ffa7ce02b730bb3c3ed16f18c3a80cf92b2a60b35a7d094db3d2941d35bb2710

General

Target

ffa7ce02b730bb3c3ed16f18c3a80cf92b2a60b35a7d094db3d2941d35bb2710.exe
Size

40KB
MD5

06dda73f98dda66b16a4f14596eaaeb0
SHA1

82722f1f62be5bd42e3535ffa8805ecd5c76ad66
SHA256

ffa7ce02b730bb3c3ed16f18c3a80cf92b2a60b35a7d094db3d2941d35bb2710
SHA512

4a383f009b3b60bedb4218857aa4ebff5e44693130f4b0a0ea5ba91421329eddeada78ecef381bc6e286e73bccb30dabd82c62f8ec295bae3b220a8c766b2086
SSDEEP

768:/ObJHX1FVXLHYbpV0O5NEvwjpnkIYNCCYbhFo+kKEKVWfcOz:/O9X1jHypV0O5NBjpnkIYNCCYbhFo+kn

Score

8^/10

discovery exploit

Malware Config

Signatures

Possible privilege escalation attempt 8 IoCs
exploit

Processes:

takeown.exeicacls.exetakeown.exeicacls.exetakeown.exeicacls.exeicacls.exetakeown.exe

pid process

3616 takeown.exe
5032 icacls.exe
2392 takeown.exe
1436 icacls.exe
5024 takeown.exe
4572 icacls.exe
1504 icacls.exe
4788 takeown.exe
Modifies file permissions 1 TTPs 8 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

takeown.exetakeown.exeicacls.exetakeown.exeicacls.exetakeown.exeicacls.exeicacls.exe

pid process

4788 takeown.exe
3616 takeown.exe
5032 icacls.exe
2392 takeown.exe
1436 icacls.exe
5024 takeown.exe
4572 icacls.exe
1504 icacls.exe

pid	process
3616	takeown.exe
5032	icacls.exe
2392	takeown.exe
1436	icacls.exe
5024	takeown.exe
4572	icacls.exe
1504	icacls.exe
4788	takeown.exe

pid	process
4788	takeown.exe
3616	takeown.exe
5032	icacls.exe
2392	takeown.exe
1436	icacls.exe
5024	takeown.exe
4572	icacls.exe
1504	icacls.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

takeown.exetakeown.exetakeown.exetakeown.exe

description	pid	process
Token: SeTakeOwnershipPrivilege	3616	takeown.exe
Token: SeTakeOwnershipPrivilege	5024	takeown.exe
Token: SeTakeOwnershipPrivilege	4788	takeown.exe
Token: SeTakeOwnershipPrivilege	2392	takeown.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

ffa7ce02b730bb3c3ed16f18c3a80cf92b2a60b35a7d094db3d2941d35bb2710.exe

pid process

4152 ffa7ce02b730bb3c3ed16f18c3a80cf92b2a60b35a7d094db3d2941d35bb2710.exe

pid	process
4152	ffa7ce02b730bb3c3ed16f18c3a80cf92b2a60b35a7d094db3d2941d35bb2710.exe

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

ffa7ce02b730bb3c3ed16f18c3a80cf92b2a60b35a7d094db3d2941d35bb2710.exe

description	pid	process	target process
PID 4152 wrote to memory of 5024	4152	ffa7ce02b730bb3c3ed16f18c3a80cf92b2a60b35a7d094db3d2941d35bb2710.exe	takeown.exe
PID 4152 wrote to memory of 5024	4152	ffa7ce02b730bb3c3ed16f18c3a80cf92b2a60b35a7d094db3d2941d35bb2710.exe	takeown.exe
PID 4152 wrote to memory of 5024	4152	ffa7ce02b730bb3c3ed16f18c3a80cf92b2a60b35a7d094db3d2941d35bb2710.exe	takeown.exe
PID 4152 wrote to memory of 5032	4152	ffa7ce02b730bb3c3ed16f18c3a80cf92b2a60b35a7d094db3d2941d35bb2710.exe	icacls.exe
PID 4152 wrote to memory of 5032	4152	ffa7ce02b730bb3c3ed16f18c3a80cf92b2a60b35a7d094db3d2941d35bb2710.exe	icacls.exe
PID 4152 wrote to memory of 5032	4152	ffa7ce02b730bb3c3ed16f18c3a80cf92b2a60b35a7d094db3d2941d35bb2710.exe	icacls.exe
PID 4152 wrote to memory of 3616	4152	ffa7ce02b730bb3c3ed16f18c3a80cf92b2a60b35a7d094db3d2941d35bb2710.exe	takeown.exe
PID 4152 wrote to memory of 3616	4152	ffa7ce02b730bb3c3ed16f18c3a80cf92b2a60b35a7d094db3d2941d35bb2710.exe	takeown.exe
PID 4152 wrote to memory of 3616	4152	ffa7ce02b730bb3c3ed16f18c3a80cf92b2a60b35a7d094db3d2941d35bb2710.exe	takeown.exe
PID 4152 wrote to memory of 4572	4152	ffa7ce02b730bb3c3ed16f18c3a80cf92b2a60b35a7d094db3d2941d35bb2710.exe	icacls.exe
PID 4152 wrote to memory of 4572	4152	ffa7ce02b730bb3c3ed16f18c3a80cf92b2a60b35a7d094db3d2941d35bb2710.exe	icacls.exe
PID 4152 wrote to memory of 4572	4152	ffa7ce02b730bb3c3ed16f18c3a80cf92b2a60b35a7d094db3d2941d35bb2710.exe	icacls.exe
PID 4152 wrote to memory of 4788	4152	ffa7ce02b730bb3c3ed16f18c3a80cf92b2a60b35a7d094db3d2941d35bb2710.exe	takeown.exe
PID 4152 wrote to memory of 4788	4152	ffa7ce02b730bb3c3ed16f18c3a80cf92b2a60b35a7d094db3d2941d35bb2710.exe	takeown.exe
PID 4152 wrote to memory of 4788	4152	ffa7ce02b730bb3c3ed16f18c3a80cf92b2a60b35a7d094db3d2941d35bb2710.exe	takeown.exe
PID 4152 wrote to memory of 1504	4152	ffa7ce02b730bb3c3ed16f18c3a80cf92b2a60b35a7d094db3d2941d35bb2710.exe	icacls.exe
PID 4152 wrote to memory of 1504	4152	ffa7ce02b730bb3c3ed16f18c3a80cf92b2a60b35a7d094db3d2941d35bb2710.exe	icacls.exe
PID 4152 wrote to memory of 1504	4152	ffa7ce02b730bb3c3ed16f18c3a80cf92b2a60b35a7d094db3d2941d35bb2710.exe	icacls.exe
PID 4152 wrote to memory of 2392	4152	ffa7ce02b730bb3c3ed16f18c3a80cf92b2a60b35a7d094db3d2941d35bb2710.exe	takeown.exe
PID 4152 wrote to memory of 2392	4152	ffa7ce02b730bb3c3ed16f18c3a80cf92b2a60b35a7d094db3d2941d35bb2710.exe	takeown.exe
PID 4152 wrote to memory of 2392	4152	ffa7ce02b730bb3c3ed16f18c3a80cf92b2a60b35a7d094db3d2941d35bb2710.exe	takeown.exe
PID 4152 wrote to memory of 1436	4152	ffa7ce02b730bb3c3ed16f18c3a80cf92b2a60b35a7d094db3d2941d35bb2710.exe	icacls.exe
PID 4152 wrote to memory of 1436	4152	ffa7ce02b730bb3c3ed16f18c3a80cf92b2a60b35a7d094db3d2941d35bb2710.exe	icacls.exe
PID 4152 wrote to memory of 1436	4152	ffa7ce02b730bb3c3ed16f18c3a80cf92b2a60b35a7d094db3d2941d35bb2710.exe	icacls.exe

C:\Users\Admin\AppData\Local\Temp\ffa7ce02b730bb3c3ed16f18c3a80cf92b2a60b35a7d094db3d2941d35bb2710.exe
"C:\Users\Admin\AppData\Local\Temp\ffa7ce02b730bb3c3ed16f18c3a80cf92b2a60b35a7d094db3d2941d35bb2710.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4152

C:\Windows\SysWOW64\takeown.exe
C:\Windows\System32\takeown.exe /f "C:\Windows\System32\cmd.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:5024

C:\Windows\SysWOW64\icacls.exe
C:\Windows\System32\icacls.exe "C:\Windows\System32\ftp.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:4572

C:\Windows\SysWOW64\icacls.exe
C:\Windows\System32\icacls.exe "C:\Windows\System32\wscript.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1504

C:\Windows\SysWOW64\takeown.exe
C:\Windows\System32\takeown.exe /f "C:\Windows\System32\wscript.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:4788

C:\Windows\SysWOW64\takeown.exe
C:\Windows\System32\takeown.exe /f "C:\Windows\System32\ftp.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:3616

C:\Windows\SysWOW64\icacls.exe
C:\Windows\System32\icacls.exe "C:\Windows\System32\cmd.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:5032

C:\Windows\SysWOW64\takeown.exe
C:\Windows\System32\takeown.exe /f "C:\Windows\System32\cscript.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:2392

C:\Windows\SysWOW64\icacls.exe
C:\Windows\System32\icacls.exe "C:\Windows\System32\cscript.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1436

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

1

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1436-141-0x0000000000000000-mapping.dmp

Download
memory/1504-139-0x0000000000000000-mapping.dmp

Download
memory/2392-140-0x0000000000000000-mapping.dmp

Download
memory/3616-136-0x0000000000000000-mapping.dmp

Download
memory/4572-137-0x0000000000000000-mapping.dmp

Download
memory/4788-138-0x0000000000000000-mapping.dmp

Download
memory/5024-134-0x0000000000000000-mapping.dmp

Download
memory/5032-135-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing