ffa7ce02b730bb3c3ed16f18c3a80cf92b2a60b35a7d094db3d2941d35bb2710

General

Target

ffa7ce02b730bb3c3ed16f18c3a80cf92b2a60b35a7d094db3d2941d35bb2710.exe
Size

40KB
MD5

06dda73f98dda66b16a4f14596eaaeb0
SHA1

82722f1f62be5bd42e3535ffa8805ecd5c76ad66
SHA256

ffa7ce02b730bb3c3ed16f18c3a80cf92b2a60b35a7d094db3d2941d35bb2710
SHA512

4a383f009b3b60bedb4218857aa4ebff5e44693130f4b0a0ea5ba91421329eddeada78ecef381bc6e286e73bccb30dabd82c62f8ec295bae3b220a8c766b2086
SSDEEP

768:/ObJHX1FVXLHYbpV0O5NEvwjpnkIYNCCYbhFo+kKEKVWfcOz:/O9X1jHypV0O5NBjpnkIYNCCYbhFo+kn

Score

8^/10

discovery exploit

Malware Config

Signatures

Possible privilege escalation attempt 8 IoCs
exploit

Processes:

takeown.exeicacls.exetakeown.exeicacls.exetakeown.exeicacls.exetakeown.exeicacls.exe

pid process

1724 takeown.exe
1156 icacls.exe
948 takeown.exe
944 icacls.exe
1760 takeown.exe
580 icacls.exe
892 takeown.exe
268 icacls.exe
Modifies file permissions 1 TTPs 8 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exetakeown.exeicacls.exetakeown.exeicacls.exetakeown.exeicacls.exetakeown.exe

pid process

1156 icacls.exe
948 takeown.exe
944 icacls.exe
1760 takeown.exe
580 icacls.exe
892 takeown.exe
268 icacls.exe
1724 takeown.exe

pid	process
1724	takeown.exe
1156	icacls.exe
948	takeown.exe
944	icacls.exe
1760	takeown.exe
580	icacls.exe
892	takeown.exe
268	icacls.exe

pid	process
1156	icacls.exe
948	takeown.exe
944	icacls.exe
1760	takeown.exe
580	icacls.exe
892	takeown.exe
268	icacls.exe
1724	takeown.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

takeown.exetakeown.exetakeown.exetakeown.exe

description	pid	process
Token: SeTakeOwnershipPrivilege	892	takeown.exe
Token: SeTakeOwnershipPrivilege	948	takeown.exe
Token: SeTakeOwnershipPrivilege	1760	takeown.exe
Token: SeTakeOwnershipPrivilege	1724	takeown.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

ffa7ce02b730bb3c3ed16f18c3a80cf92b2a60b35a7d094db3d2941d35bb2710.exe

pid process

1048 ffa7ce02b730bb3c3ed16f18c3a80cf92b2a60b35a7d094db3d2941d35bb2710.exe

pid	process
1048	ffa7ce02b730bb3c3ed16f18c3a80cf92b2a60b35a7d094db3d2941d35bb2710.exe

Suspicious use of WriteProcessMemory 32 IoCs

Processes:

ffa7ce02b730bb3c3ed16f18c3a80cf92b2a60b35a7d094db3d2941d35bb2710.exe

description	pid	process	target process
PID 1048 wrote to memory of 948	1048	ffa7ce02b730bb3c3ed16f18c3a80cf92b2a60b35a7d094db3d2941d35bb2710.exe	takeown.exe
PID 1048 wrote to memory of 948	1048	ffa7ce02b730bb3c3ed16f18c3a80cf92b2a60b35a7d094db3d2941d35bb2710.exe	takeown.exe
PID 1048 wrote to memory of 948	1048	ffa7ce02b730bb3c3ed16f18c3a80cf92b2a60b35a7d094db3d2941d35bb2710.exe	takeown.exe
PID 1048 wrote to memory of 948	1048	ffa7ce02b730bb3c3ed16f18c3a80cf92b2a60b35a7d094db3d2941d35bb2710.exe	takeown.exe
PID 1048 wrote to memory of 944	1048	ffa7ce02b730bb3c3ed16f18c3a80cf92b2a60b35a7d094db3d2941d35bb2710.exe	icacls.exe
PID 1048 wrote to memory of 944	1048	ffa7ce02b730bb3c3ed16f18c3a80cf92b2a60b35a7d094db3d2941d35bb2710.exe	icacls.exe
PID 1048 wrote to memory of 944	1048	ffa7ce02b730bb3c3ed16f18c3a80cf92b2a60b35a7d094db3d2941d35bb2710.exe	icacls.exe
PID 1048 wrote to memory of 944	1048	ffa7ce02b730bb3c3ed16f18c3a80cf92b2a60b35a7d094db3d2941d35bb2710.exe	icacls.exe
PID 1048 wrote to memory of 1760	1048	ffa7ce02b730bb3c3ed16f18c3a80cf92b2a60b35a7d094db3d2941d35bb2710.exe	takeown.exe
PID 1048 wrote to memory of 1760	1048	ffa7ce02b730bb3c3ed16f18c3a80cf92b2a60b35a7d094db3d2941d35bb2710.exe	takeown.exe
PID 1048 wrote to memory of 1760	1048	ffa7ce02b730bb3c3ed16f18c3a80cf92b2a60b35a7d094db3d2941d35bb2710.exe	takeown.exe
PID 1048 wrote to memory of 1760	1048	ffa7ce02b730bb3c3ed16f18c3a80cf92b2a60b35a7d094db3d2941d35bb2710.exe	takeown.exe
PID 1048 wrote to memory of 580	1048	ffa7ce02b730bb3c3ed16f18c3a80cf92b2a60b35a7d094db3d2941d35bb2710.exe	icacls.exe
PID 1048 wrote to memory of 580	1048	ffa7ce02b730bb3c3ed16f18c3a80cf92b2a60b35a7d094db3d2941d35bb2710.exe	icacls.exe
PID 1048 wrote to memory of 580	1048	ffa7ce02b730bb3c3ed16f18c3a80cf92b2a60b35a7d094db3d2941d35bb2710.exe	icacls.exe
PID 1048 wrote to memory of 580	1048	ffa7ce02b730bb3c3ed16f18c3a80cf92b2a60b35a7d094db3d2941d35bb2710.exe	icacls.exe
PID 1048 wrote to memory of 892	1048	ffa7ce02b730bb3c3ed16f18c3a80cf92b2a60b35a7d094db3d2941d35bb2710.exe	takeown.exe
PID 1048 wrote to memory of 892	1048	ffa7ce02b730bb3c3ed16f18c3a80cf92b2a60b35a7d094db3d2941d35bb2710.exe	takeown.exe
PID 1048 wrote to memory of 892	1048	ffa7ce02b730bb3c3ed16f18c3a80cf92b2a60b35a7d094db3d2941d35bb2710.exe	takeown.exe
PID 1048 wrote to memory of 892	1048	ffa7ce02b730bb3c3ed16f18c3a80cf92b2a60b35a7d094db3d2941d35bb2710.exe	takeown.exe
PID 1048 wrote to memory of 268	1048	ffa7ce02b730bb3c3ed16f18c3a80cf92b2a60b35a7d094db3d2941d35bb2710.exe	icacls.exe
PID 1048 wrote to memory of 268	1048	ffa7ce02b730bb3c3ed16f18c3a80cf92b2a60b35a7d094db3d2941d35bb2710.exe	icacls.exe
PID 1048 wrote to memory of 268	1048	ffa7ce02b730bb3c3ed16f18c3a80cf92b2a60b35a7d094db3d2941d35bb2710.exe	icacls.exe
PID 1048 wrote to memory of 268	1048	ffa7ce02b730bb3c3ed16f18c3a80cf92b2a60b35a7d094db3d2941d35bb2710.exe	icacls.exe
PID 1048 wrote to memory of 1724	1048	ffa7ce02b730bb3c3ed16f18c3a80cf92b2a60b35a7d094db3d2941d35bb2710.exe	takeown.exe
PID 1048 wrote to memory of 1724	1048	ffa7ce02b730bb3c3ed16f18c3a80cf92b2a60b35a7d094db3d2941d35bb2710.exe	takeown.exe
PID 1048 wrote to memory of 1724	1048	ffa7ce02b730bb3c3ed16f18c3a80cf92b2a60b35a7d094db3d2941d35bb2710.exe	takeown.exe
PID 1048 wrote to memory of 1724	1048	ffa7ce02b730bb3c3ed16f18c3a80cf92b2a60b35a7d094db3d2941d35bb2710.exe	takeown.exe
PID 1048 wrote to memory of 1156	1048	ffa7ce02b730bb3c3ed16f18c3a80cf92b2a60b35a7d094db3d2941d35bb2710.exe	icacls.exe
PID 1048 wrote to memory of 1156	1048	ffa7ce02b730bb3c3ed16f18c3a80cf92b2a60b35a7d094db3d2941d35bb2710.exe	icacls.exe
PID 1048 wrote to memory of 1156	1048	ffa7ce02b730bb3c3ed16f18c3a80cf92b2a60b35a7d094db3d2941d35bb2710.exe	icacls.exe
PID 1048 wrote to memory of 1156	1048	ffa7ce02b730bb3c3ed16f18c3a80cf92b2a60b35a7d094db3d2941d35bb2710.exe	icacls.exe

C:\Users\Admin\AppData\Local\Temp\ffa7ce02b730bb3c3ed16f18c3a80cf92b2a60b35a7d094db3d2941d35bb2710.exe
"C:\Users\Admin\AppData\Local\Temp\ffa7ce02b730bb3c3ed16f18c3a80cf92b2a60b35a7d094db3d2941d35bb2710.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1048

C:\Windows\SysWOW64\takeown.exe
C:\Windows\System32\takeown.exe /f "C:\Windows\System32\cmd.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:948

C:\Windows\SysWOW64\icacls.exe
C:\Windows\System32\icacls.exe "C:\Windows\System32\cmd.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:944

C:\Windows\SysWOW64\takeown.exe
C:\Windows\System32\takeown.exe /f "C:\Windows\System32\ftp.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:1760

C:\Windows\SysWOW64\icacls.exe
C:\Windows\System32\icacls.exe "C:\Windows\System32\ftp.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:580

C:\Windows\SysWOW64\takeown.exe
C:\Windows\System32\takeown.exe /f "C:\Windows\System32\wscript.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:892

C:\Windows\SysWOW64\icacls.exe
C:\Windows\System32\icacls.exe "C:\Windows\System32\wscript.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:268

C:\Windows\SysWOW64\takeown.exe
C:\Windows\System32\takeown.exe /f "C:\Windows\System32\cscript.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:1724

C:\Windows\SysWOW64\icacls.exe
C:\Windows\System32\icacls.exe "C:\Windows\System32\cscript.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1156

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

1

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/268-61-0x0000000000000000-mapping.dmp

Download
memory/580-59-0x0000000000000000-mapping.dmp

Download
memory/892-60-0x0000000000000000-mapping.dmp

Download
memory/944-57-0x0000000000000000-mapping.dmp

Download
memory/948-56-0x0000000000000000-mapping.dmp

Download
memory/1156-63-0x0000000000000000-mapping.dmp

Download
memory/1724-62-0x0000000000000000-mapping.dmp

Download
memory/1760-58-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing