b05e74890ce4e340c6d0b6f156e001d15583d265c69021ea4fdf47dd9e718c35

Analysis

max time kernel
44s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
29-10-2022 20:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b05e74890ce4e340c6d0b6f156e001d15583d265c69021ea4fdf47dd9e718c35.exe
Size

40KB
MD5

a3629e1ac9a406713d4301202e559d00
SHA1

38504d98f976fa87da12a9c0165f5e37dc33611a
SHA256

b05e74890ce4e340c6d0b6f156e001d15583d265c69021ea4fdf47dd9e718c35
SHA512

76ae82802fc763c2991e2d41e85934ff13dacf81fe19c82051cdd70c99e66ab590f540664f8c9342312cde6c02b11551b3d9f2f37a85d01ae9bfa48463939540
SSDEEP

768:/o8zm5DKduqIO6XFUztOjGVYTxtmBUASDmyTgB97:/54sCxtEyTgB97

Score

8^/10

discovery exploit persistence

Malware Config

Signatures

Possible privilege escalation attempt 2 IoCs
exploit

Processes:

takeown.exeicacls.exe

pid process

1696 takeown.exe
1472 icacls.exe
Modifies file permissions 1 TTPs 2 IoCs
discovery

File Permissions Modification
T1222

Processes:

icacls.exetakeown.exe

pid process

1472 icacls.exe
1696 takeown.exe

pid	process
1696	takeown.exe
1472	icacls.exe

pid	process
1472	icacls.exe
1696	takeown.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

b05e74890ce4e340c6d0b6f156e001d15583d265c69021ea4fdf47dd9e718c35.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	b05e74890ce4e340c6d0b6f156e001d15583d265c69021ea4fdf47dd9e718c35.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mPjMt = "C:\\Windows\\system32\\ldqgq.exe"	b05e74890ce4e340c6d0b6f156e001d15583d265c69021ea4fdf47dd9e718c35.exe

Drops file in System32 directory 2 IoCs

Processes:

b05e74890ce4e340c6d0b6f156e001d15583d265c69021ea4fdf47dd9e718c35.exe

description	ioc	process
File created	C:\Windows\SysWOW64\ldqgq.exe	b05e74890ce4e340c6d0b6f156e001d15583d265c69021ea4fdf47dd9e718c35.exe
File opened for modification	C:\Windows\SysWOW64\ldqgq.exe	b05e74890ce4e340c6d0b6f156e001d15583d265c69021ea4fdf47dd9e718c35.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

b05e74890ce4e340c6d0b6f156e001d15583d265c69021ea4fdf47dd9e718c35.exe

pid process

1464 b05e74890ce4e340c6d0b6f156e001d15583d265c69021ea4fdf47dd9e718c35.exe

pid	process
1464	b05e74890ce4e340c6d0b6f156e001d15583d265c69021ea4fdf47dd9e718c35.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

b05e74890ce4e340c6d0b6f156e001d15583d265c69021ea4fdf47dd9e718c35.exe

description	pid	process	target process
PID 1464 wrote to memory of 1696	1464	b05e74890ce4e340c6d0b6f156e001d15583d265c69021ea4fdf47dd9e718c35.exe	takeown.exe
PID 1464 wrote to memory of 1696	1464	b05e74890ce4e340c6d0b6f156e001d15583d265c69021ea4fdf47dd9e718c35.exe	takeown.exe
PID 1464 wrote to memory of 1696	1464	b05e74890ce4e340c6d0b6f156e001d15583d265c69021ea4fdf47dd9e718c35.exe	takeown.exe
PID 1464 wrote to memory of 1696	1464	b05e74890ce4e340c6d0b6f156e001d15583d265c69021ea4fdf47dd9e718c35.exe	takeown.exe
PID 1464 wrote to memory of 1472	1464	b05e74890ce4e340c6d0b6f156e001d15583d265c69021ea4fdf47dd9e718c35.exe	icacls.exe
PID 1464 wrote to memory of 1472	1464	b05e74890ce4e340c6d0b6f156e001d15583d265c69021ea4fdf47dd9e718c35.exe	icacls.exe
PID 1464 wrote to memory of 1472	1464	b05e74890ce4e340c6d0b6f156e001d15583d265c69021ea4fdf47dd9e718c35.exe	icacls.exe
PID 1464 wrote to memory of 1472	1464	b05e74890ce4e340c6d0b6f156e001d15583d265c69021ea4fdf47dd9e718c35.exe	icacls.exe

C:\Users\Admin\AppData\Local\Temp\b05e74890ce4e340c6d0b6f156e001d15583d265c69021ea4fdf47dd9e718c35.exe
"C:\Users\Admin\AppData\Local\Temp\b05e74890ce4e340c6d0b6f156e001d15583d265c69021ea4fdf47dd9e718c35.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1464

C:\Windows\SysWOW64\takeown.exe
C:\Windows\system32\takeown.exe /f "C:\Windows\system32\ldqgq.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1696

C:\Windows\SysWOW64\icacls.exe
C:\Windows\system32\icacls.exe "C:\Windows\system32\ldqgq.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1472

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

File Permissions Modification

T1222

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\ldqgq.exe
Filesize
40KB

MD5
a3629e1ac9a406713d4301202e559d00

SHA1
38504d98f976fa87da12a9c0165f5e37dc33611a

SHA256
b05e74890ce4e340c6d0b6f156e001d15583d265c69021ea4fdf47dd9e718c35

SHA512
76ae82802fc763c2991e2d41e85934ff13dacf81fe19c82051cdd70c99e66ab590f540664f8c9342312cde6c02b11551b3d9f2f37a85d01ae9bfa48463939540

Download Submit
memory/1472-57-0x0000000000000000-mapping.dmp

Download
memory/1696-56-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads