1577b7cbb5459a9b57afb778b9041e63dad06b7ef9352c4b7145778fde10f478

General

Target

1577b7cbb5459a9b57afb778b9041e63dad06b7ef9352c4b7145778fde10f478.exe
Size

40KB
MD5

0cab4f9123d3e29604999acbbcfb38b0
SHA1

b16deda6490ba04fb38b6958d96498c3143a52dd
SHA256

1577b7cbb5459a9b57afb778b9041e63dad06b7ef9352c4b7145778fde10f478
SHA512

9275012ed16207b04e27caaa608aca10e715a2b533bd0f0cd872a012da961f9b534ab24e4a0b5f4316a14276f1a81bda1bfea70bf3549fb27cf80034940fac69
SSDEEP

768:/5sbBfAY3H+JtDxOTy6Bk+LE3Ghnmby9EUxl8tiSn82fr8zZ3XnXPMddQ1YLAwTg:/5sy+pBk+LE3Ghnmby9EUxl8tLn82frO

Score

8^/10

discovery exploit

Malware Config

Signatures

Possible privilege escalation attempt 8 IoCs
exploit

Processes:

icacls.exetakeown.exeicacls.exetakeown.exeicacls.exetakeown.exeicacls.exetakeown.exe

pid process

624 icacls.exe
1072 takeown.exe
864 icacls.exe
1684 takeown.exe
1704 icacls.exe
1724 takeown.exe
1364 icacls.exe
1176 takeown.exe
Modifies file permissions 1 TTPs 8 IoCs
discovery

File Permissions Modification
T1222

Processes:

icacls.exetakeown.exeicacls.exetakeown.exeicacls.exetakeown.exeicacls.exetakeown.exe

pid process

864 icacls.exe
1684 takeown.exe
1704 icacls.exe
1724 takeown.exe
1364 icacls.exe
1176 takeown.exe
624 icacls.exe
1072 takeown.exe

pid	process
624	icacls.exe
1072	takeown.exe
864	icacls.exe
1684	takeown.exe
1704	icacls.exe
1724	takeown.exe
1364	icacls.exe
1176	takeown.exe

pid	process
864	icacls.exe
1684	takeown.exe
1704	icacls.exe
1724	takeown.exe
1364	icacls.exe
1176	takeown.exe
624	icacls.exe
1072	takeown.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

takeown.exetakeown.exetakeown.exetakeown.exe

description	pid	process
Token: SeTakeOwnershipPrivilege	1176	takeown.exe
Token: SeTakeOwnershipPrivilege	1724	takeown.exe
Token: SeTakeOwnershipPrivilege	1072	takeown.exe
Token: SeTakeOwnershipPrivilege	1684	takeown.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

1577b7cbb5459a9b57afb778b9041e63dad06b7ef9352c4b7145778fde10f478.exe

pid process

1516 1577b7cbb5459a9b57afb778b9041e63dad06b7ef9352c4b7145778fde10f478.exe

pid	process
1516	1577b7cbb5459a9b57afb778b9041e63dad06b7ef9352c4b7145778fde10f478.exe

Suspicious use of WriteProcessMemory 32 IoCs

Processes:

1577b7cbb5459a9b57afb778b9041e63dad06b7ef9352c4b7145778fde10f478.exe

description	pid	process	target process
PID 1516 wrote to memory of 1176	1516	1577b7cbb5459a9b57afb778b9041e63dad06b7ef9352c4b7145778fde10f478.exe	takeown.exe
PID 1516 wrote to memory of 1176	1516	1577b7cbb5459a9b57afb778b9041e63dad06b7ef9352c4b7145778fde10f478.exe	takeown.exe
PID 1516 wrote to memory of 1176	1516	1577b7cbb5459a9b57afb778b9041e63dad06b7ef9352c4b7145778fde10f478.exe	takeown.exe
PID 1516 wrote to memory of 1176	1516	1577b7cbb5459a9b57afb778b9041e63dad06b7ef9352c4b7145778fde10f478.exe	takeown.exe
PID 1516 wrote to memory of 624	1516	1577b7cbb5459a9b57afb778b9041e63dad06b7ef9352c4b7145778fde10f478.exe	icacls.exe
PID 1516 wrote to memory of 624	1516	1577b7cbb5459a9b57afb778b9041e63dad06b7ef9352c4b7145778fde10f478.exe	icacls.exe
PID 1516 wrote to memory of 624	1516	1577b7cbb5459a9b57afb778b9041e63dad06b7ef9352c4b7145778fde10f478.exe	icacls.exe
PID 1516 wrote to memory of 624	1516	1577b7cbb5459a9b57afb778b9041e63dad06b7ef9352c4b7145778fde10f478.exe	icacls.exe
PID 1516 wrote to memory of 1072	1516	1577b7cbb5459a9b57afb778b9041e63dad06b7ef9352c4b7145778fde10f478.exe	takeown.exe
PID 1516 wrote to memory of 1072	1516	1577b7cbb5459a9b57afb778b9041e63dad06b7ef9352c4b7145778fde10f478.exe	takeown.exe
PID 1516 wrote to memory of 1072	1516	1577b7cbb5459a9b57afb778b9041e63dad06b7ef9352c4b7145778fde10f478.exe	takeown.exe
PID 1516 wrote to memory of 1072	1516	1577b7cbb5459a9b57afb778b9041e63dad06b7ef9352c4b7145778fde10f478.exe	takeown.exe
PID 1516 wrote to memory of 864	1516	1577b7cbb5459a9b57afb778b9041e63dad06b7ef9352c4b7145778fde10f478.exe	icacls.exe
PID 1516 wrote to memory of 864	1516	1577b7cbb5459a9b57afb778b9041e63dad06b7ef9352c4b7145778fde10f478.exe	icacls.exe
PID 1516 wrote to memory of 864	1516	1577b7cbb5459a9b57afb778b9041e63dad06b7ef9352c4b7145778fde10f478.exe	icacls.exe
PID 1516 wrote to memory of 864	1516	1577b7cbb5459a9b57afb778b9041e63dad06b7ef9352c4b7145778fde10f478.exe	icacls.exe
PID 1516 wrote to memory of 1684	1516	1577b7cbb5459a9b57afb778b9041e63dad06b7ef9352c4b7145778fde10f478.exe	takeown.exe
PID 1516 wrote to memory of 1684	1516	1577b7cbb5459a9b57afb778b9041e63dad06b7ef9352c4b7145778fde10f478.exe	takeown.exe
PID 1516 wrote to memory of 1684	1516	1577b7cbb5459a9b57afb778b9041e63dad06b7ef9352c4b7145778fde10f478.exe	takeown.exe
PID 1516 wrote to memory of 1684	1516	1577b7cbb5459a9b57afb778b9041e63dad06b7ef9352c4b7145778fde10f478.exe	takeown.exe
PID 1516 wrote to memory of 1704	1516	1577b7cbb5459a9b57afb778b9041e63dad06b7ef9352c4b7145778fde10f478.exe	icacls.exe
PID 1516 wrote to memory of 1704	1516	1577b7cbb5459a9b57afb778b9041e63dad06b7ef9352c4b7145778fde10f478.exe	icacls.exe
PID 1516 wrote to memory of 1704	1516	1577b7cbb5459a9b57afb778b9041e63dad06b7ef9352c4b7145778fde10f478.exe	icacls.exe
PID 1516 wrote to memory of 1704	1516	1577b7cbb5459a9b57afb778b9041e63dad06b7ef9352c4b7145778fde10f478.exe	icacls.exe
PID 1516 wrote to memory of 1724	1516	1577b7cbb5459a9b57afb778b9041e63dad06b7ef9352c4b7145778fde10f478.exe	takeown.exe
PID 1516 wrote to memory of 1724	1516	1577b7cbb5459a9b57afb778b9041e63dad06b7ef9352c4b7145778fde10f478.exe	takeown.exe
PID 1516 wrote to memory of 1724	1516	1577b7cbb5459a9b57afb778b9041e63dad06b7ef9352c4b7145778fde10f478.exe	takeown.exe
PID 1516 wrote to memory of 1724	1516	1577b7cbb5459a9b57afb778b9041e63dad06b7ef9352c4b7145778fde10f478.exe	takeown.exe
PID 1516 wrote to memory of 1364	1516	1577b7cbb5459a9b57afb778b9041e63dad06b7ef9352c4b7145778fde10f478.exe	icacls.exe
PID 1516 wrote to memory of 1364	1516	1577b7cbb5459a9b57afb778b9041e63dad06b7ef9352c4b7145778fde10f478.exe	icacls.exe
PID 1516 wrote to memory of 1364	1516	1577b7cbb5459a9b57afb778b9041e63dad06b7ef9352c4b7145778fde10f478.exe	icacls.exe
PID 1516 wrote to memory of 1364	1516	1577b7cbb5459a9b57afb778b9041e63dad06b7ef9352c4b7145778fde10f478.exe	icacls.exe

C:\Users\Admin\AppData\Local\Temp\1577b7cbb5459a9b57afb778b9041e63dad06b7ef9352c4b7145778fde10f478.exe
"C:\Users\Admin\AppData\Local\Temp\1577b7cbb5459a9b57afb778b9041e63dad06b7ef9352c4b7145778fde10f478.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1516

C:\Windows\SysWOW64\takeown.exe
C:\Windows\System32\takeown.exe /f "C:\Windows\System32\cmd.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:1176

C:\Windows\SysWOW64\icacls.exe
C:\Windows\System32\icacls.exe "C:\Windows\System32\cmd.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:624

C:\Windows\SysWOW64\takeown.exe
C:\Windows\System32\takeown.exe /f "C:\Windows\System32\ftp.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:1072

C:\Windows\SysWOW64\icacls.exe
C:\Windows\System32\icacls.exe "C:\Windows\System32\ftp.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:864

C:\Windows\SysWOW64\takeown.exe
C:\Windows\System32\takeown.exe /f "C:\Windows\System32\wscript.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:1684

C:\Windows\SysWOW64\icacls.exe
C:\Windows\System32\icacls.exe "C:\Windows\System32\wscript.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1704

C:\Windows\SysWOW64\takeown.exe
C:\Windows\System32\takeown.exe /f "C:\Windows\System32\cscript.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:1724

C:\Windows\SysWOW64\icacls.exe
C:\Windows\System32\icacls.exe "C:\Windows\System32\cscript.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1364

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File Permissions Modification

1

T1222

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/624-57-0x0000000000000000-mapping.dmp

Download
memory/864-59-0x0000000000000000-mapping.dmp

Download
memory/1072-58-0x0000000000000000-mapping.dmp

Download
memory/1176-56-0x0000000000000000-mapping.dmp

Download
memory/1364-63-0x0000000000000000-mapping.dmp

Download
memory/1684-60-0x0000000000000000-mapping.dmp

Download
memory/1704-61-0x0000000000000000-mapping.dmp

Download
memory/1724-62-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing