b9ca1cf16954d9acd6df231bc5907c881afd2b91a5e3547c551fe4e9b657fc22

Analysis

max time kernel
37s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
28-10-2022 23:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b9ca1cf16954d9acd6df231bc5907c881afd2b91a5e3547c551fe4e9b657fc22.exe
Size

36KB
MD5

0c3a356abef9c4af054c3f12f8994920
SHA1

cf16d9187ac1e38181de60da74d7249b4a9c49d4
SHA256

b9ca1cf16954d9acd6df231bc5907c881afd2b91a5e3547c551fe4e9b657fc22
SHA512

60a1172ca4587719f80bd62a28dc2b59803b9ce18547b635d03f71f9d280962c26346ddddb9e4eacc47c6e9006b67bbae9fe2d8244d59f4577654d3a58efd317
SSDEEP

768:/FkyFv0ZexjUjfYzsEHXLeKorAQCvGjlJ:/FT0rsHq/jlJ

Score

8^/10

discovery exploit persistence

Malware Config

Signatures

Possible privilege escalation attempt 2 IoCs
exploit

Processes:

takeown.exeicacls.exe

pid process

2020 takeown.exe
984 icacls.exe
Modifies file permissions 1 TTPs 2 IoCs
discovery

File Permissions Modification
T1222

Processes:

takeown.exeicacls.exe

pid process

2020 takeown.exe
984 icacls.exe

pid	process
2020	takeown.exe
984	icacls.exe

pid	process
2020	takeown.exe
984	icacls.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

b9ca1cf16954d9acd6df231bc5907c881afd2b91a5e3547c551fe4e9b657fc22.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	b9ca1cf16954d9acd6df231bc5907c881afd2b91a5e3547c551fe4e9b657fc22.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\TPDFy = "C:\\Windows\\system32\\azoy.exe"	b9ca1cf16954d9acd6df231bc5907c881afd2b91a5e3547c551fe4e9b657fc22.exe

Drops file in System32 directory 2 IoCs

Processes:

b9ca1cf16954d9acd6df231bc5907c881afd2b91a5e3547c551fe4e9b657fc22.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\azoy.exe	b9ca1cf16954d9acd6df231bc5907c881afd2b91a5e3547c551fe4e9b657fc22.exe
File created	C:\Windows\SysWOW64\azoy.exe	b9ca1cf16954d9acd6df231bc5907c881afd2b91a5e3547c551fe4e9b657fc22.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

b9ca1cf16954d9acd6df231bc5907c881afd2b91a5e3547c551fe4e9b657fc22.exe

pid process

1672 b9ca1cf16954d9acd6df231bc5907c881afd2b91a5e3547c551fe4e9b657fc22.exe

pid	process
1672	b9ca1cf16954d9acd6df231bc5907c881afd2b91a5e3547c551fe4e9b657fc22.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

b9ca1cf16954d9acd6df231bc5907c881afd2b91a5e3547c551fe4e9b657fc22.exe

description	pid	process	target process
PID 1672 wrote to memory of 2020	1672	b9ca1cf16954d9acd6df231bc5907c881afd2b91a5e3547c551fe4e9b657fc22.exe	takeown.exe
PID 1672 wrote to memory of 2020	1672	b9ca1cf16954d9acd6df231bc5907c881afd2b91a5e3547c551fe4e9b657fc22.exe	takeown.exe
PID 1672 wrote to memory of 2020	1672	b9ca1cf16954d9acd6df231bc5907c881afd2b91a5e3547c551fe4e9b657fc22.exe	takeown.exe
PID 1672 wrote to memory of 2020	1672	b9ca1cf16954d9acd6df231bc5907c881afd2b91a5e3547c551fe4e9b657fc22.exe	takeown.exe
PID 1672 wrote to memory of 984	1672	b9ca1cf16954d9acd6df231bc5907c881afd2b91a5e3547c551fe4e9b657fc22.exe	icacls.exe
PID 1672 wrote to memory of 984	1672	b9ca1cf16954d9acd6df231bc5907c881afd2b91a5e3547c551fe4e9b657fc22.exe	icacls.exe
PID 1672 wrote to memory of 984	1672	b9ca1cf16954d9acd6df231bc5907c881afd2b91a5e3547c551fe4e9b657fc22.exe	icacls.exe
PID 1672 wrote to memory of 984	1672	b9ca1cf16954d9acd6df231bc5907c881afd2b91a5e3547c551fe4e9b657fc22.exe	icacls.exe

C:\Users\Admin\AppData\Local\Temp\b9ca1cf16954d9acd6df231bc5907c881afd2b91a5e3547c551fe4e9b657fc22.exe
"C:\Users\Admin\AppData\Local\Temp\b9ca1cf16954d9acd6df231bc5907c881afd2b91a5e3547c551fe4e9b657fc22.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1672

C:\Windows\SysWOW64\takeown.exe
C:\Windows\system32\takeown.exe /f "C:\Windows\system32\azoy.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:2020

C:\Windows\SysWOW64\icacls.exe
C:\Windows\system32\icacls.exe "C:\Windows\system32\azoy.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:984

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

File Permissions Modification

T1222

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\azoy.exe
Filesize
36KB

MD5
0c3a356abef9c4af054c3f12f8994920

SHA1
cf16d9187ac1e38181de60da74d7249b4a9c49d4

SHA256
b9ca1cf16954d9acd6df231bc5907c881afd2b91a5e3547c551fe4e9b657fc22

SHA512
60a1172ca4587719f80bd62a28dc2b59803b9ce18547b635d03f71f9d280962c26346ddddb9e4eacc47c6e9006b67bbae9fe2d8244d59f4577654d3a58efd317

Download Submit
memory/984-57-0x0000000000000000-mapping.dmp

Download
memory/2020-56-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads