhV7/eklX10q8rutrwL2

Score

8^/10

discovery exploit

Malware Config

Signatures

Possible privilege escalation attempt 8 IoCs
exploit

Processes:

takeown.exeicacls.exetakeown.exeicacls.exetakeown.exeicacls.exetakeown.exeicacls.exe

pid process

1644 takeown.exe
1240 icacls.exe
2296 takeown.exe
368 icacls.exe
1628 takeown.exe
1848 icacls.exe
2664 takeown.exe
1864 icacls.exe
Modifies file permissions 1 TTPs 8 IoCs
discovery

File Permissions Modification
T1222

Processes:

takeown.exeicacls.exetakeown.exeicacls.exetakeown.exeicacls.exetakeown.exeicacls.exe

pid process

2296 takeown.exe
368 icacls.exe
1628 takeown.exe
1848 icacls.exe
2664 takeown.exe
1864 icacls.exe
1644 takeown.exe
1240 icacls.exe

pid	process
1644	takeown.exe
1240	icacls.exe
2296	takeown.exe
368	icacls.exe
1628	takeown.exe
1848	icacls.exe
2664	takeown.exe
1864	icacls.exe

pid	process
2296	takeown.exe
368	icacls.exe
1628	takeown.exe
1848	icacls.exe
2664	takeown.exe
1864	icacls.exe
1644	takeown.exe
1240	icacls.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

takeown.exetakeown.exetakeown.exetakeown.exe

description	pid	process
Token: SeTakeOwnershipPrivilege	2296	takeown.exe
Token: SeTakeOwnershipPrivilege	1644	takeown.exe
Token: SeTakeOwnershipPrivilege	2664	takeown.exe
Token: SeTakeOwnershipPrivilege	1628	takeown.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

c9655849ba70d2aeca5ffb803e8104ae1aec5b3b1a28ed732ecec301169f1109.exe

pid process

4796 c9655849ba70d2aeca5ffb803e8104ae1aec5b3b1a28ed732ecec301169f1109.exe

pid	process
4796	c9655849ba70d2aeca5ffb803e8104ae1aec5b3b1a28ed732ecec301169f1109.exe

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

c9655849ba70d2aeca5ffb803e8104ae1aec5b3b1a28ed732ecec301169f1109.exe

description	pid	process	target process
PID 4796 wrote to memory of 1628	4796	c9655849ba70d2aeca5ffb803e8104ae1aec5b3b1a28ed732ecec301169f1109.exe	takeown.exe
PID 4796 wrote to memory of 1628	4796	c9655849ba70d2aeca5ffb803e8104ae1aec5b3b1a28ed732ecec301169f1109.exe	takeown.exe
PID 4796 wrote to memory of 1628	4796	c9655849ba70d2aeca5ffb803e8104ae1aec5b3b1a28ed732ecec301169f1109.exe	takeown.exe
PID 4796 wrote to memory of 1848	4796	c9655849ba70d2aeca5ffb803e8104ae1aec5b3b1a28ed732ecec301169f1109.exe	icacls.exe
PID 4796 wrote to memory of 1848	4796	c9655849ba70d2aeca5ffb803e8104ae1aec5b3b1a28ed732ecec301169f1109.exe	icacls.exe
PID 4796 wrote to memory of 1848	4796	c9655849ba70d2aeca5ffb803e8104ae1aec5b3b1a28ed732ecec301169f1109.exe	icacls.exe
PID 4796 wrote to memory of 2664	4796	c9655849ba70d2aeca5ffb803e8104ae1aec5b3b1a28ed732ecec301169f1109.exe	takeown.exe
PID 4796 wrote to memory of 2664	4796	c9655849ba70d2aeca5ffb803e8104ae1aec5b3b1a28ed732ecec301169f1109.exe	takeown.exe
PID 4796 wrote to memory of 2664	4796	c9655849ba70d2aeca5ffb803e8104ae1aec5b3b1a28ed732ecec301169f1109.exe	takeown.exe
PID 4796 wrote to memory of 1864	4796	c9655849ba70d2aeca5ffb803e8104ae1aec5b3b1a28ed732ecec301169f1109.exe	icacls.exe
PID 4796 wrote to memory of 1864	4796	c9655849ba70d2aeca5ffb803e8104ae1aec5b3b1a28ed732ecec301169f1109.exe	icacls.exe
PID 4796 wrote to memory of 1864	4796	c9655849ba70d2aeca5ffb803e8104ae1aec5b3b1a28ed732ecec301169f1109.exe	icacls.exe
PID 4796 wrote to memory of 1644	4796	c9655849ba70d2aeca5ffb803e8104ae1aec5b3b1a28ed732ecec301169f1109.exe	takeown.exe
PID 4796 wrote to memory of 1644	4796	c9655849ba70d2aeca5ffb803e8104ae1aec5b3b1a28ed732ecec301169f1109.exe	takeown.exe
PID 4796 wrote to memory of 1644	4796	c9655849ba70d2aeca5ffb803e8104ae1aec5b3b1a28ed732ecec301169f1109.exe	takeown.exe
PID 4796 wrote to memory of 1240	4796	c9655849ba70d2aeca5ffb803e8104ae1aec5b3b1a28ed732ecec301169f1109.exe	icacls.exe
PID 4796 wrote to memory of 1240	4796	c9655849ba70d2aeca5ffb803e8104ae1aec5b3b1a28ed732ecec301169f1109.exe	icacls.exe
PID 4796 wrote to memory of 1240	4796	c9655849ba70d2aeca5ffb803e8104ae1aec5b3b1a28ed732ecec301169f1109.exe	icacls.exe
PID 4796 wrote to memory of 2296	4796	c9655849ba70d2aeca5ffb803e8104ae1aec5b3b1a28ed732ecec301169f1109.exe	takeown.exe
PID 4796 wrote to memory of 2296	4796	c9655849ba70d2aeca5ffb803e8104ae1aec5b3b1a28ed732ecec301169f1109.exe	takeown.exe
PID 4796 wrote to memory of 2296	4796	c9655849ba70d2aeca5ffb803e8104ae1aec5b3b1a28ed732ecec301169f1109.exe	takeown.exe
PID 4796 wrote to memory of 368	4796	c9655849ba70d2aeca5ffb803e8104ae1aec5b3b1a28ed732ecec301169f1109.exe	icacls.exe
PID 4796 wrote to memory of 368	4796	c9655849ba70d2aeca5ffb803e8104ae1aec5b3b1a28ed732ecec301169f1109.exe	icacls.exe
PID 4796 wrote to memory of 368	4796	c9655849ba70d2aeca5ffb803e8104ae1aec5b3b1a28ed732ecec301169f1109.exe	icacls.exe

C:\Users\Admin\AppData\Local\Temp\c9655849ba70d2aeca5ffb803e8104ae1aec5b3b1a28ed732ecec301169f1109.exe
"C:\Users\Admin\AppData\Local\Temp\c9655849ba70d2aeca5ffb803e8104ae1aec5b3b1a28ed732ecec301169f1109.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4796

C:\Windows\SysWOW64\takeown.exe
C:\Windows\System32\takeown.exe /f "C:\Windows\System32\cmd.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:1628

C:\Windows\SysWOW64\icacls.exe
C:\Windows\System32\icacls.exe "C:\Windows\System32\cmd.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1848

C:\Windows\SysWOW64\takeown.exe
C:\Windows\System32\takeown.exe /f "C:\Windows\System32\ftp.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:2664

C:\Windows\SysWOW64\icacls.exe
C:\Windows\System32\icacls.exe "C:\Windows\System32\ftp.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1864

C:\Windows\SysWOW64\takeown.exe
C:\Windows\System32\takeown.exe /f "C:\Windows\System32\wscript.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:1644

C:\Windows\SysWOW64\icacls.exe
C:\Windows\System32\icacls.exe "C:\Windows\System32\wscript.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1240

C:\Windows\SysWOW64\takeown.exe
C:\Windows\System32\takeown.exe /f "C:\Windows\System32\cscript.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:2296

C:\Windows\SysWOW64\icacls.exe
C:\Windows\System32\icacls.exe "C:\Windows\System32\cscript.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:368

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File Permissions Modification

1

T1222

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/368-141-0x0000000000000000-mapping.dmp

Download
memory/1240-139-0x0000000000000000-mapping.dmp

Download
memory/1628-134-0x0000000000000000-mapping.dmp

Download
memory/1644-138-0x0000000000000000-mapping.dmp

Download
memory/1848-135-0x0000000000000000-mapping.dmp

Download
memory/1864-137-0x0000000000000000-mapping.dmp

Download
memory/2296-140-0x0000000000000000-mapping.dmp

Download
memory/2664-136-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing