32f458515681a69cb20e28bf2dbe5fb05de147faac0338616548f46bc44918af

General

Target

32f458515681a69cb20e28bf2dbe5fb05de147faac0338616548f46bc44918af.exe
Size

40KB
MD5

443247892070b27552695efb25cbd370
SHA1

9994e9ff44bfa117ffe2f73b3f974a639f99d751
SHA256

32f458515681a69cb20e28bf2dbe5fb05de147faac0338616548f46bc44918af
SHA512

7591dfa873fb7b7194c5899757fdd99ffb35ebd638668992ea210137aa56e852d1d57ec9655903471d4a25c5ae62dd1c126238d72c0bf2e4c1b6f8de6b81fd41
SSDEEP

384:/TjE5yPOeiuC5EApHgDTTdvJOWbZy5TpN2FJhnI/Gk+hJ+tbzvMmpdEKDwRwmDDB:/2yPOV1gppbeTXU9vJ+JED/OT

Score

8^/10

discovery exploit

Malware Config

Signatures

Possible privilege escalation attempt 8 IoCs
exploit

Processes:

icacls.exetakeown.exeicacls.exetakeown.exeicacls.exeicacls.exetakeown.exetakeown.exe

pid process

1588 icacls.exe
1080 takeown.exe
940 icacls.exe
948 takeown.exe
972 icacls.exe
1832 icacls.exe
1860 takeown.exe
1352 takeown.exe
Modifies file permissions 1 TTPs 8 IoCs
discovery

File Permissions Modification
T1222

Processes:

icacls.exetakeown.exeicacls.exetakeown.exeicacls.exeicacls.exetakeown.exetakeown.exe

pid process

1588 icacls.exe
1080 takeown.exe
940 icacls.exe
948 takeown.exe
972 icacls.exe
1832 icacls.exe
1860 takeown.exe
1352 takeown.exe

pid	process
1588	icacls.exe
1080	takeown.exe
940	icacls.exe
948	takeown.exe
972	icacls.exe
1832	icacls.exe
1860	takeown.exe
1352	takeown.exe

pid	process
1588	icacls.exe
1080	takeown.exe
940	icacls.exe
948	takeown.exe
972	icacls.exe
1832	icacls.exe
1860	takeown.exe
1352	takeown.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

takeown.exetakeown.exetakeown.exetakeown.exe

description	pid	process
Token: SeTakeOwnershipPrivilege	1352	takeown.exe
Token: SeTakeOwnershipPrivilege	948	takeown.exe
Token: SeTakeOwnershipPrivilege	1080	takeown.exe
Token: SeTakeOwnershipPrivilege	1860	takeown.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

32f458515681a69cb20e28bf2dbe5fb05de147faac0338616548f46bc44918af.exe

pid process

1508 32f458515681a69cb20e28bf2dbe5fb05de147faac0338616548f46bc44918af.exe

pid	process
1508	32f458515681a69cb20e28bf2dbe5fb05de147faac0338616548f46bc44918af.exe

Suspicious use of WriteProcessMemory 32 IoCs

Processes:

32f458515681a69cb20e28bf2dbe5fb05de147faac0338616548f46bc44918af.exe

description	pid	process	target process
PID 1508 wrote to memory of 1352	1508	32f458515681a69cb20e28bf2dbe5fb05de147faac0338616548f46bc44918af.exe	takeown.exe
PID 1508 wrote to memory of 1352	1508	32f458515681a69cb20e28bf2dbe5fb05de147faac0338616548f46bc44918af.exe	takeown.exe
PID 1508 wrote to memory of 1352	1508	32f458515681a69cb20e28bf2dbe5fb05de147faac0338616548f46bc44918af.exe	takeown.exe
PID 1508 wrote to memory of 1352	1508	32f458515681a69cb20e28bf2dbe5fb05de147faac0338616548f46bc44918af.exe	takeown.exe
PID 1508 wrote to memory of 1588	1508	32f458515681a69cb20e28bf2dbe5fb05de147faac0338616548f46bc44918af.exe	icacls.exe
PID 1508 wrote to memory of 1588	1508	32f458515681a69cb20e28bf2dbe5fb05de147faac0338616548f46bc44918af.exe	icacls.exe
PID 1508 wrote to memory of 1588	1508	32f458515681a69cb20e28bf2dbe5fb05de147faac0338616548f46bc44918af.exe	icacls.exe
PID 1508 wrote to memory of 1588	1508	32f458515681a69cb20e28bf2dbe5fb05de147faac0338616548f46bc44918af.exe	icacls.exe
PID 1508 wrote to memory of 1080	1508	32f458515681a69cb20e28bf2dbe5fb05de147faac0338616548f46bc44918af.exe	takeown.exe
PID 1508 wrote to memory of 1080	1508	32f458515681a69cb20e28bf2dbe5fb05de147faac0338616548f46bc44918af.exe	takeown.exe
PID 1508 wrote to memory of 1080	1508	32f458515681a69cb20e28bf2dbe5fb05de147faac0338616548f46bc44918af.exe	takeown.exe
PID 1508 wrote to memory of 1080	1508	32f458515681a69cb20e28bf2dbe5fb05de147faac0338616548f46bc44918af.exe	takeown.exe
PID 1508 wrote to memory of 940	1508	32f458515681a69cb20e28bf2dbe5fb05de147faac0338616548f46bc44918af.exe	icacls.exe
PID 1508 wrote to memory of 940	1508	32f458515681a69cb20e28bf2dbe5fb05de147faac0338616548f46bc44918af.exe	icacls.exe
PID 1508 wrote to memory of 940	1508	32f458515681a69cb20e28bf2dbe5fb05de147faac0338616548f46bc44918af.exe	icacls.exe
PID 1508 wrote to memory of 940	1508	32f458515681a69cb20e28bf2dbe5fb05de147faac0338616548f46bc44918af.exe	icacls.exe
PID 1508 wrote to memory of 948	1508	32f458515681a69cb20e28bf2dbe5fb05de147faac0338616548f46bc44918af.exe	takeown.exe
PID 1508 wrote to memory of 948	1508	32f458515681a69cb20e28bf2dbe5fb05de147faac0338616548f46bc44918af.exe	takeown.exe
PID 1508 wrote to memory of 948	1508	32f458515681a69cb20e28bf2dbe5fb05de147faac0338616548f46bc44918af.exe	takeown.exe
PID 1508 wrote to memory of 948	1508	32f458515681a69cb20e28bf2dbe5fb05de147faac0338616548f46bc44918af.exe	takeown.exe
PID 1508 wrote to memory of 972	1508	32f458515681a69cb20e28bf2dbe5fb05de147faac0338616548f46bc44918af.exe	icacls.exe
PID 1508 wrote to memory of 972	1508	32f458515681a69cb20e28bf2dbe5fb05de147faac0338616548f46bc44918af.exe	icacls.exe
PID 1508 wrote to memory of 972	1508	32f458515681a69cb20e28bf2dbe5fb05de147faac0338616548f46bc44918af.exe	icacls.exe
PID 1508 wrote to memory of 972	1508	32f458515681a69cb20e28bf2dbe5fb05de147faac0338616548f46bc44918af.exe	icacls.exe
PID 1508 wrote to memory of 1860	1508	32f458515681a69cb20e28bf2dbe5fb05de147faac0338616548f46bc44918af.exe	takeown.exe
PID 1508 wrote to memory of 1860	1508	32f458515681a69cb20e28bf2dbe5fb05de147faac0338616548f46bc44918af.exe	takeown.exe
PID 1508 wrote to memory of 1860	1508	32f458515681a69cb20e28bf2dbe5fb05de147faac0338616548f46bc44918af.exe	takeown.exe
PID 1508 wrote to memory of 1860	1508	32f458515681a69cb20e28bf2dbe5fb05de147faac0338616548f46bc44918af.exe	takeown.exe
PID 1508 wrote to memory of 1832	1508	32f458515681a69cb20e28bf2dbe5fb05de147faac0338616548f46bc44918af.exe	icacls.exe
PID 1508 wrote to memory of 1832	1508	32f458515681a69cb20e28bf2dbe5fb05de147faac0338616548f46bc44918af.exe	icacls.exe
PID 1508 wrote to memory of 1832	1508	32f458515681a69cb20e28bf2dbe5fb05de147faac0338616548f46bc44918af.exe	icacls.exe
PID 1508 wrote to memory of 1832	1508	32f458515681a69cb20e28bf2dbe5fb05de147faac0338616548f46bc44918af.exe	icacls.exe

C:\Users\Admin\AppData\Local\Temp\32f458515681a69cb20e28bf2dbe5fb05de147faac0338616548f46bc44918af.exe
"C:\Users\Admin\AppData\Local\Temp\32f458515681a69cb20e28bf2dbe5fb05de147faac0338616548f46bc44918af.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1508

C:\Windows\SysWOW64\takeown.exe
C:\Windows\System32\takeown.exe /f "C:\Windows\System32\cmd.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:1352

C:\Windows\SysWOW64\icacls.exe
C:\Windows\System32\icacls.exe "C:\Windows\System32\cmd.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1588

C:\Windows\SysWOW64\takeown.exe
C:\Windows\System32\takeown.exe /f "C:\Windows\System32\ftp.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:1080

C:\Windows\SysWOW64\icacls.exe
C:\Windows\System32\icacls.exe "C:\Windows\System32\ftp.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:940

C:\Windows\SysWOW64\takeown.exe
C:\Windows\System32\takeown.exe /f "C:\Windows\System32\wscript.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:948

C:\Windows\SysWOW64\icacls.exe
C:\Windows\System32\icacls.exe "C:\Windows\System32\wscript.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:972

C:\Windows\SysWOW64\icacls.exe
C:\Windows\System32\icacls.exe "C:\Windows\System32\cscript.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1832

C:\Windows\SysWOW64\takeown.exe
C:\Windows\System32\takeown.exe /f "C:\Windows\System32\cscript.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:1860

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File Permissions Modification

1

T1222

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/940-59-0x0000000000000000-mapping.dmp

Download
memory/948-60-0x0000000000000000-mapping.dmp

Download
memory/972-61-0x0000000000000000-mapping.dmp

Download
memory/1080-58-0x0000000000000000-mapping.dmp

Download
memory/1352-56-0x0000000000000000-mapping.dmp

Download
memory/1588-57-0x0000000000000000-mapping.dmp

Download
memory/1832-63-0x0000000000000000-mapping.dmp

Download
memory/1860-62-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing