c0113ec2f55feb9f2972be3ad76f75f2fc8bcdd0e4085509f9420f5dff38ba99

General

Target

c0113ec2f55feb9f2972be3ad76f75f2fc8bcdd0e4085509f9420f5dff38ba99.exe
Size

60KB
MD5

6d9d1b713010f998d8ad0627c7eb4680
SHA1

a4cf355a7dd9f37ba98dcf18b6672d75794a2cce
SHA256

c0113ec2f55feb9f2972be3ad76f75f2fc8bcdd0e4085509f9420f5dff38ba99
SHA512

b58a56ea2d5addc79f237b5cc319d468f7878d8f90032400d126c517b1454abcfd54601339486e3fbff30973cca87d5dda92749257ebb596d2da38da15ee6457
SSDEEP

768:HoCjNyULSOTuYRFMGXGlS/F6S8qKGZLb47J1bH86wQ6wsZn1iu37rwIgg4eAuZ3o:HoiiMpGlFqKGZLb4FxLw7CIr4eA23o

Score

8^/10

discovery exploit

Malware Config

Signatures

Possible privilege escalation attempt 20 IoCs

exploit

Processes:

takeown.exeicacls.exetakeown.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exetakeown.exetakeown.exetakeown.exetakeown.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exetakeown.exeicacls.exe

pid	process
2620	takeown.exe
3908	icacls.exe
3876	takeown.exe
3712	icacls.exe
4616	icacls.exe
1596	icacls.exe
3640	icacls.exe
2176	icacls.exe
2256	icacls.exe
1344	takeown.exe
3500	takeown.exe
1012	takeown.exe
4412	takeown.exe
1276	icacls.exe
4680	icacls.exe
4644	icacls.exe
876	icacls.exe
4376	icacls.exe
4868	takeown.exe
2212	icacls.exe

Modifies file permissions 1 TTPs 20 IoCs

discovery

File Permissions Modification

T1222

Processes:

icacls.exetakeown.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exetakeown.exetakeown.exeicacls.exetakeown.exeicacls.exetakeown.exeicacls.exetakeown.exeicacls.exetakeown.exeicacls.exeicacls.exeicacls.exe

pid	process
4376	icacls.exe
4868	takeown.exe
4680	icacls.exe
4644	icacls.exe
1596	icacls.exe
3640	icacls.exe
2256	icacls.exe
2620	takeown.exe
1344	takeown.exe
2176	icacls.exe
1012	takeown.exe
4616	icacls.exe
4412	takeown.exe
2212	icacls.exe
3876	takeown.exe
3712	icacls.exe
3500	takeown.exe
1276	icacls.exe
3908	icacls.exe
876	icacls.exe

Drops file in System32 directory 6 IoCs

Processes:

c0113ec2f55feb9f2972be3ad76f75f2fc8bcdd0e4085509f9420f5dff38ba99.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\ftp.exe	c0113ec2f55feb9f2972be3ad76f75f2fc8bcdd0e4085509f9420f5dff38ba99.exe
File opened for modification	C:\Windows\SysWOW64\wscript.exe	c0113ec2f55feb9f2972be3ad76f75f2fc8bcdd0e4085509f9420f5dff38ba99.exe
File opened for modification	C:\Windows\SysWOW64\cscript.exe	c0113ec2f55feb9f2972be3ad76f75f2fc8bcdd0e4085509f9420f5dff38ba99.exe
File created	\??\c:\windows\SysWOW64\ezasb.exe	c0113ec2f55feb9f2972be3ad76f75f2fc8bcdd0e4085509f9420f5dff38ba99.exe
File opened for modification	\??\c:\windows\SysWOW64\ezasb.exe	c0113ec2f55feb9f2972be3ad76f75f2fc8bcdd0e4085509f9420f5dff38ba99.exe
File opened for modification	C:\Windows\SysWOW64\cmd.exe	c0113ec2f55feb9f2972be3ad76f75f2fc8bcdd0e4085509f9420f5dff38ba99.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

takeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exe

description	pid	process
Token: SeTakeOwnershipPrivilege	2620	takeown.exe
Token: SeTakeOwnershipPrivilege	4868	takeown.exe
Token: SeTakeOwnershipPrivilege	1344	takeown.exe
Token: SeTakeOwnershipPrivilege	3500	takeown.exe
Token: SeTakeOwnershipPrivilege	1012	takeown.exe
Token: SeTakeOwnershipPrivilege	3876	takeown.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

c0113ec2f55feb9f2972be3ad76f75f2fc8bcdd0e4085509f9420f5dff38ba99.exe

pid process

4856 c0113ec2f55feb9f2972be3ad76f75f2fc8bcdd0e4085509f9420f5dff38ba99.exe

pid	process
4856	c0113ec2f55feb9f2972be3ad76f75f2fc8bcdd0e4085509f9420f5dff38ba99.exe

Suspicious use of WriteProcessMemory 60 IoCs

Processes:

c0113ec2f55feb9f2972be3ad76f75f2fc8bcdd0e4085509f9420f5dff38ba99.exe

description	pid	process	target process
PID 4856 wrote to memory of 4412	4856	c0113ec2f55feb9f2972be3ad76f75f2fc8bcdd0e4085509f9420f5dff38ba99.exe	takeown.exe
PID 4856 wrote to memory of 4412	4856	c0113ec2f55feb9f2972be3ad76f75f2fc8bcdd0e4085509f9420f5dff38ba99.exe	takeown.exe
PID 4856 wrote to memory of 4412	4856	c0113ec2f55feb9f2972be3ad76f75f2fc8bcdd0e4085509f9420f5dff38ba99.exe	takeown.exe
PID 4856 wrote to memory of 876	4856	c0113ec2f55feb9f2972be3ad76f75f2fc8bcdd0e4085509f9420f5dff38ba99.exe	icacls.exe
PID 4856 wrote to memory of 876	4856	c0113ec2f55feb9f2972be3ad76f75f2fc8bcdd0e4085509f9420f5dff38ba99.exe	icacls.exe
PID 4856 wrote to memory of 876	4856	c0113ec2f55feb9f2972be3ad76f75f2fc8bcdd0e4085509f9420f5dff38ba99.exe	icacls.exe
PID 4856 wrote to memory of 2620	4856	c0113ec2f55feb9f2972be3ad76f75f2fc8bcdd0e4085509f9420f5dff38ba99.exe	takeown.exe
PID 4856 wrote to memory of 2620	4856	c0113ec2f55feb9f2972be3ad76f75f2fc8bcdd0e4085509f9420f5dff38ba99.exe	takeown.exe
PID 4856 wrote to memory of 2620	4856	c0113ec2f55feb9f2972be3ad76f75f2fc8bcdd0e4085509f9420f5dff38ba99.exe	takeown.exe
PID 4856 wrote to memory of 4376	4856	c0113ec2f55feb9f2972be3ad76f75f2fc8bcdd0e4085509f9420f5dff38ba99.exe	icacls.exe
PID 4856 wrote to memory of 4376	4856	c0113ec2f55feb9f2972be3ad76f75f2fc8bcdd0e4085509f9420f5dff38ba99.exe	icacls.exe
PID 4856 wrote to memory of 4376	4856	c0113ec2f55feb9f2972be3ad76f75f2fc8bcdd0e4085509f9420f5dff38ba99.exe	icacls.exe
PID 4856 wrote to memory of 1276	4856	c0113ec2f55feb9f2972be3ad76f75f2fc8bcdd0e4085509f9420f5dff38ba99.exe	icacls.exe
PID 4856 wrote to memory of 1276	4856	c0113ec2f55feb9f2972be3ad76f75f2fc8bcdd0e4085509f9420f5dff38ba99.exe	icacls.exe
PID 4856 wrote to memory of 1276	4856	c0113ec2f55feb9f2972be3ad76f75f2fc8bcdd0e4085509f9420f5dff38ba99.exe	icacls.exe
PID 4856 wrote to memory of 4868	4856	c0113ec2f55feb9f2972be3ad76f75f2fc8bcdd0e4085509f9420f5dff38ba99.exe	takeown.exe
PID 4856 wrote to memory of 4868	4856	c0113ec2f55feb9f2972be3ad76f75f2fc8bcdd0e4085509f9420f5dff38ba99.exe	takeown.exe
PID 4856 wrote to memory of 4868	4856	c0113ec2f55feb9f2972be3ad76f75f2fc8bcdd0e4085509f9420f5dff38ba99.exe	takeown.exe
PID 4856 wrote to memory of 4680	4856	c0113ec2f55feb9f2972be3ad76f75f2fc8bcdd0e4085509f9420f5dff38ba99.exe	icacls.exe
PID 4856 wrote to memory of 4680	4856	c0113ec2f55feb9f2972be3ad76f75f2fc8bcdd0e4085509f9420f5dff38ba99.exe	icacls.exe
PID 4856 wrote to memory of 4680	4856	c0113ec2f55feb9f2972be3ad76f75f2fc8bcdd0e4085509f9420f5dff38ba99.exe	icacls.exe
PID 4856 wrote to memory of 4644	4856	c0113ec2f55feb9f2972be3ad76f75f2fc8bcdd0e4085509f9420f5dff38ba99.exe	icacls.exe
PID 4856 wrote to memory of 4644	4856	c0113ec2f55feb9f2972be3ad76f75f2fc8bcdd0e4085509f9420f5dff38ba99.exe	icacls.exe
PID 4856 wrote to memory of 4644	4856	c0113ec2f55feb9f2972be3ad76f75f2fc8bcdd0e4085509f9420f5dff38ba99.exe	icacls.exe
PID 4856 wrote to memory of 1344	4856	c0113ec2f55feb9f2972be3ad76f75f2fc8bcdd0e4085509f9420f5dff38ba99.exe	takeown.exe
PID 4856 wrote to memory of 1344	4856	c0113ec2f55feb9f2972be3ad76f75f2fc8bcdd0e4085509f9420f5dff38ba99.exe	takeown.exe
PID 4856 wrote to memory of 1344	4856	c0113ec2f55feb9f2972be3ad76f75f2fc8bcdd0e4085509f9420f5dff38ba99.exe	takeown.exe
PID 4856 wrote to memory of 1596	4856	c0113ec2f55feb9f2972be3ad76f75f2fc8bcdd0e4085509f9420f5dff38ba99.exe	icacls.exe
PID 4856 wrote to memory of 1596	4856	c0113ec2f55feb9f2972be3ad76f75f2fc8bcdd0e4085509f9420f5dff38ba99.exe	icacls.exe
PID 4856 wrote to memory of 1596	4856	c0113ec2f55feb9f2972be3ad76f75f2fc8bcdd0e4085509f9420f5dff38ba99.exe	icacls.exe
PID 4856 wrote to memory of 3908	4856	c0113ec2f55feb9f2972be3ad76f75f2fc8bcdd0e4085509f9420f5dff38ba99.exe	icacls.exe
PID 4856 wrote to memory of 3908	4856	c0113ec2f55feb9f2972be3ad76f75f2fc8bcdd0e4085509f9420f5dff38ba99.exe	icacls.exe
PID 4856 wrote to memory of 3908	4856	c0113ec2f55feb9f2972be3ad76f75f2fc8bcdd0e4085509f9420f5dff38ba99.exe	icacls.exe
PID 4856 wrote to memory of 3500	4856	c0113ec2f55feb9f2972be3ad76f75f2fc8bcdd0e4085509f9420f5dff38ba99.exe	takeown.exe
PID 4856 wrote to memory of 3500	4856	c0113ec2f55feb9f2972be3ad76f75f2fc8bcdd0e4085509f9420f5dff38ba99.exe	takeown.exe
PID 4856 wrote to memory of 3500	4856	c0113ec2f55feb9f2972be3ad76f75f2fc8bcdd0e4085509f9420f5dff38ba99.exe	takeown.exe
PID 4856 wrote to memory of 3640	4856	c0113ec2f55feb9f2972be3ad76f75f2fc8bcdd0e4085509f9420f5dff38ba99.exe	icacls.exe
PID 4856 wrote to memory of 3640	4856	c0113ec2f55feb9f2972be3ad76f75f2fc8bcdd0e4085509f9420f5dff38ba99.exe	icacls.exe
PID 4856 wrote to memory of 3640	4856	c0113ec2f55feb9f2972be3ad76f75f2fc8bcdd0e4085509f9420f5dff38ba99.exe	icacls.exe
PID 4856 wrote to memory of 2176	4856	c0113ec2f55feb9f2972be3ad76f75f2fc8bcdd0e4085509f9420f5dff38ba99.exe	icacls.exe
PID 4856 wrote to memory of 2176	4856	c0113ec2f55feb9f2972be3ad76f75f2fc8bcdd0e4085509f9420f5dff38ba99.exe	icacls.exe
PID 4856 wrote to memory of 2176	4856	c0113ec2f55feb9f2972be3ad76f75f2fc8bcdd0e4085509f9420f5dff38ba99.exe	icacls.exe
PID 4856 wrote to memory of 1012	4856	c0113ec2f55feb9f2972be3ad76f75f2fc8bcdd0e4085509f9420f5dff38ba99.exe	takeown.exe
PID 4856 wrote to memory of 1012	4856	c0113ec2f55feb9f2972be3ad76f75f2fc8bcdd0e4085509f9420f5dff38ba99.exe	takeown.exe
PID 4856 wrote to memory of 1012	4856	c0113ec2f55feb9f2972be3ad76f75f2fc8bcdd0e4085509f9420f5dff38ba99.exe	takeown.exe
PID 4856 wrote to memory of 2212	4856	c0113ec2f55feb9f2972be3ad76f75f2fc8bcdd0e4085509f9420f5dff38ba99.exe	icacls.exe
PID 4856 wrote to memory of 2212	4856	c0113ec2f55feb9f2972be3ad76f75f2fc8bcdd0e4085509f9420f5dff38ba99.exe	icacls.exe
PID 4856 wrote to memory of 2212	4856	c0113ec2f55feb9f2972be3ad76f75f2fc8bcdd0e4085509f9420f5dff38ba99.exe	icacls.exe
PID 4856 wrote to memory of 2256	4856	c0113ec2f55feb9f2972be3ad76f75f2fc8bcdd0e4085509f9420f5dff38ba99.exe	icacls.exe
PID 4856 wrote to memory of 2256	4856	c0113ec2f55feb9f2972be3ad76f75f2fc8bcdd0e4085509f9420f5dff38ba99.exe	icacls.exe
PID 4856 wrote to memory of 2256	4856	c0113ec2f55feb9f2972be3ad76f75f2fc8bcdd0e4085509f9420f5dff38ba99.exe	icacls.exe
PID 4856 wrote to memory of 3876	4856	c0113ec2f55feb9f2972be3ad76f75f2fc8bcdd0e4085509f9420f5dff38ba99.exe	takeown.exe
PID 4856 wrote to memory of 3876	4856	c0113ec2f55feb9f2972be3ad76f75f2fc8bcdd0e4085509f9420f5dff38ba99.exe	takeown.exe
PID 4856 wrote to memory of 3876	4856	c0113ec2f55feb9f2972be3ad76f75f2fc8bcdd0e4085509f9420f5dff38ba99.exe	takeown.exe
PID 4856 wrote to memory of 4616	4856	c0113ec2f55feb9f2972be3ad76f75f2fc8bcdd0e4085509f9420f5dff38ba99.exe	icacls.exe
PID 4856 wrote to memory of 4616	4856	c0113ec2f55feb9f2972be3ad76f75f2fc8bcdd0e4085509f9420f5dff38ba99.exe	icacls.exe
PID 4856 wrote to memory of 4616	4856	c0113ec2f55feb9f2972be3ad76f75f2fc8bcdd0e4085509f9420f5dff38ba99.exe	icacls.exe
PID 4856 wrote to memory of 3712	4856	c0113ec2f55feb9f2972be3ad76f75f2fc8bcdd0e4085509f9420f5dff38ba99.exe	icacls.exe
PID 4856 wrote to memory of 3712	4856	c0113ec2f55feb9f2972be3ad76f75f2fc8bcdd0e4085509f9420f5dff38ba99.exe	icacls.exe
PID 4856 wrote to memory of 3712	4856	c0113ec2f55feb9f2972be3ad76f75f2fc8bcdd0e4085509f9420f5dff38ba99.exe	icacls.exe

C:\Users\Admin\AppData\Local\Temp\c0113ec2f55feb9f2972be3ad76f75f2fc8bcdd0e4085509f9420f5dff38ba99.exe
"C:\Users\Admin\AppData\Local\Temp\c0113ec2f55feb9f2972be3ad76f75f2fc8bcdd0e4085509f9420f5dff38ba99.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4856

C:\Windows\SysWOW64\takeown.exe
C:\Windows\system32\takeown.exe /f "c:\windows\system32\ezasb.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:4412

C:\Windows\SysWOW64\icacls.exe
C:\Windows\system32\icacls.exe "c:\windows\system32\ezasb.exe" /grant SYSTEM:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:876

C:\Windows\SysWOW64\takeown.exe
C:\Windows\system32\takeown.exe /f "C:\Windows\System32\cmd.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:2620

C:\Windows\SysWOW64\icacls.exe
C:\Windows\system32\icacls.exe "C:\Windows\System32\cmd.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1276

C:\Windows\SysWOW64\icacls.exe
C:\Windows\system32\icacls.exe "C:\Windows\System32\cmd.exe" /grant SYSTEM:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:4376

C:\Windows\SysWOW64\takeown.exe
C:\Windows\system32\takeown.exe /f "C:\Windows\System32\cmd.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:4868

C:\Windows\SysWOW64\icacls.exe
C:\Windows\system32\icacls.exe "C:\Windows\System32\cmd.exe" /grant SYSTEM:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:4680

C:\Windows\SysWOW64\icacls.exe
C:\Windows\system32\icacls.exe "C:\Windows\System32\cmd.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:4644

C:\Windows\SysWOW64\takeown.exe
C:\Windows\system32\takeown.exe /f "C:\Windows\System32\ftp.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:1344

C:\Windows\SysWOW64\icacls.exe
C:\Windows\system32\icacls.exe "C:\Windows\System32\ftp.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:3908

C:\Windows\SysWOW64\icacls.exe
C:\Windows\system32\icacls.exe "C:\Windows\System32\ftp.exe" /grant SYSTEM:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1596

C:\Windows\SysWOW64\takeown.exe
C:\Windows\system32\takeown.exe /f "C:\Windows\System32\wscript.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:3500

C:\Windows\SysWOW64\icacls.exe
C:\Windows\system32\icacls.exe "C:\Windows\System32\wscript.exe" /grant SYSTEM:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:3640

C:\Windows\SysWOW64\icacls.exe
C:\Windows\system32\icacls.exe "C:\Windows\System32\wscript.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:2176

C:\Windows\SysWOW64\takeown.exe
C:\Windows\system32\takeown.exe /f "C:\Windows\System32\cscript.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:1012

C:\Windows\SysWOW64\icacls.exe
C:\Windows\system32\icacls.exe "C:\Windows\System32\cscript.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:2256

C:\Windows\SysWOW64\icacls.exe
C:\Windows\system32\icacls.exe "C:\Windows\System32\cscript.exe" /grant SYSTEM:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:2212

C:\Windows\SysWOW64\takeown.exe
C:\Windows\system32\takeown.exe /f "C:\Windows\System32\cscript.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:3876

C:\Windows\SysWOW64\icacls.exe
C:\Windows\system32\icacls.exe "C:\Windows\System32\cscript.exe" /grant SYSTEM:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:4616

C:\Windows\SysWOW64\icacls.exe
C:\Windows\system32\icacls.exe "C:\Windows\System32\cscript.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:3712

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File Permissions Modification

1

T1222

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\??\c:\windows\SysWOW64\ezasb.exe
Filesize
60KB

MD5
6d9d1b713010f998d8ad0627c7eb4680

SHA1
a4cf355a7dd9f37ba98dcf18b6672d75794a2cce

SHA256
c0113ec2f55feb9f2972be3ad76f75f2fc8bcdd0e4085509f9420f5dff38ba99

SHA512
b58a56ea2d5addc79f237b5cc319d468f7878d8f90032400d126c517b1454abcfd54601339486e3fbff30973cca87d5dda92749257ebb596d2da38da15ee6457

Download Submit
memory/876-135-0x0000000000000000-mapping.dmp

Download
memory/1012-149-0x0000000000000000-mapping.dmp

Download
memory/1276-139-0x0000000000000000-mapping.dmp

Download
memory/1344-143-0x0000000000000000-mapping.dmp

Download
memory/1596-144-0x0000000000000000-mapping.dmp

Download
memory/2176-148-0x0000000000000000-mapping.dmp

Download
memory/2212-150-0x0000000000000000-mapping.dmp

Download
memory/2256-151-0x0000000000000000-mapping.dmp

Download
memory/2620-137-0x0000000000000000-mapping.dmp

Download
memory/3500-146-0x0000000000000000-mapping.dmp

Download
memory/3640-147-0x0000000000000000-mapping.dmp

Download
memory/3712-154-0x0000000000000000-mapping.dmp

Download
memory/3876-152-0x0000000000000000-mapping.dmp

Download
memory/3908-145-0x0000000000000000-mapping.dmp

Download
memory/4376-138-0x0000000000000000-mapping.dmp

Download
memory/4412-134-0x0000000000000000-mapping.dmp

Download
memory/4616-153-0x0000000000000000-mapping.dmp

Download
memory/4644-142-0x0000000000000000-mapping.dmp

Download
memory/4680-141-0x0000000000000000-mapping.dmp

Download
memory/4868-140-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads