34176114591f9e3bd6da6ed9f52b4eda80e3c2fc1bbd9d30ec94cdb0ef807165

General

Target

34176114591f9e3bd6da6ed9f52b4eda80e3c2fc1bbd9d30ec94cdb0ef807165.exe
Size

36KB
MD5

67afa9afdf9f97902c310bcc7236e9b0
SHA1

184db2eab50767513ead595e740c42258edbad91
SHA256

34176114591f9e3bd6da6ed9f52b4eda80e3c2fc1bbd9d30ec94cdb0ef807165
SHA512

bbaff8627ec28b11e36ace8680fc60ee78c93d0be9da5b82bee75fa668f9b088a00925c021bd3fd080990717b079e96b9c422fccc7e0314d391d8e4658d51906
SSDEEP

768:/XjTph/LX37cOx4b0d+Mf2IpQ0+R+r8SxYsLXdj4J5L97B3ux8AhrVLPgbxNaofH:/Xjv/Ln73SMf2IpQ0+R+r8SxYsLXdj4P

Score

8^/10

discovery exploit

Malware Config

Signatures

Possible privilege escalation attempt 8 IoCs
exploit

Processes:

takeown.exeicacls.exetakeown.exeicacls.exetakeown.exeicacls.exetakeown.exeicacls.exe

pid process

588 takeown.exe
1984 icacls.exe
1828 takeown.exe
1120 icacls.exe
1992 takeown.exe
2012 icacls.exe
1208 takeown.exe
1724 icacls.exe
Modifies file permissions 1 TTPs 8 IoCs
discovery

File Permissions Modification
T1222

Processes:

icacls.exetakeown.exeicacls.exetakeown.exeicacls.exetakeown.exeicacls.exetakeown.exe

pid process

2012 icacls.exe
1208 takeown.exe
1724 icacls.exe
588 takeown.exe
1984 icacls.exe
1828 takeown.exe
1120 icacls.exe
1992 takeown.exe

pid	process
588	takeown.exe
1984	icacls.exe
1828	takeown.exe
1120	icacls.exe
1992	takeown.exe
2012	icacls.exe
1208	takeown.exe
1724	icacls.exe

pid	process
2012	icacls.exe
1208	takeown.exe
1724	icacls.exe
588	takeown.exe
1984	icacls.exe
1828	takeown.exe
1120	icacls.exe
1992	takeown.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

takeown.exetakeown.exetakeown.exetakeown.exe

description	pid	process
Token: SeTakeOwnershipPrivilege	1992	takeown.exe
Token: SeTakeOwnershipPrivilege	1208	takeown.exe
Token: SeTakeOwnershipPrivilege	1828	takeown.exe
Token: SeTakeOwnershipPrivilege	588	takeown.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

34176114591f9e3bd6da6ed9f52b4eda80e3c2fc1bbd9d30ec94cdb0ef807165.exe

pid process

1932 34176114591f9e3bd6da6ed9f52b4eda80e3c2fc1bbd9d30ec94cdb0ef807165.exe

pid	process
1932	34176114591f9e3bd6da6ed9f52b4eda80e3c2fc1bbd9d30ec94cdb0ef807165.exe

Suspicious use of WriteProcessMemory 32 IoCs

Processes:

34176114591f9e3bd6da6ed9f52b4eda80e3c2fc1bbd9d30ec94cdb0ef807165.exe

description	pid	process	target process
PID 1932 wrote to memory of 1828	1932	34176114591f9e3bd6da6ed9f52b4eda80e3c2fc1bbd9d30ec94cdb0ef807165.exe	takeown.exe
PID 1932 wrote to memory of 1828	1932	34176114591f9e3bd6da6ed9f52b4eda80e3c2fc1bbd9d30ec94cdb0ef807165.exe	takeown.exe
PID 1932 wrote to memory of 1828	1932	34176114591f9e3bd6da6ed9f52b4eda80e3c2fc1bbd9d30ec94cdb0ef807165.exe	takeown.exe
PID 1932 wrote to memory of 1828	1932	34176114591f9e3bd6da6ed9f52b4eda80e3c2fc1bbd9d30ec94cdb0ef807165.exe	takeown.exe
PID 1932 wrote to memory of 1120	1932	34176114591f9e3bd6da6ed9f52b4eda80e3c2fc1bbd9d30ec94cdb0ef807165.exe	icacls.exe
PID 1932 wrote to memory of 1120	1932	34176114591f9e3bd6da6ed9f52b4eda80e3c2fc1bbd9d30ec94cdb0ef807165.exe	icacls.exe
PID 1932 wrote to memory of 1120	1932	34176114591f9e3bd6da6ed9f52b4eda80e3c2fc1bbd9d30ec94cdb0ef807165.exe	icacls.exe
PID 1932 wrote to memory of 1120	1932	34176114591f9e3bd6da6ed9f52b4eda80e3c2fc1bbd9d30ec94cdb0ef807165.exe	icacls.exe
PID 1932 wrote to memory of 1992	1932	34176114591f9e3bd6da6ed9f52b4eda80e3c2fc1bbd9d30ec94cdb0ef807165.exe	takeown.exe
PID 1932 wrote to memory of 1992	1932	34176114591f9e3bd6da6ed9f52b4eda80e3c2fc1bbd9d30ec94cdb0ef807165.exe	takeown.exe
PID 1932 wrote to memory of 1992	1932	34176114591f9e3bd6da6ed9f52b4eda80e3c2fc1bbd9d30ec94cdb0ef807165.exe	takeown.exe
PID 1932 wrote to memory of 1992	1932	34176114591f9e3bd6da6ed9f52b4eda80e3c2fc1bbd9d30ec94cdb0ef807165.exe	takeown.exe
PID 1932 wrote to memory of 2012	1932	34176114591f9e3bd6da6ed9f52b4eda80e3c2fc1bbd9d30ec94cdb0ef807165.exe	icacls.exe
PID 1932 wrote to memory of 2012	1932	34176114591f9e3bd6da6ed9f52b4eda80e3c2fc1bbd9d30ec94cdb0ef807165.exe	icacls.exe
PID 1932 wrote to memory of 2012	1932	34176114591f9e3bd6da6ed9f52b4eda80e3c2fc1bbd9d30ec94cdb0ef807165.exe	icacls.exe
PID 1932 wrote to memory of 2012	1932	34176114591f9e3bd6da6ed9f52b4eda80e3c2fc1bbd9d30ec94cdb0ef807165.exe	icacls.exe
PID 1932 wrote to memory of 1208	1932	34176114591f9e3bd6da6ed9f52b4eda80e3c2fc1bbd9d30ec94cdb0ef807165.exe	takeown.exe
PID 1932 wrote to memory of 1208	1932	34176114591f9e3bd6da6ed9f52b4eda80e3c2fc1bbd9d30ec94cdb0ef807165.exe	takeown.exe
PID 1932 wrote to memory of 1208	1932	34176114591f9e3bd6da6ed9f52b4eda80e3c2fc1bbd9d30ec94cdb0ef807165.exe	takeown.exe
PID 1932 wrote to memory of 1208	1932	34176114591f9e3bd6da6ed9f52b4eda80e3c2fc1bbd9d30ec94cdb0ef807165.exe	takeown.exe
PID 1932 wrote to memory of 1724	1932	34176114591f9e3bd6da6ed9f52b4eda80e3c2fc1bbd9d30ec94cdb0ef807165.exe	icacls.exe
PID 1932 wrote to memory of 1724	1932	34176114591f9e3bd6da6ed9f52b4eda80e3c2fc1bbd9d30ec94cdb0ef807165.exe	icacls.exe
PID 1932 wrote to memory of 1724	1932	34176114591f9e3bd6da6ed9f52b4eda80e3c2fc1bbd9d30ec94cdb0ef807165.exe	icacls.exe
PID 1932 wrote to memory of 1724	1932	34176114591f9e3bd6da6ed9f52b4eda80e3c2fc1bbd9d30ec94cdb0ef807165.exe	icacls.exe
PID 1932 wrote to memory of 588	1932	34176114591f9e3bd6da6ed9f52b4eda80e3c2fc1bbd9d30ec94cdb0ef807165.exe	takeown.exe
PID 1932 wrote to memory of 588	1932	34176114591f9e3bd6da6ed9f52b4eda80e3c2fc1bbd9d30ec94cdb0ef807165.exe	takeown.exe
PID 1932 wrote to memory of 588	1932	34176114591f9e3bd6da6ed9f52b4eda80e3c2fc1bbd9d30ec94cdb0ef807165.exe	takeown.exe
PID 1932 wrote to memory of 588	1932	34176114591f9e3bd6da6ed9f52b4eda80e3c2fc1bbd9d30ec94cdb0ef807165.exe	takeown.exe
PID 1932 wrote to memory of 1984	1932	34176114591f9e3bd6da6ed9f52b4eda80e3c2fc1bbd9d30ec94cdb0ef807165.exe	icacls.exe
PID 1932 wrote to memory of 1984	1932	34176114591f9e3bd6da6ed9f52b4eda80e3c2fc1bbd9d30ec94cdb0ef807165.exe	icacls.exe
PID 1932 wrote to memory of 1984	1932	34176114591f9e3bd6da6ed9f52b4eda80e3c2fc1bbd9d30ec94cdb0ef807165.exe	icacls.exe
PID 1932 wrote to memory of 1984	1932	34176114591f9e3bd6da6ed9f52b4eda80e3c2fc1bbd9d30ec94cdb0ef807165.exe	icacls.exe

C:\Users\Admin\AppData\Local\Temp\34176114591f9e3bd6da6ed9f52b4eda80e3c2fc1bbd9d30ec94cdb0ef807165.exe
"C:\Users\Admin\AppData\Local\Temp\34176114591f9e3bd6da6ed9f52b4eda80e3c2fc1bbd9d30ec94cdb0ef807165.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1932

C:\Windows\SysWOW64\takeown.exe
C:\Windows\System32\takeown.exe /f "C:\Windows\System32\cmd.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:1828

C:\Windows\SysWOW64\icacls.exe
C:\Windows\System32\icacls.exe "C:\Windows\System32\cmd.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1120

C:\Windows\SysWOW64\takeown.exe
C:\Windows\System32\takeown.exe /f "C:\Windows\System32\ftp.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:1992

C:\Windows\SysWOW64\icacls.exe
C:\Windows\System32\icacls.exe "C:\Windows\System32\ftp.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:2012

C:\Windows\SysWOW64\takeown.exe
C:\Windows\System32\takeown.exe /f "C:\Windows\System32\wscript.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:1208

C:\Windows\SysWOW64\icacls.exe
C:\Windows\System32\icacls.exe "C:\Windows\System32\wscript.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1724

C:\Windows\SysWOW64\takeown.exe
C:\Windows\System32\takeown.exe /f "C:\Windows\System32\cscript.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:588

C:\Windows\SysWOW64\icacls.exe
C:\Windows\System32\icacls.exe "C:\Windows\System32\cscript.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1984

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File Permissions Modification

1

T1222

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/588-62-0x0000000000000000-mapping.dmp

Download
memory/1120-57-0x0000000000000000-mapping.dmp

Download
memory/1208-60-0x0000000000000000-mapping.dmp

Download
memory/1724-61-0x0000000000000000-mapping.dmp

Download
memory/1828-56-0x0000000000000000-mapping.dmp

Download
memory/1984-63-0x0000000000000000-mapping.dmp

Download
memory/1992-58-0x0000000000000000-mapping.dmp

Download
memory/2012-59-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing