6271a403f452f0ea2a30bc7a06577aabe2f5b95ad4a53ce0aa5ef5a8e213b9d1

General

Target

6271a403f452f0ea2a30bc7a06577aabe2f5b95ad4a53ce0aa5ef5a8e213b9d1.exe
Size

40KB
MD5

0c31db471f0d2341a58fe1e9d7cf4690
SHA1

e1e600a4c10cda3c4b5e9af0501c3f393c2af947
SHA256

6271a403f452f0ea2a30bc7a06577aabe2f5b95ad4a53ce0aa5ef5a8e213b9d1
SHA512

4bb6e8d16c5697f25b5f40d3c25816d153bd34e6f34afb3223ccc9d79ddd97ab67da90e8d52a06da2b83e60c14f9a328cc06ded08ba691403e9b88439da9708d
SSDEEP

768:/3LOIyPXI9ELkI9fcSTKQT382BAKrod6HFYuw47GF5UjGGOpvMEirS7tS52ELA9U:/3o4I9fcSTKQT382BAKrod6HFYuw47GW

Score

8^/10

discovery exploit

Malware Config

Signatures

Possible privilege escalation attempt 8 IoCs
exploit

Processes:

icacls.exetakeown.exeicacls.exetakeown.exeicacls.exetakeown.exeicacls.exetakeown.exe

pid process

3828 icacls.exe
4116 takeown.exe
1292 icacls.exe
4284 takeown.exe
1816 icacls.exe
1328 takeown.exe
4864 icacls.exe
3680 takeown.exe
Modifies file permissions 1 TTPs 8 IoCs
discovery

File Permissions Modification
T1222

Processes:

icacls.exetakeown.exeicacls.exetakeown.exeicacls.exetakeown.exeicacls.exetakeown.exe

pid process

1292 icacls.exe
4284 takeown.exe
1816 icacls.exe
1328 takeown.exe
4864 icacls.exe
3680 takeown.exe
3828 icacls.exe
4116 takeown.exe

pid	process
3828	icacls.exe
4116	takeown.exe
1292	icacls.exe
4284	takeown.exe
1816	icacls.exe
1328	takeown.exe
4864	icacls.exe
3680	takeown.exe

pid	process
1292	icacls.exe
4284	takeown.exe
1816	icacls.exe
1328	takeown.exe
4864	icacls.exe
3680	takeown.exe
3828	icacls.exe
4116	takeown.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

takeown.exetakeown.exetakeown.exetakeown.exe

description	pid	process
Token: SeTakeOwnershipPrivilege	3680	takeown.exe
Token: SeTakeOwnershipPrivilege	1328	takeown.exe
Token: SeTakeOwnershipPrivilege	4116	takeown.exe
Token: SeTakeOwnershipPrivilege	4284	takeown.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

6271a403f452f0ea2a30bc7a06577aabe2f5b95ad4a53ce0aa5ef5a8e213b9d1.exe

pid process

5068 6271a403f452f0ea2a30bc7a06577aabe2f5b95ad4a53ce0aa5ef5a8e213b9d1.exe

pid	process
5068	6271a403f452f0ea2a30bc7a06577aabe2f5b95ad4a53ce0aa5ef5a8e213b9d1.exe

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

6271a403f452f0ea2a30bc7a06577aabe2f5b95ad4a53ce0aa5ef5a8e213b9d1.exe

description	pid	process	target process
PID 5068 wrote to memory of 3680	5068	6271a403f452f0ea2a30bc7a06577aabe2f5b95ad4a53ce0aa5ef5a8e213b9d1.exe	takeown.exe
PID 5068 wrote to memory of 3680	5068	6271a403f452f0ea2a30bc7a06577aabe2f5b95ad4a53ce0aa5ef5a8e213b9d1.exe	takeown.exe
PID 5068 wrote to memory of 3680	5068	6271a403f452f0ea2a30bc7a06577aabe2f5b95ad4a53ce0aa5ef5a8e213b9d1.exe	takeown.exe
PID 5068 wrote to memory of 4864	5068	6271a403f452f0ea2a30bc7a06577aabe2f5b95ad4a53ce0aa5ef5a8e213b9d1.exe	icacls.exe
PID 5068 wrote to memory of 4864	5068	6271a403f452f0ea2a30bc7a06577aabe2f5b95ad4a53ce0aa5ef5a8e213b9d1.exe	icacls.exe
PID 5068 wrote to memory of 4864	5068	6271a403f452f0ea2a30bc7a06577aabe2f5b95ad4a53ce0aa5ef5a8e213b9d1.exe	icacls.exe
PID 5068 wrote to memory of 1328	5068	6271a403f452f0ea2a30bc7a06577aabe2f5b95ad4a53ce0aa5ef5a8e213b9d1.exe	takeown.exe
PID 5068 wrote to memory of 1328	5068	6271a403f452f0ea2a30bc7a06577aabe2f5b95ad4a53ce0aa5ef5a8e213b9d1.exe	takeown.exe
PID 5068 wrote to memory of 1328	5068	6271a403f452f0ea2a30bc7a06577aabe2f5b95ad4a53ce0aa5ef5a8e213b9d1.exe	takeown.exe
PID 5068 wrote to memory of 1816	5068	6271a403f452f0ea2a30bc7a06577aabe2f5b95ad4a53ce0aa5ef5a8e213b9d1.exe	icacls.exe
PID 5068 wrote to memory of 1816	5068	6271a403f452f0ea2a30bc7a06577aabe2f5b95ad4a53ce0aa5ef5a8e213b9d1.exe	icacls.exe
PID 5068 wrote to memory of 1816	5068	6271a403f452f0ea2a30bc7a06577aabe2f5b95ad4a53ce0aa5ef5a8e213b9d1.exe	icacls.exe
PID 5068 wrote to memory of 4284	5068	6271a403f452f0ea2a30bc7a06577aabe2f5b95ad4a53ce0aa5ef5a8e213b9d1.exe	takeown.exe
PID 5068 wrote to memory of 4284	5068	6271a403f452f0ea2a30bc7a06577aabe2f5b95ad4a53ce0aa5ef5a8e213b9d1.exe	takeown.exe
PID 5068 wrote to memory of 4284	5068	6271a403f452f0ea2a30bc7a06577aabe2f5b95ad4a53ce0aa5ef5a8e213b9d1.exe	takeown.exe
PID 5068 wrote to memory of 1292	5068	6271a403f452f0ea2a30bc7a06577aabe2f5b95ad4a53ce0aa5ef5a8e213b9d1.exe	icacls.exe
PID 5068 wrote to memory of 1292	5068	6271a403f452f0ea2a30bc7a06577aabe2f5b95ad4a53ce0aa5ef5a8e213b9d1.exe	icacls.exe
PID 5068 wrote to memory of 1292	5068	6271a403f452f0ea2a30bc7a06577aabe2f5b95ad4a53ce0aa5ef5a8e213b9d1.exe	icacls.exe
PID 5068 wrote to memory of 4116	5068	6271a403f452f0ea2a30bc7a06577aabe2f5b95ad4a53ce0aa5ef5a8e213b9d1.exe	takeown.exe
PID 5068 wrote to memory of 4116	5068	6271a403f452f0ea2a30bc7a06577aabe2f5b95ad4a53ce0aa5ef5a8e213b9d1.exe	takeown.exe
PID 5068 wrote to memory of 4116	5068	6271a403f452f0ea2a30bc7a06577aabe2f5b95ad4a53ce0aa5ef5a8e213b9d1.exe	takeown.exe
PID 5068 wrote to memory of 3828	5068	6271a403f452f0ea2a30bc7a06577aabe2f5b95ad4a53ce0aa5ef5a8e213b9d1.exe	icacls.exe
PID 5068 wrote to memory of 3828	5068	6271a403f452f0ea2a30bc7a06577aabe2f5b95ad4a53ce0aa5ef5a8e213b9d1.exe	icacls.exe
PID 5068 wrote to memory of 3828	5068	6271a403f452f0ea2a30bc7a06577aabe2f5b95ad4a53ce0aa5ef5a8e213b9d1.exe	icacls.exe

C:\Users\Admin\AppData\Local\Temp\6271a403f452f0ea2a30bc7a06577aabe2f5b95ad4a53ce0aa5ef5a8e213b9d1.exe
"C:\Users\Admin\AppData\Local\Temp\6271a403f452f0ea2a30bc7a06577aabe2f5b95ad4a53ce0aa5ef5a8e213b9d1.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5068

C:\Windows\SysWOW64\icacls.exe
C:\Windows\System32\icacls.exe "C:\Windows\System32\cscript.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:3828

C:\Windows\SysWOW64\takeown.exe
C:\Windows\System32\takeown.exe /f "C:\Windows\System32\cscript.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:4116

C:\Windows\SysWOW64\icacls.exe
C:\Windows\System32\icacls.exe "C:\Windows\System32\wscript.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1292

C:\Windows\SysWOW64\takeown.exe
C:\Windows\System32\takeown.exe /f "C:\Windows\System32\wscript.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:4284

C:\Windows\SysWOW64\icacls.exe
C:\Windows\System32\icacls.exe "C:\Windows\System32\ftp.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1816

C:\Windows\SysWOW64\takeown.exe
C:\Windows\System32\takeown.exe /f "C:\Windows\System32\ftp.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:1328

C:\Windows\SysWOW64\icacls.exe
C:\Windows\System32\icacls.exe "C:\Windows\System32\cmd.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:4864

C:\Windows\SysWOW64\takeown.exe
C:\Windows\System32\takeown.exe /f "C:\Windows\System32\cmd.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:3680

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File Permissions Modification

1

T1222

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1292-139-0x0000000000000000-mapping.dmp

Download
memory/1328-136-0x0000000000000000-mapping.dmp

Download
memory/1816-137-0x0000000000000000-mapping.dmp

Download
memory/3680-134-0x0000000000000000-mapping.dmp

Download
memory/3828-141-0x0000000000000000-mapping.dmp

Download
memory/4116-140-0x0000000000000000-mapping.dmp

Download
memory/4284-138-0x0000000000000000-mapping.dmp

Download
memory/4864-135-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing