524d1b739a0d3c0da8d10fa62e5d0e7bcbec94308d942f248f6557098f551980

General

Target

524d1b739a0d3c0da8d10fa62e5d0e7bcbec94308d942f248f6557098f551980.exe
Size

40KB
MD5

0f625d35e48b771698b92ea3cc2121c0
SHA1

d7514b282f3f56dd7ba3b9b0e5cff287a30dd924
SHA256

524d1b739a0d3c0da8d10fa62e5d0e7bcbec94308d942f248f6557098f551980
SHA512

1e3f3160cd4a905e5151c464998a6c04804d589783e64a99115f6f0aa233f22f4697f2af7bab2ed106c58c833f311007d8b093d303dca8feba7f9499c830d2f3
SSDEEP

768:/NWtMPelSasROzNQy54okCQTsAMcWNjsG1ucl3bNm:/AWipsRS6Qg5WNjsG1fZm

Score

8^/10

discovery exploit

Malware Config

Signatures

Possible privilege escalation attempt 8 IoCs
exploit

Processes:

icacls.exetakeown.exeicacls.exetakeown.exeicacls.exetakeown.exeicacls.exetakeown.exe

pid process

2036 icacls.exe
1116 takeown.exe
2024 icacls.exe
1980 takeown.exe
1180 icacls.exe
840 takeown.exe
1068 icacls.exe
2040 takeown.exe
Modifies file permissions 1 TTPs 8 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

takeown.exeicacls.exetakeown.exeicacls.exetakeown.exeicacls.exetakeown.exeicacls.exe

pid process

2040 takeown.exe
2036 icacls.exe
1116 takeown.exe
2024 icacls.exe
1980 takeown.exe
1180 icacls.exe
840 takeown.exe
1068 icacls.exe

pid	process
2036	icacls.exe
1116	takeown.exe
2024	icacls.exe
1980	takeown.exe
1180	icacls.exe
840	takeown.exe
1068	icacls.exe
2040	takeown.exe

pid	process
2040	takeown.exe
2036	icacls.exe
1116	takeown.exe
2024	icacls.exe
1980	takeown.exe
1180	icacls.exe
840	takeown.exe
1068	icacls.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

takeown.exetakeown.exetakeown.exetakeown.exe

description	pid	process
Token: SeTakeOwnershipPrivilege	1116	takeown.exe
Token: SeTakeOwnershipPrivilege	2040	takeown.exe
Token: SeTakeOwnershipPrivilege	1980	takeown.exe
Token: SeTakeOwnershipPrivilege	840	takeown.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

524d1b739a0d3c0da8d10fa62e5d0e7bcbec94308d942f248f6557098f551980.exe

pid process

852 524d1b739a0d3c0da8d10fa62e5d0e7bcbec94308d942f248f6557098f551980.exe

pid	process
852	524d1b739a0d3c0da8d10fa62e5d0e7bcbec94308d942f248f6557098f551980.exe

Suspicious use of WriteProcessMemory 32 IoCs

Processes:

524d1b739a0d3c0da8d10fa62e5d0e7bcbec94308d942f248f6557098f551980.exe

description	pid	process	target process
PID 852 wrote to memory of 2040	852	524d1b739a0d3c0da8d10fa62e5d0e7bcbec94308d942f248f6557098f551980.exe	takeown.exe
PID 852 wrote to memory of 2040	852	524d1b739a0d3c0da8d10fa62e5d0e7bcbec94308d942f248f6557098f551980.exe	takeown.exe
PID 852 wrote to memory of 2040	852	524d1b739a0d3c0da8d10fa62e5d0e7bcbec94308d942f248f6557098f551980.exe	takeown.exe
PID 852 wrote to memory of 2040	852	524d1b739a0d3c0da8d10fa62e5d0e7bcbec94308d942f248f6557098f551980.exe	takeown.exe
PID 852 wrote to memory of 2036	852	524d1b739a0d3c0da8d10fa62e5d0e7bcbec94308d942f248f6557098f551980.exe	icacls.exe
PID 852 wrote to memory of 2036	852	524d1b739a0d3c0da8d10fa62e5d0e7bcbec94308d942f248f6557098f551980.exe	icacls.exe
PID 852 wrote to memory of 2036	852	524d1b739a0d3c0da8d10fa62e5d0e7bcbec94308d942f248f6557098f551980.exe	icacls.exe
PID 852 wrote to memory of 2036	852	524d1b739a0d3c0da8d10fa62e5d0e7bcbec94308d942f248f6557098f551980.exe	icacls.exe
PID 852 wrote to memory of 1116	852	524d1b739a0d3c0da8d10fa62e5d0e7bcbec94308d942f248f6557098f551980.exe	takeown.exe
PID 852 wrote to memory of 1116	852	524d1b739a0d3c0da8d10fa62e5d0e7bcbec94308d942f248f6557098f551980.exe	takeown.exe
PID 852 wrote to memory of 1116	852	524d1b739a0d3c0da8d10fa62e5d0e7bcbec94308d942f248f6557098f551980.exe	takeown.exe
PID 852 wrote to memory of 1116	852	524d1b739a0d3c0da8d10fa62e5d0e7bcbec94308d942f248f6557098f551980.exe	takeown.exe
PID 852 wrote to memory of 2024	852	524d1b739a0d3c0da8d10fa62e5d0e7bcbec94308d942f248f6557098f551980.exe	icacls.exe
PID 852 wrote to memory of 2024	852	524d1b739a0d3c0da8d10fa62e5d0e7bcbec94308d942f248f6557098f551980.exe	icacls.exe
PID 852 wrote to memory of 2024	852	524d1b739a0d3c0da8d10fa62e5d0e7bcbec94308d942f248f6557098f551980.exe	icacls.exe
PID 852 wrote to memory of 2024	852	524d1b739a0d3c0da8d10fa62e5d0e7bcbec94308d942f248f6557098f551980.exe	icacls.exe
PID 852 wrote to memory of 1980	852	524d1b739a0d3c0da8d10fa62e5d0e7bcbec94308d942f248f6557098f551980.exe	takeown.exe
PID 852 wrote to memory of 1980	852	524d1b739a0d3c0da8d10fa62e5d0e7bcbec94308d942f248f6557098f551980.exe	takeown.exe
PID 852 wrote to memory of 1980	852	524d1b739a0d3c0da8d10fa62e5d0e7bcbec94308d942f248f6557098f551980.exe	takeown.exe
PID 852 wrote to memory of 1980	852	524d1b739a0d3c0da8d10fa62e5d0e7bcbec94308d942f248f6557098f551980.exe	takeown.exe
PID 852 wrote to memory of 1180	852	524d1b739a0d3c0da8d10fa62e5d0e7bcbec94308d942f248f6557098f551980.exe	icacls.exe
PID 852 wrote to memory of 1180	852	524d1b739a0d3c0da8d10fa62e5d0e7bcbec94308d942f248f6557098f551980.exe	icacls.exe
PID 852 wrote to memory of 1180	852	524d1b739a0d3c0da8d10fa62e5d0e7bcbec94308d942f248f6557098f551980.exe	icacls.exe
PID 852 wrote to memory of 1180	852	524d1b739a0d3c0da8d10fa62e5d0e7bcbec94308d942f248f6557098f551980.exe	icacls.exe
PID 852 wrote to memory of 840	852	524d1b739a0d3c0da8d10fa62e5d0e7bcbec94308d942f248f6557098f551980.exe	takeown.exe
PID 852 wrote to memory of 840	852	524d1b739a0d3c0da8d10fa62e5d0e7bcbec94308d942f248f6557098f551980.exe	takeown.exe
PID 852 wrote to memory of 840	852	524d1b739a0d3c0da8d10fa62e5d0e7bcbec94308d942f248f6557098f551980.exe	takeown.exe
PID 852 wrote to memory of 840	852	524d1b739a0d3c0da8d10fa62e5d0e7bcbec94308d942f248f6557098f551980.exe	takeown.exe
PID 852 wrote to memory of 1068	852	524d1b739a0d3c0da8d10fa62e5d0e7bcbec94308d942f248f6557098f551980.exe	icacls.exe
PID 852 wrote to memory of 1068	852	524d1b739a0d3c0da8d10fa62e5d0e7bcbec94308d942f248f6557098f551980.exe	icacls.exe
PID 852 wrote to memory of 1068	852	524d1b739a0d3c0da8d10fa62e5d0e7bcbec94308d942f248f6557098f551980.exe	icacls.exe
PID 852 wrote to memory of 1068	852	524d1b739a0d3c0da8d10fa62e5d0e7bcbec94308d942f248f6557098f551980.exe	icacls.exe

C:\Users\Admin\AppData\Local\Temp\524d1b739a0d3c0da8d10fa62e5d0e7bcbec94308d942f248f6557098f551980.exe
"C:\Users\Admin\AppData\Local\Temp\524d1b739a0d3c0da8d10fa62e5d0e7bcbec94308d942f248f6557098f551980.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:852
- C:\Windows\SysWOW64\takeown.exe
  C:\Windows\System32\takeown.exe /f "C:\Windows\System32\cmd.exe"
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  - Suspicious use of AdjustPrivilegeToken
  PID:2040
- C:\Windows\SysWOW64\icacls.exe
  C:\Windows\System32\icacls.exe "C:\Windows\System32\cmd.exe" /grant Users:F
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:2036
- C:\Windows\SysWOW64\takeown.exe
  C:\Windows\System32\takeown.exe /f "C:\Windows\System32\ftp.exe"
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  - Suspicious use of AdjustPrivilegeToken
  PID:1116
- C:\Windows\SysWOW64\icacls.exe
  C:\Windows\System32\icacls.exe "C:\Windows\System32\ftp.exe" /grant Users:F
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:2024
- C:\Windows\SysWOW64\takeown.exe
  C:\Windows\System32\takeown.exe /f "C:\Windows\System32\wscript.exe"
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  - Suspicious use of AdjustPrivilegeToken
  PID:1980
- C:\Windows\SysWOW64\icacls.exe
  C:\Windows\System32\icacls.exe "C:\Windows\System32\wscript.exe" /grant Users:F
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:1180
- C:\Windows\SysWOW64\takeown.exe
  C:\Windows\System32\takeown.exe /f "C:\Windows\System32\cscript.exe"
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  - Suspicious use of AdjustPrivilegeToken
  PID:840
- C:\Windows\SysWOW64\icacls.exe
  C:\Windows\System32\icacls.exe "C:\Windows\System32\cscript.exe" /grant Users:F
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:1068

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

1

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/840-62-0x0000000000000000-mapping.dmp

Download
memory/1068-63-0x0000000000000000-mapping.dmp

Download
memory/1116-58-0x0000000000000000-mapping.dmp

Download
memory/1180-61-0x0000000000000000-mapping.dmp

Download
memory/1980-60-0x0000000000000000-mapping.dmp

Download
memory/2024-59-0x0000000000000000-mapping.dmp

Download
memory/2036-57-0x0000000000000000-mapping.dmp

Download
memory/2040-56-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing