0c2659ad4dc8826ddddf18c68f572613fd5b5541dec5822027d34a03c519625e

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07-11-2022 00:01

Target

0c2659ad4dc8826ddddf18c68f572613fd5b5541dec5822027d34a03c519625e.exe
Size

68KB
MD5

15b222e230f32f377982fdcffa0a6771
SHA1

89c3ddd16938a6f1aeb73f27a717d545c9de98cc
SHA256

0c2659ad4dc8826ddddf18c68f572613fd5b5541dec5822027d34a03c519625e
SHA512

3b0b3e86e6fa1072e3d3411f0d6c34f728176959abfd2f728eff41b35ed27a95145fd803da845dd38d7c543f54abc2efa03a53f1e5cb300489545bec061e7510
SSDEEP

768:l7c26u0ujY+6+zAehBmJ+9hUykr4VDOtF1qyvFTPk7BRIztyiwLdV3cRnffCXe:lN3AgflE1qrBy3Ee

Score

8^/10

discovery exploit

Possible privilege escalation attempt 2 IoCs
exploit

Processes:

takeown.exeicacls.exe

pid process

1296 takeown.exe
1668 icacls.exe
Modifies file permissions 1 TTPs 2 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exetakeown.exe

pid process

1668 icacls.exe
1296 takeown.exe

pid	process
1296	takeown.exe
1668	icacls.exe

pid	process
1668	icacls.exe
1296	takeown.exe

Drops file in System32 directory 2 IoCs

Processes:

0c2659ad4dc8826ddddf18c68f572613fd5b5541dec5822027d34a03c519625e.exe

description	ioc	process
File created	C:\Windows\SysWOW64\btwp.exe	0c2659ad4dc8826ddddf18c68f572613fd5b5541dec5822027d34a03c519625e.exe
File opened for modification	C:\Windows\SysWOW64\btwp.exe	0c2659ad4dc8826ddddf18c68f572613fd5b5541dec5822027d34a03c519625e.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

0c2659ad4dc8826ddddf18c68f572613fd5b5541dec5822027d34a03c519625e.exe

pid process

1052 0c2659ad4dc8826ddddf18c68f572613fd5b5541dec5822027d34a03c519625e.exe

pid	process
1052	0c2659ad4dc8826ddddf18c68f572613fd5b5541dec5822027d34a03c519625e.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

0c2659ad4dc8826ddddf18c68f572613fd5b5541dec5822027d34a03c519625e.exe

description	pid	process	target process
PID 1052 wrote to memory of 1296	1052	0c2659ad4dc8826ddddf18c68f572613fd5b5541dec5822027d34a03c519625e.exe	takeown.exe
PID 1052 wrote to memory of 1296	1052	0c2659ad4dc8826ddddf18c68f572613fd5b5541dec5822027d34a03c519625e.exe	takeown.exe
PID 1052 wrote to memory of 1296	1052	0c2659ad4dc8826ddddf18c68f572613fd5b5541dec5822027d34a03c519625e.exe	takeown.exe
PID 1052 wrote to memory of 1296	1052	0c2659ad4dc8826ddddf18c68f572613fd5b5541dec5822027d34a03c519625e.exe	takeown.exe
PID 1052 wrote to memory of 1668	1052	0c2659ad4dc8826ddddf18c68f572613fd5b5541dec5822027d34a03c519625e.exe	icacls.exe
PID 1052 wrote to memory of 1668	1052	0c2659ad4dc8826ddddf18c68f572613fd5b5541dec5822027d34a03c519625e.exe	icacls.exe
PID 1052 wrote to memory of 1668	1052	0c2659ad4dc8826ddddf18c68f572613fd5b5541dec5822027d34a03c519625e.exe	icacls.exe
PID 1052 wrote to memory of 1668	1052	0c2659ad4dc8826ddddf18c68f572613fd5b5541dec5822027d34a03c519625e.exe	icacls.exe

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Windows\SysWOW64\btwp.exe

Filesize
68KB

MD5
15b222e230f32f377982fdcffa0a6771

SHA1
89c3ddd16938a6f1aeb73f27a717d545c9de98cc

SHA256
0c2659ad4dc8826ddddf18c68f572613fd5b5541dec5822027d34a03c519625e

SHA512
3b0b3e86e6fa1072e3d3411f0d6c34f728176959abfd2f728eff41b35ed27a95145fd803da845dd38d7c543f54abc2efa03a53f1e5cb300489545bec061e7510

Download Submit
memory/1052-56-0x0000000075931000-0x0000000075933000-memory.dmp

Filesize
8KB

Download
memory/1296-57-0x0000000000000000-mapping.dmp

Download
memory/1668-59-0x0000000000000000-mapping.dmp

Download