5f8a4293e943cd0950e3d32f021a02cfcb2f1b2f57a7d25338ae75be89c009a0

General

Target

5f8a4293e943cd0950e3d32f021a02cfcb2f1b2f57a7d25338ae75be89c009a0.exe
Size

36KB
MD5

0659c3376dffe4ccf0e3afd688829300
SHA1

b3ba94eaf100a37605646123975ee31f7802135d
SHA256

5f8a4293e943cd0950e3d32f021a02cfcb2f1b2f57a7d25338ae75be89c009a0
SHA512

bfd6f9db9d27df36ada48101ec2465bf45f2d5b0864b511dbe38745590b13d661d6abc7e705ee2b4df5e49e7f553291a21e87da95c061f6bc25260e000187f0c
SSDEEP

768:/bzBTSKGyUSN2iUBnBgPN3AC4ZsNxscq84yQl/ZNW:/bN961BBgPqCOsPscqcQl/bW

Score

8^/10

discovery exploit

Malware Config

Signatures

Possible privilege escalation attempt 8 IoCs
exploit

Processes:

takeown.exeicacls.exetakeown.exeicacls.exetakeown.exeicacls.exetakeown.exeicacls.exe

pid process

1116 takeown.exe
960 icacls.exe
1964 takeown.exe
2008 icacls.exe
1564 takeown.exe
940 icacls.exe
1088 takeown.exe
964 icacls.exe
Modifies file permissions 1 TTPs 8 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

takeown.exeicacls.exetakeown.exeicacls.exetakeown.exeicacls.exetakeown.exeicacls.exe

pid process

1964 takeown.exe
2008 icacls.exe
1564 takeown.exe
940 icacls.exe
1088 takeown.exe
964 icacls.exe
1116 takeown.exe
960 icacls.exe

pid	process
1116	takeown.exe
960	icacls.exe
1964	takeown.exe
2008	icacls.exe
1564	takeown.exe
940	icacls.exe
1088	takeown.exe
964	icacls.exe

pid	process
1964	takeown.exe
2008	icacls.exe
1564	takeown.exe
940	icacls.exe
1088	takeown.exe
964	icacls.exe
1116	takeown.exe
960	icacls.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

takeown.exetakeown.exetakeown.exetakeown.exe

description	pid	process
Token: SeTakeOwnershipPrivilege	1964	takeown.exe
Token: SeTakeOwnershipPrivilege	1564	takeown.exe
Token: SeTakeOwnershipPrivilege	1116	takeown.exe
Token: SeTakeOwnershipPrivilege	1088	takeown.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

5f8a4293e943cd0950e3d32f021a02cfcb2f1b2f57a7d25338ae75be89c009a0.exe

pid process

1452 5f8a4293e943cd0950e3d32f021a02cfcb2f1b2f57a7d25338ae75be89c009a0.exe

pid	process
1452	5f8a4293e943cd0950e3d32f021a02cfcb2f1b2f57a7d25338ae75be89c009a0.exe

Suspicious use of WriteProcessMemory 32 IoCs

Processes:

5f8a4293e943cd0950e3d32f021a02cfcb2f1b2f57a7d25338ae75be89c009a0.exe

description	pid	process	target process
PID 1452 wrote to memory of 1964	1452	5f8a4293e943cd0950e3d32f021a02cfcb2f1b2f57a7d25338ae75be89c009a0.exe	takeown.exe
PID 1452 wrote to memory of 1964	1452	5f8a4293e943cd0950e3d32f021a02cfcb2f1b2f57a7d25338ae75be89c009a0.exe	takeown.exe
PID 1452 wrote to memory of 1964	1452	5f8a4293e943cd0950e3d32f021a02cfcb2f1b2f57a7d25338ae75be89c009a0.exe	takeown.exe
PID 1452 wrote to memory of 1964	1452	5f8a4293e943cd0950e3d32f021a02cfcb2f1b2f57a7d25338ae75be89c009a0.exe	takeown.exe
PID 1452 wrote to memory of 2008	1452	5f8a4293e943cd0950e3d32f021a02cfcb2f1b2f57a7d25338ae75be89c009a0.exe	icacls.exe
PID 1452 wrote to memory of 2008	1452	5f8a4293e943cd0950e3d32f021a02cfcb2f1b2f57a7d25338ae75be89c009a0.exe	icacls.exe
PID 1452 wrote to memory of 2008	1452	5f8a4293e943cd0950e3d32f021a02cfcb2f1b2f57a7d25338ae75be89c009a0.exe	icacls.exe
PID 1452 wrote to memory of 2008	1452	5f8a4293e943cd0950e3d32f021a02cfcb2f1b2f57a7d25338ae75be89c009a0.exe	icacls.exe
PID 1452 wrote to memory of 1564	1452	5f8a4293e943cd0950e3d32f021a02cfcb2f1b2f57a7d25338ae75be89c009a0.exe	takeown.exe
PID 1452 wrote to memory of 1564	1452	5f8a4293e943cd0950e3d32f021a02cfcb2f1b2f57a7d25338ae75be89c009a0.exe	takeown.exe
PID 1452 wrote to memory of 1564	1452	5f8a4293e943cd0950e3d32f021a02cfcb2f1b2f57a7d25338ae75be89c009a0.exe	takeown.exe
PID 1452 wrote to memory of 1564	1452	5f8a4293e943cd0950e3d32f021a02cfcb2f1b2f57a7d25338ae75be89c009a0.exe	takeown.exe
PID 1452 wrote to memory of 940	1452	5f8a4293e943cd0950e3d32f021a02cfcb2f1b2f57a7d25338ae75be89c009a0.exe	icacls.exe
PID 1452 wrote to memory of 940	1452	5f8a4293e943cd0950e3d32f021a02cfcb2f1b2f57a7d25338ae75be89c009a0.exe	icacls.exe
PID 1452 wrote to memory of 940	1452	5f8a4293e943cd0950e3d32f021a02cfcb2f1b2f57a7d25338ae75be89c009a0.exe	icacls.exe
PID 1452 wrote to memory of 940	1452	5f8a4293e943cd0950e3d32f021a02cfcb2f1b2f57a7d25338ae75be89c009a0.exe	icacls.exe
PID 1452 wrote to memory of 1088	1452	5f8a4293e943cd0950e3d32f021a02cfcb2f1b2f57a7d25338ae75be89c009a0.exe	takeown.exe
PID 1452 wrote to memory of 1088	1452	5f8a4293e943cd0950e3d32f021a02cfcb2f1b2f57a7d25338ae75be89c009a0.exe	takeown.exe
PID 1452 wrote to memory of 1088	1452	5f8a4293e943cd0950e3d32f021a02cfcb2f1b2f57a7d25338ae75be89c009a0.exe	takeown.exe
PID 1452 wrote to memory of 1088	1452	5f8a4293e943cd0950e3d32f021a02cfcb2f1b2f57a7d25338ae75be89c009a0.exe	takeown.exe
PID 1452 wrote to memory of 964	1452	5f8a4293e943cd0950e3d32f021a02cfcb2f1b2f57a7d25338ae75be89c009a0.exe	icacls.exe
PID 1452 wrote to memory of 964	1452	5f8a4293e943cd0950e3d32f021a02cfcb2f1b2f57a7d25338ae75be89c009a0.exe	icacls.exe
PID 1452 wrote to memory of 964	1452	5f8a4293e943cd0950e3d32f021a02cfcb2f1b2f57a7d25338ae75be89c009a0.exe	icacls.exe
PID 1452 wrote to memory of 964	1452	5f8a4293e943cd0950e3d32f021a02cfcb2f1b2f57a7d25338ae75be89c009a0.exe	icacls.exe
PID 1452 wrote to memory of 1116	1452	5f8a4293e943cd0950e3d32f021a02cfcb2f1b2f57a7d25338ae75be89c009a0.exe	takeown.exe
PID 1452 wrote to memory of 1116	1452	5f8a4293e943cd0950e3d32f021a02cfcb2f1b2f57a7d25338ae75be89c009a0.exe	takeown.exe
PID 1452 wrote to memory of 1116	1452	5f8a4293e943cd0950e3d32f021a02cfcb2f1b2f57a7d25338ae75be89c009a0.exe	takeown.exe
PID 1452 wrote to memory of 1116	1452	5f8a4293e943cd0950e3d32f021a02cfcb2f1b2f57a7d25338ae75be89c009a0.exe	takeown.exe
PID 1452 wrote to memory of 960	1452	5f8a4293e943cd0950e3d32f021a02cfcb2f1b2f57a7d25338ae75be89c009a0.exe	icacls.exe
PID 1452 wrote to memory of 960	1452	5f8a4293e943cd0950e3d32f021a02cfcb2f1b2f57a7d25338ae75be89c009a0.exe	icacls.exe
PID 1452 wrote to memory of 960	1452	5f8a4293e943cd0950e3d32f021a02cfcb2f1b2f57a7d25338ae75be89c009a0.exe	icacls.exe
PID 1452 wrote to memory of 960	1452	5f8a4293e943cd0950e3d32f021a02cfcb2f1b2f57a7d25338ae75be89c009a0.exe	icacls.exe

C:\Users\Admin\AppData\Local\Temp\5f8a4293e943cd0950e3d32f021a02cfcb2f1b2f57a7d25338ae75be89c009a0.exe
"C:\Users\Admin\AppData\Local\Temp\5f8a4293e943cd0950e3d32f021a02cfcb2f1b2f57a7d25338ae75be89c009a0.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1452

C:\Windows\SysWOW64\takeown.exe
C:\Windows\System32\takeown.exe /f "C:\Windows\System32\cmd.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:1964

C:\Windows\SysWOW64\icacls.exe
C:\Windows\System32\icacls.exe "C:\Windows\System32\cmd.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:2008

C:\Windows\SysWOW64\takeown.exe
C:\Windows\System32\takeown.exe /f "C:\Windows\System32\ftp.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:1564

C:\Windows\SysWOW64\icacls.exe
C:\Windows\System32\icacls.exe "C:\Windows\System32\ftp.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:940

C:\Windows\SysWOW64\takeown.exe
C:\Windows\System32\takeown.exe /f "C:\Windows\System32\wscript.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:1088

C:\Windows\SysWOW64\icacls.exe
C:\Windows\System32\icacls.exe "C:\Windows\System32\wscript.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:964

C:\Windows\SysWOW64\takeown.exe
C:\Windows\System32\takeown.exe /f "C:\Windows\System32\cscript.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:1116

C:\Windows\SysWOW64\icacls.exe
C:\Windows\System32\icacls.exe "C:\Windows\System32\cscript.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:960

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

1

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/940-59-0x0000000000000000-mapping.dmp

Download
memory/960-63-0x0000000000000000-mapping.dmp

Download
memory/964-61-0x0000000000000000-mapping.dmp

Download
memory/1088-60-0x0000000000000000-mapping.dmp

Download
memory/1116-62-0x0000000000000000-mapping.dmp

Download
memory/1564-58-0x0000000000000000-mapping.dmp

Download
memory/1964-56-0x0000000000000000-mapping.dmp

Download
memory/2008-57-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing