1577b7cbb5459a9b57afb778b9041e63dad06b7ef9352c4b7145778fde10f478

General

Target

1577b7cbb5459a9b57afb778b9041e63dad06b7ef9352c4b7145778fde10f478.exe
Size

40KB
MD5

0cab4f9123d3e29604999acbbcfb38b0
SHA1

b16deda6490ba04fb38b6958d96498c3143a52dd
SHA256

1577b7cbb5459a9b57afb778b9041e63dad06b7ef9352c4b7145778fde10f478
SHA512

9275012ed16207b04e27caaa608aca10e715a2b533bd0f0cd872a012da961f9b534ab24e4a0b5f4316a14276f1a81bda1bfea70bf3549fb27cf80034940fac69
SSDEEP

768:/5sbBfAY3H+JtDxOTy6Bk+LE3Ghnmby9EUxl8tiSn82fr8zZ3XnXPMddQ1YLAwTg:/5sy+pBk+LE3Ghnmby9EUxl8tLn82frO

Score

8^/10

discovery exploit

Malware Config

Signatures

Possible privilege escalation attempt 8 IoCs
exploit

Processes:

takeown.exeicacls.exetakeown.exeicacls.exetakeown.exetakeown.exeicacls.exeicacls.exe

pid process

2988 takeown.exe
3692 icacls.exe
4812 takeown.exe
2180 icacls.exe
3504 takeown.exe
2212 takeown.exe
3048 icacls.exe
3844 icacls.exe
Modifies file permissions 1 TTPs 8 IoCs
discovery

File Permissions Modification
T1222

Processes:

icacls.exetakeown.exeicacls.exetakeown.exeicacls.exetakeown.exetakeown.exeicacls.exe

pid process

3844 icacls.exe
2988 takeown.exe
3692 icacls.exe
4812 takeown.exe
2180 icacls.exe
3504 takeown.exe
2212 takeown.exe
3048 icacls.exe

pid	process
2988	takeown.exe
3692	icacls.exe
4812	takeown.exe
2180	icacls.exe
3504	takeown.exe
2212	takeown.exe
3048	icacls.exe
3844	icacls.exe

pid	process
3844	icacls.exe
2988	takeown.exe
3692	icacls.exe
4812	takeown.exe
2180	icacls.exe
3504	takeown.exe
2212	takeown.exe
3048	icacls.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

takeown.exetakeown.exetakeown.exetakeown.exe

description	pid	process
Token: SeTakeOwnershipPrivilege	3504	takeown.exe
Token: SeTakeOwnershipPrivilege	2988	takeown.exe
Token: SeTakeOwnershipPrivilege	2212	takeown.exe
Token: SeTakeOwnershipPrivilege	4812	takeown.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

1577b7cbb5459a9b57afb778b9041e63dad06b7ef9352c4b7145778fde10f478.exe

pid process

4832 1577b7cbb5459a9b57afb778b9041e63dad06b7ef9352c4b7145778fde10f478.exe

pid	process
4832	1577b7cbb5459a9b57afb778b9041e63dad06b7ef9352c4b7145778fde10f478.exe

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

1577b7cbb5459a9b57afb778b9041e63dad06b7ef9352c4b7145778fde10f478.exe

description	pid	process	target process
PID 4832 wrote to memory of 4812	4832	1577b7cbb5459a9b57afb778b9041e63dad06b7ef9352c4b7145778fde10f478.exe	takeown.exe
PID 4832 wrote to memory of 4812	4832	1577b7cbb5459a9b57afb778b9041e63dad06b7ef9352c4b7145778fde10f478.exe	takeown.exe
PID 4832 wrote to memory of 4812	4832	1577b7cbb5459a9b57afb778b9041e63dad06b7ef9352c4b7145778fde10f478.exe	takeown.exe
PID 4832 wrote to memory of 2180	4832	1577b7cbb5459a9b57afb778b9041e63dad06b7ef9352c4b7145778fde10f478.exe	icacls.exe
PID 4832 wrote to memory of 2180	4832	1577b7cbb5459a9b57afb778b9041e63dad06b7ef9352c4b7145778fde10f478.exe	icacls.exe
PID 4832 wrote to memory of 2180	4832	1577b7cbb5459a9b57afb778b9041e63dad06b7ef9352c4b7145778fde10f478.exe	icacls.exe
PID 4832 wrote to memory of 3504	4832	1577b7cbb5459a9b57afb778b9041e63dad06b7ef9352c4b7145778fde10f478.exe	takeown.exe
PID 4832 wrote to memory of 3504	4832	1577b7cbb5459a9b57afb778b9041e63dad06b7ef9352c4b7145778fde10f478.exe	takeown.exe
PID 4832 wrote to memory of 3504	4832	1577b7cbb5459a9b57afb778b9041e63dad06b7ef9352c4b7145778fde10f478.exe	takeown.exe
PID 4832 wrote to memory of 3048	4832	1577b7cbb5459a9b57afb778b9041e63dad06b7ef9352c4b7145778fde10f478.exe	icacls.exe
PID 4832 wrote to memory of 3048	4832	1577b7cbb5459a9b57afb778b9041e63dad06b7ef9352c4b7145778fde10f478.exe	icacls.exe
PID 4832 wrote to memory of 3048	4832	1577b7cbb5459a9b57afb778b9041e63dad06b7ef9352c4b7145778fde10f478.exe	icacls.exe
PID 4832 wrote to memory of 2212	4832	1577b7cbb5459a9b57afb778b9041e63dad06b7ef9352c4b7145778fde10f478.exe	takeown.exe
PID 4832 wrote to memory of 2212	4832	1577b7cbb5459a9b57afb778b9041e63dad06b7ef9352c4b7145778fde10f478.exe	takeown.exe
PID 4832 wrote to memory of 2212	4832	1577b7cbb5459a9b57afb778b9041e63dad06b7ef9352c4b7145778fde10f478.exe	takeown.exe
PID 4832 wrote to memory of 3844	4832	1577b7cbb5459a9b57afb778b9041e63dad06b7ef9352c4b7145778fde10f478.exe	icacls.exe
PID 4832 wrote to memory of 3844	4832	1577b7cbb5459a9b57afb778b9041e63dad06b7ef9352c4b7145778fde10f478.exe	icacls.exe
PID 4832 wrote to memory of 3844	4832	1577b7cbb5459a9b57afb778b9041e63dad06b7ef9352c4b7145778fde10f478.exe	icacls.exe
PID 4832 wrote to memory of 2988	4832	1577b7cbb5459a9b57afb778b9041e63dad06b7ef9352c4b7145778fde10f478.exe	takeown.exe
PID 4832 wrote to memory of 2988	4832	1577b7cbb5459a9b57afb778b9041e63dad06b7ef9352c4b7145778fde10f478.exe	takeown.exe
PID 4832 wrote to memory of 2988	4832	1577b7cbb5459a9b57afb778b9041e63dad06b7ef9352c4b7145778fde10f478.exe	takeown.exe
PID 4832 wrote to memory of 3692	4832	1577b7cbb5459a9b57afb778b9041e63dad06b7ef9352c4b7145778fde10f478.exe	icacls.exe
PID 4832 wrote to memory of 3692	4832	1577b7cbb5459a9b57afb778b9041e63dad06b7ef9352c4b7145778fde10f478.exe	icacls.exe
PID 4832 wrote to memory of 3692	4832	1577b7cbb5459a9b57afb778b9041e63dad06b7ef9352c4b7145778fde10f478.exe	icacls.exe

C:\Users\Admin\AppData\Local\Temp\1577b7cbb5459a9b57afb778b9041e63dad06b7ef9352c4b7145778fde10f478.exe
"C:\Users\Admin\AppData\Local\Temp\1577b7cbb5459a9b57afb778b9041e63dad06b7ef9352c4b7145778fde10f478.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4832

C:\Windows\SysWOW64\takeown.exe
C:\Windows\System32\takeown.exe /f "C:\Windows\System32\cmd.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:4812

C:\Windows\SysWOW64\icacls.exe
C:\Windows\System32\icacls.exe "C:\Windows\System32\cmd.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:2180

C:\Windows\SysWOW64\takeown.exe
C:\Windows\System32\takeown.exe /f "C:\Windows\System32\ftp.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:3504

C:\Windows\SysWOW64\takeown.exe
C:\Windows\System32\takeown.exe /f "C:\Windows\System32\wscript.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:2212

C:\Windows\SysWOW64\icacls.exe
C:\Windows\System32\icacls.exe "C:\Windows\System32\ftp.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:3048

C:\Windows\SysWOW64\icacls.exe
C:\Windows\System32\icacls.exe "C:\Windows\System32\wscript.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:3844

C:\Windows\SysWOW64\takeown.exe
C:\Windows\System32\takeown.exe /f "C:\Windows\System32\cscript.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:2988

C:\Windows\SysWOW64\icacls.exe
C:\Windows\System32\icacls.exe "C:\Windows\System32\cscript.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:3692

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File Permissions Modification

1

T1222

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2180-135-0x0000000000000000-mapping.dmp

Download
memory/2212-138-0x0000000000000000-mapping.dmp

Download
memory/2988-140-0x0000000000000000-mapping.dmp

Download
memory/3048-137-0x0000000000000000-mapping.dmp

Download
memory/3504-136-0x0000000000000000-mapping.dmp

Download
memory/3692-141-0x0000000000000000-mapping.dmp

Download
memory/3844-139-0x0000000000000000-mapping.dmp

Download
memory/4812-134-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing