eb195549cf32b0e822757d4a45847b1f340b8c9b468409e4d879c3c033062942

General

Target

eb195549cf32b0e822757d4a45847b1f340b8c9b468409e4d879c3c033062942.exe
Size

40KB
MD5

2a975600dd703ba64bb3c00cab788cb0
SHA1

eb0f6ee075a451bfb0d2b5bdddcbf787353cbb2f
SHA256

eb195549cf32b0e822757d4a45847b1f340b8c9b468409e4d879c3c033062942
SHA512

d6dc407bfea5a9f03e4de8cf29b07138fe6a44fbdb326c16c87e98e5e68d7a66a7461c71c7f59a6936abb346c493834d92f0d099394a6c1b63dd372da9f3fef3
SSDEEP

768:/dCOR0vhT17PzHu655y0Pp2YlWBEigExe5yGEO9:/dMXq1MGGb9

Score

8^/10

discovery exploit

Malware Config

Signatures

Possible privilege escalation attempt 8 IoCs
exploit

Processes:

icacls.exetakeown.exetakeown.exeicacls.exeicacls.exetakeown.exeicacls.exetakeown.exe

pid process

2488 icacls.exe
2424 takeown.exe
4032 takeown.exe
4232 icacls.exe
4396 icacls.exe
4900 takeown.exe
4056 icacls.exe
1236 takeown.exe
Modifies file permissions 1 TTPs 8 IoCs
discovery

File Permissions Modification
T1222

Processes:

icacls.exeicacls.exetakeown.exeicacls.exetakeown.exeicacls.exetakeown.exetakeown.exe

pid process

4232 icacls.exe
4396 icacls.exe
4900 takeown.exe
4056 icacls.exe
1236 takeown.exe
2488 icacls.exe
2424 takeown.exe
4032 takeown.exe

pid	process
2488	icacls.exe
2424	takeown.exe
4032	takeown.exe
4232	icacls.exe
4396	icacls.exe
4900	takeown.exe
4056	icacls.exe
1236	takeown.exe

pid	process
4232	icacls.exe
4396	icacls.exe
4900	takeown.exe
4056	icacls.exe
1236	takeown.exe
2488	icacls.exe
2424	takeown.exe
4032	takeown.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

takeown.exetakeown.exetakeown.exetakeown.exe

description	pid	process
Token: SeTakeOwnershipPrivilege	1236	takeown.exe
Token: SeTakeOwnershipPrivilege	2424	takeown.exe
Token: SeTakeOwnershipPrivilege	4032	takeown.exe
Token: SeTakeOwnershipPrivilege	4900	takeown.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

eb195549cf32b0e822757d4a45847b1f340b8c9b468409e4d879c3c033062942.exe

pid process

1476 eb195549cf32b0e822757d4a45847b1f340b8c9b468409e4d879c3c033062942.exe

pid	process
1476	eb195549cf32b0e822757d4a45847b1f340b8c9b468409e4d879c3c033062942.exe

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

eb195549cf32b0e822757d4a45847b1f340b8c9b468409e4d879c3c033062942.exe

description	pid	process	target process
PID 1476 wrote to memory of 1236	1476	eb195549cf32b0e822757d4a45847b1f340b8c9b468409e4d879c3c033062942.exe	takeown.exe
PID 1476 wrote to memory of 1236	1476	eb195549cf32b0e822757d4a45847b1f340b8c9b468409e4d879c3c033062942.exe	takeown.exe
PID 1476 wrote to memory of 1236	1476	eb195549cf32b0e822757d4a45847b1f340b8c9b468409e4d879c3c033062942.exe	takeown.exe
PID 1476 wrote to memory of 2488	1476	eb195549cf32b0e822757d4a45847b1f340b8c9b468409e4d879c3c033062942.exe	icacls.exe
PID 1476 wrote to memory of 2488	1476	eb195549cf32b0e822757d4a45847b1f340b8c9b468409e4d879c3c033062942.exe	icacls.exe
PID 1476 wrote to memory of 2488	1476	eb195549cf32b0e822757d4a45847b1f340b8c9b468409e4d879c3c033062942.exe	icacls.exe
PID 1476 wrote to memory of 2424	1476	eb195549cf32b0e822757d4a45847b1f340b8c9b468409e4d879c3c033062942.exe	takeown.exe
PID 1476 wrote to memory of 2424	1476	eb195549cf32b0e822757d4a45847b1f340b8c9b468409e4d879c3c033062942.exe	takeown.exe
PID 1476 wrote to memory of 2424	1476	eb195549cf32b0e822757d4a45847b1f340b8c9b468409e4d879c3c033062942.exe	takeown.exe
PID 1476 wrote to memory of 4232	1476	eb195549cf32b0e822757d4a45847b1f340b8c9b468409e4d879c3c033062942.exe	icacls.exe
PID 1476 wrote to memory of 4232	1476	eb195549cf32b0e822757d4a45847b1f340b8c9b468409e4d879c3c033062942.exe	icacls.exe
PID 1476 wrote to memory of 4232	1476	eb195549cf32b0e822757d4a45847b1f340b8c9b468409e4d879c3c033062942.exe	icacls.exe
PID 1476 wrote to memory of 4032	1476	eb195549cf32b0e822757d4a45847b1f340b8c9b468409e4d879c3c033062942.exe	takeown.exe
PID 1476 wrote to memory of 4032	1476	eb195549cf32b0e822757d4a45847b1f340b8c9b468409e4d879c3c033062942.exe	takeown.exe
PID 1476 wrote to memory of 4032	1476	eb195549cf32b0e822757d4a45847b1f340b8c9b468409e4d879c3c033062942.exe	takeown.exe
PID 1476 wrote to memory of 4396	1476	eb195549cf32b0e822757d4a45847b1f340b8c9b468409e4d879c3c033062942.exe	icacls.exe
PID 1476 wrote to memory of 4396	1476	eb195549cf32b0e822757d4a45847b1f340b8c9b468409e4d879c3c033062942.exe	icacls.exe
PID 1476 wrote to memory of 4396	1476	eb195549cf32b0e822757d4a45847b1f340b8c9b468409e4d879c3c033062942.exe	icacls.exe
PID 1476 wrote to memory of 4900	1476	eb195549cf32b0e822757d4a45847b1f340b8c9b468409e4d879c3c033062942.exe	takeown.exe
PID 1476 wrote to memory of 4900	1476	eb195549cf32b0e822757d4a45847b1f340b8c9b468409e4d879c3c033062942.exe	takeown.exe
PID 1476 wrote to memory of 4900	1476	eb195549cf32b0e822757d4a45847b1f340b8c9b468409e4d879c3c033062942.exe	takeown.exe
PID 1476 wrote to memory of 4056	1476	eb195549cf32b0e822757d4a45847b1f340b8c9b468409e4d879c3c033062942.exe	icacls.exe
PID 1476 wrote to memory of 4056	1476	eb195549cf32b0e822757d4a45847b1f340b8c9b468409e4d879c3c033062942.exe	icacls.exe
PID 1476 wrote to memory of 4056	1476	eb195549cf32b0e822757d4a45847b1f340b8c9b468409e4d879c3c033062942.exe	icacls.exe

C:\Users\Admin\AppData\Local\Temp\eb195549cf32b0e822757d4a45847b1f340b8c9b468409e4d879c3c033062942.exe
"C:\Users\Admin\AppData\Local\Temp\eb195549cf32b0e822757d4a45847b1f340b8c9b468409e4d879c3c033062942.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1476

C:\Windows\SysWOW64\takeown.exe
C:\Windows\System32\takeown.exe /f "C:\Windows\System32\cmd.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:1236

C:\Windows\SysWOW64\icacls.exe
C:\Windows\System32\icacls.exe "C:\Windows\System32\cmd.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:2488

C:\Windows\SysWOW64\takeown.exe
C:\Windows\System32\takeown.exe /f "C:\Windows\System32\ftp.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:2424

C:\Windows\SysWOW64\takeown.exe
C:\Windows\System32\takeown.exe /f "C:\Windows\System32\wscript.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:4032

C:\Windows\SysWOW64\icacls.exe
C:\Windows\System32\icacls.exe "C:\Windows\System32\ftp.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:4232

C:\Windows\SysWOW64\icacls.exe
C:\Windows\System32\icacls.exe "C:\Windows\System32\wscript.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:4396

C:\Windows\SysWOW64\takeown.exe
C:\Windows\System32\takeown.exe /f "C:\Windows\System32\cscript.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:4900

C:\Windows\SysWOW64\icacls.exe
C:\Windows\System32\icacls.exe "C:\Windows\System32\cscript.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:4056

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File Permissions Modification

1

T1222

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1236-134-0x0000000000000000-mapping.dmp

Download
memory/2424-136-0x0000000000000000-mapping.dmp

Download
memory/2488-135-0x0000000000000000-mapping.dmp

Download
memory/4032-138-0x0000000000000000-mapping.dmp

Download
memory/4056-141-0x0000000000000000-mapping.dmp

Download
memory/4232-137-0x0000000000000000-mapping.dmp

Download
memory/4396-139-0x0000000000000000-mapping.dmp

Download
memory/4900-140-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing