524d1b739a0d3c0da8d10fa62e5d0e7bcbec94308d942f248f6557098f551980

General

Target

524d1b739a0d3c0da8d10fa62e5d0e7bcbec94308d942f248f6557098f551980.exe
Size

40KB
MD5

0f625d35e48b771698b92ea3cc2121c0
SHA1

d7514b282f3f56dd7ba3b9b0e5cff287a30dd924
SHA256

524d1b739a0d3c0da8d10fa62e5d0e7bcbec94308d942f248f6557098f551980
SHA512

1e3f3160cd4a905e5151c464998a6c04804d589783e64a99115f6f0aa233f22f4697f2af7bab2ed106c58c833f311007d8b093d303dca8feba7f9499c830d2f3
SSDEEP

768:/NWtMPelSasROzNQy54okCQTsAMcWNjsG1ucl3bNm:/AWipsRS6Qg5WNjsG1fZm

Score

8^/10

discovery exploit

Malware Config

Signatures

Possible privilege escalation attempt 8 IoCs
exploit

Processes:

icacls.exetakeown.exeicacls.exeicacls.exetakeown.exetakeown.exeicacls.exetakeown.exe

pid process

1500 icacls.exe
1924 takeown.exe
1220 icacls.exe
5064 icacls.exe
4884 takeown.exe
3188 takeown.exe
4952 icacls.exe
360 takeown.exe
Modifies file permissions 1 TTPs 8 IoCs
discovery

File Permissions Modification
T1222

Processes:

takeown.exeicacls.exetakeown.exeicacls.exetakeown.exeicacls.exeicacls.exetakeown.exe

pid process

3188 takeown.exe
4952 icacls.exe
360 takeown.exe
1500 icacls.exe
1924 takeown.exe
1220 icacls.exe
5064 icacls.exe
4884 takeown.exe

pid	process
1500	icacls.exe
1924	takeown.exe
1220	icacls.exe
5064	icacls.exe
4884	takeown.exe
3188	takeown.exe
4952	icacls.exe
360	takeown.exe

pid	process
3188	takeown.exe
4952	icacls.exe
360	takeown.exe
1500	icacls.exe
1924	takeown.exe
1220	icacls.exe
5064	icacls.exe
4884	takeown.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

takeown.exetakeown.exetakeown.exetakeown.exe

description	pid	process
Token: SeTakeOwnershipPrivilege	1924	takeown.exe
Token: SeTakeOwnershipPrivilege	360	takeown.exe
Token: SeTakeOwnershipPrivilege	3188	takeown.exe
Token: SeTakeOwnershipPrivilege	4884	takeown.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

524d1b739a0d3c0da8d10fa62e5d0e7bcbec94308d942f248f6557098f551980.exe

pid process

4828 524d1b739a0d3c0da8d10fa62e5d0e7bcbec94308d942f248f6557098f551980.exe

pid	process
4828	524d1b739a0d3c0da8d10fa62e5d0e7bcbec94308d942f248f6557098f551980.exe

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

524d1b739a0d3c0da8d10fa62e5d0e7bcbec94308d942f248f6557098f551980.exe

description	pid	process	target process
PID 4828 wrote to memory of 360	4828	524d1b739a0d3c0da8d10fa62e5d0e7bcbec94308d942f248f6557098f551980.exe	takeown.exe
PID 4828 wrote to memory of 360	4828	524d1b739a0d3c0da8d10fa62e5d0e7bcbec94308d942f248f6557098f551980.exe	takeown.exe
PID 4828 wrote to memory of 360	4828	524d1b739a0d3c0da8d10fa62e5d0e7bcbec94308d942f248f6557098f551980.exe	takeown.exe
PID 4828 wrote to memory of 1500	4828	524d1b739a0d3c0da8d10fa62e5d0e7bcbec94308d942f248f6557098f551980.exe	icacls.exe
PID 4828 wrote to memory of 1500	4828	524d1b739a0d3c0da8d10fa62e5d0e7bcbec94308d942f248f6557098f551980.exe	icacls.exe
PID 4828 wrote to memory of 1500	4828	524d1b739a0d3c0da8d10fa62e5d0e7bcbec94308d942f248f6557098f551980.exe	icacls.exe
PID 4828 wrote to memory of 1924	4828	524d1b739a0d3c0da8d10fa62e5d0e7bcbec94308d942f248f6557098f551980.exe	takeown.exe
PID 4828 wrote to memory of 1924	4828	524d1b739a0d3c0da8d10fa62e5d0e7bcbec94308d942f248f6557098f551980.exe	takeown.exe
PID 4828 wrote to memory of 1924	4828	524d1b739a0d3c0da8d10fa62e5d0e7bcbec94308d942f248f6557098f551980.exe	takeown.exe
PID 4828 wrote to memory of 1220	4828	524d1b739a0d3c0da8d10fa62e5d0e7bcbec94308d942f248f6557098f551980.exe	icacls.exe
PID 4828 wrote to memory of 1220	4828	524d1b739a0d3c0da8d10fa62e5d0e7bcbec94308d942f248f6557098f551980.exe	icacls.exe
PID 4828 wrote to memory of 1220	4828	524d1b739a0d3c0da8d10fa62e5d0e7bcbec94308d942f248f6557098f551980.exe	icacls.exe
PID 4828 wrote to memory of 3188	4828	524d1b739a0d3c0da8d10fa62e5d0e7bcbec94308d942f248f6557098f551980.exe	takeown.exe
PID 4828 wrote to memory of 3188	4828	524d1b739a0d3c0da8d10fa62e5d0e7bcbec94308d942f248f6557098f551980.exe	takeown.exe
PID 4828 wrote to memory of 3188	4828	524d1b739a0d3c0da8d10fa62e5d0e7bcbec94308d942f248f6557098f551980.exe	takeown.exe
PID 4828 wrote to memory of 5064	4828	524d1b739a0d3c0da8d10fa62e5d0e7bcbec94308d942f248f6557098f551980.exe	icacls.exe
PID 4828 wrote to memory of 5064	4828	524d1b739a0d3c0da8d10fa62e5d0e7bcbec94308d942f248f6557098f551980.exe	icacls.exe
PID 4828 wrote to memory of 5064	4828	524d1b739a0d3c0da8d10fa62e5d0e7bcbec94308d942f248f6557098f551980.exe	icacls.exe
PID 4828 wrote to memory of 4884	4828	524d1b739a0d3c0da8d10fa62e5d0e7bcbec94308d942f248f6557098f551980.exe	takeown.exe
PID 4828 wrote to memory of 4884	4828	524d1b739a0d3c0da8d10fa62e5d0e7bcbec94308d942f248f6557098f551980.exe	takeown.exe
PID 4828 wrote to memory of 4884	4828	524d1b739a0d3c0da8d10fa62e5d0e7bcbec94308d942f248f6557098f551980.exe	takeown.exe
PID 4828 wrote to memory of 4952	4828	524d1b739a0d3c0da8d10fa62e5d0e7bcbec94308d942f248f6557098f551980.exe	icacls.exe
PID 4828 wrote to memory of 4952	4828	524d1b739a0d3c0da8d10fa62e5d0e7bcbec94308d942f248f6557098f551980.exe	icacls.exe
PID 4828 wrote to memory of 4952	4828	524d1b739a0d3c0da8d10fa62e5d0e7bcbec94308d942f248f6557098f551980.exe	icacls.exe

C:\Users\Admin\AppData\Local\Temp\524d1b739a0d3c0da8d10fa62e5d0e7bcbec94308d942f248f6557098f551980.exe
"C:\Users\Admin\AppData\Local\Temp\524d1b739a0d3c0da8d10fa62e5d0e7bcbec94308d942f248f6557098f551980.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4828

C:\Windows\SysWOW64\takeown.exe
C:\Windows\System32\takeown.exe /f "C:\Windows\System32\cmd.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:360

C:\Windows\SysWOW64\icacls.exe
C:\Windows\System32\icacls.exe "C:\Windows\System32\cmd.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1500

C:\Windows\SysWOW64\takeown.exe
C:\Windows\System32\takeown.exe /f "C:\Windows\System32\ftp.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:1924

C:\Windows\SysWOW64\icacls.exe
C:\Windows\System32\icacls.exe "C:\Windows\System32\ftp.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1220

C:\Windows\SysWOW64\icacls.exe
C:\Windows\System32\icacls.exe "C:\Windows\System32\wscript.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:5064

C:\Windows\SysWOW64\takeown.exe
C:\Windows\System32\takeown.exe /f "C:\Windows\System32\cscript.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:4884

C:\Windows\SysWOW64\takeown.exe
C:\Windows\System32\takeown.exe /f "C:\Windows\System32\wscript.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:3188

C:\Windows\SysWOW64\icacls.exe
C:\Windows\System32\icacls.exe "C:\Windows\System32\cscript.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:4952

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File Permissions Modification

1

T1222

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/360-134-0x0000000000000000-mapping.dmp

Download
memory/1220-137-0x0000000000000000-mapping.dmp

Download
memory/1500-135-0x0000000000000000-mapping.dmp

Download
memory/1924-136-0x0000000000000000-mapping.dmp

Download
memory/3188-138-0x0000000000000000-mapping.dmp

Download
memory/4884-140-0x0000000000000000-mapping.dmp

Download
memory/4952-141-0x0000000000000000-mapping.dmp

Download
memory/5064-139-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing