14ab70d14afe0daaf39c12ecf092fd1b19b838e4545d22c2cadc9ec971409dbf

Analysis

max time kernel
45s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06-11-2022 23:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

14ab70d14afe0daaf39c12ecf092fd1b19b838e4545d22c2cadc9ec971409dbf.exe
Size

68KB
MD5

04979ba43d2a66da6f82dba777f37ef6
SHA1

bae61b6086e88810216ada12033ad85b55cfc8d1
SHA256

14ab70d14afe0daaf39c12ecf092fd1b19b838e4545d22c2cadc9ec971409dbf
SHA512

20a0815cce19cd9214f19ede1873e4cd634e2379e5578b1d58227bb0e812279f659307feeb67b22887a64a1c50b7e31e1abca9802339cb1783017e875546fd53
SSDEEP

1536:yi1V73h8E3n/dWMImM9FxMpebIXzLWPw:yMOE3n/dWPmM9FWvfZ

Score

8^/10

discovery exploit

Malware Config

Signatures

Possible privilege escalation attempt 2 IoCs
exploit

Processes:

takeown.exeicacls.exe

pid process

916 takeown.exe
1780 icacls.exe
Modifies file permissions 1 TTPs 2 IoCs
discovery

File Permissions Modification
T1222

Processes:

takeown.exeicacls.exe

pid process

916 takeown.exe
1780 icacls.exe

pid	process
916	takeown.exe
1780	icacls.exe

pid	process
916	takeown.exe
1780	icacls.exe

Drops file in System32 directory 2 IoCs

Processes:

14ab70d14afe0daaf39c12ecf092fd1b19b838e4545d22c2cadc9ec971409dbf.exe

description	ioc	process
File created	C:\Windows\SysWOW64\zdsck.exe	14ab70d14afe0daaf39c12ecf092fd1b19b838e4545d22c2cadc9ec971409dbf.exe
File opened for modification	C:\Windows\SysWOW64\zdsck.exe	14ab70d14afe0daaf39c12ecf092fd1b19b838e4545d22c2cadc9ec971409dbf.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

14ab70d14afe0daaf39c12ecf092fd1b19b838e4545d22c2cadc9ec971409dbf.exe

pid process

1460 14ab70d14afe0daaf39c12ecf092fd1b19b838e4545d22c2cadc9ec971409dbf.exe

pid	process
1460	14ab70d14afe0daaf39c12ecf092fd1b19b838e4545d22c2cadc9ec971409dbf.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

14ab70d14afe0daaf39c12ecf092fd1b19b838e4545d22c2cadc9ec971409dbf.exe

description	pid	process	target process
PID 1460 wrote to memory of 916	1460	14ab70d14afe0daaf39c12ecf092fd1b19b838e4545d22c2cadc9ec971409dbf.exe	takeown.exe
PID 1460 wrote to memory of 916	1460	14ab70d14afe0daaf39c12ecf092fd1b19b838e4545d22c2cadc9ec971409dbf.exe	takeown.exe
PID 1460 wrote to memory of 916	1460	14ab70d14afe0daaf39c12ecf092fd1b19b838e4545d22c2cadc9ec971409dbf.exe	takeown.exe
PID 1460 wrote to memory of 916	1460	14ab70d14afe0daaf39c12ecf092fd1b19b838e4545d22c2cadc9ec971409dbf.exe	takeown.exe
PID 1460 wrote to memory of 1780	1460	14ab70d14afe0daaf39c12ecf092fd1b19b838e4545d22c2cadc9ec971409dbf.exe	icacls.exe
PID 1460 wrote to memory of 1780	1460	14ab70d14afe0daaf39c12ecf092fd1b19b838e4545d22c2cadc9ec971409dbf.exe	icacls.exe
PID 1460 wrote to memory of 1780	1460	14ab70d14afe0daaf39c12ecf092fd1b19b838e4545d22c2cadc9ec971409dbf.exe	icacls.exe
PID 1460 wrote to memory of 1780	1460	14ab70d14afe0daaf39c12ecf092fd1b19b838e4545d22c2cadc9ec971409dbf.exe	icacls.exe

C:\Users\Admin\AppData\Local\Temp\14ab70d14afe0daaf39c12ecf092fd1b19b838e4545d22c2cadc9ec971409dbf.exe
"C:\Users\Admin\AppData\Local\Temp\14ab70d14afe0daaf39c12ecf092fd1b19b838e4545d22c2cadc9ec971409dbf.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1460

C:\Windows\SysWOW64\takeown.exe
C:\Windows\system32\takeown.exe /f "C:\Windows\system32\zdsck.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:916

C:\Windows\SysWOW64\icacls.exe
C:\Windows\system32\icacls.exe "C:\Windows\system32\zdsck.exe" /grant SYSTEM:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1780

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\zdsck.exe
Filesize
68KB

MD5
04979ba43d2a66da6f82dba777f37ef6

SHA1
bae61b6086e88810216ada12033ad85b55cfc8d1

SHA256
14ab70d14afe0daaf39c12ecf092fd1b19b838e4545d22c2cadc9ec971409dbf

SHA512
20a0815cce19cd9214f19ede1873e4cd634e2379e5578b1d58227bb0e812279f659307feeb67b22887a64a1c50b7e31e1abca9802339cb1783017e875546fd53

Download Submit
memory/916-57-0x0000000000000000-mapping.dmp

Download
memory/1460-56-0x0000000075831000-0x0000000075833000-memory.dmp

Filesize
8KB

Download
memory/1780-59-0x0000000000000000-mapping.dmp

Download