b05e74890ce4e340c6d0b6f156e001d15583d265c69021ea4fdf47dd9e718c35

Analysis

max time kernel
44s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
29/10/2022, 20:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b05e74890ce4e340c6d0b6f156e001d15583d265c69021ea4fdf47dd9e718c35.exe
Size

40KB
MD5

a3629e1ac9a406713d4301202e559d00
SHA1

38504d98f976fa87da12a9c0165f5e37dc33611a
SHA256

b05e74890ce4e340c6d0b6f156e001d15583d265c69021ea4fdf47dd9e718c35
SHA512

76ae82802fc763c2991e2d41e85934ff13dacf81fe19c82051cdd70c99e66ab590f540664f8c9342312cde6c02b11551b3d9f2f37a85d01ae9bfa48463939540
SSDEEP

768:/o8zm5DKduqIO6XFUztOjGVYTxtmBUASDmyTgB97:/54sCxtEyTgB97

Score

8^/10

discovery exploit persistence

Malware Config

Signatures

Possible privilege escalation attempt 2 IoCs

exploit

pid	Process
1696	takeown.exe
1472	icacls.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1472	icacls.exe
1696	takeown.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	b05e74890ce4e340c6d0b6f156e001d15583d265c69021ea4fdf47dd9e718c35.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mPjMt = "C:\\Windows\\system32\\ldqgq.exe"	b05e74890ce4e340c6d0b6f156e001d15583d265c69021ea4fdf47dd9e718c35.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\ldqgq.exe	b05e74890ce4e340c6d0b6f156e001d15583d265c69021ea4fdf47dd9e718c35.exe
File opened for modification	C:\Windows\SysWOW64\ldqgq.exe	b05e74890ce4e340c6d0b6f156e001d15583d265c69021ea4fdf47dd9e718c35.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1464	b05e74890ce4e340c6d0b6f156e001d15583d265c69021ea4fdf47dd9e718c35.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1464 wrote to memory of 1696	1464	b05e74890ce4e340c6d0b6f156e001d15583d265c69021ea4fdf47dd9e718c35.exe	26
PID 1464 wrote to memory of 1696	1464	b05e74890ce4e340c6d0b6f156e001d15583d265c69021ea4fdf47dd9e718c35.exe	26
PID 1464 wrote to memory of 1696	1464	b05e74890ce4e340c6d0b6f156e001d15583d265c69021ea4fdf47dd9e718c35.exe	26
PID 1464 wrote to memory of 1696	1464	b05e74890ce4e340c6d0b6f156e001d15583d265c69021ea4fdf47dd9e718c35.exe	26
PID 1464 wrote to memory of 1472	1464	b05e74890ce4e340c6d0b6f156e001d15583d265c69021ea4fdf47dd9e718c35.exe	27
PID 1464 wrote to memory of 1472	1464	b05e74890ce4e340c6d0b6f156e001d15583d265c69021ea4fdf47dd9e718c35.exe	27
PID 1464 wrote to memory of 1472	1464	b05e74890ce4e340c6d0b6f156e001d15583d265c69021ea4fdf47dd9e718c35.exe	27
PID 1464 wrote to memory of 1472	1464	b05e74890ce4e340c6d0b6f156e001d15583d265c69021ea4fdf47dd9e718c35.exe	27

C:\Users\Admin\AppData\Local\Temp\b05e74890ce4e340c6d0b6f156e001d15583d265c69021ea4fdf47dd9e718c35.exe
"C:\Users\Admin\AppData\Local\Temp\b05e74890ce4e340c6d0b6f156e001d15583d265c69021ea4fdf47dd9e718c35.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1464
- C:\Windows\SysWOW64\takeown.exe
  C:\Windows\system32\takeown.exe /f "C:\Windows\system32\ldqgq.exe"
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:1696
- C:\Windows\SysWOW64\icacls.exe
  C:\Windows\system32\icacls.exe "C:\Windows\system32\ldqgq.exe" /grant Users:F
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:1472

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\ldqgq.exe

Filesize
40KB

MD5
a3629e1ac9a406713d4301202e559d00

SHA1
38504d98f976fa87da12a9c0165f5e37dc33611a

SHA256
b05e74890ce4e340c6d0b6f156e001d15583d265c69021ea4fdf47dd9e718c35

SHA512
76ae82802fc763c2991e2d41e85934ff13dacf81fe19c82051cdd70c99e66ab590f540664f8c9342312cde6c02b11551b3d9f2f37a85d01ae9bfa48463939540

Download Submit