5f8a4293e943cd0950e3d32f021a02cfcb2f1b2f57a7d25338ae75be89c009a0

General

Target

5f8a4293e943cd0950e3d32f021a02cfcb2f1b2f57a7d25338ae75be89c009a0.exe
Size

36KB
MD5

0659c3376dffe4ccf0e3afd688829300
SHA1

b3ba94eaf100a37605646123975ee31f7802135d
SHA256

5f8a4293e943cd0950e3d32f021a02cfcb2f1b2f57a7d25338ae75be89c009a0
SHA512

bfd6f9db9d27df36ada48101ec2465bf45f2d5b0864b511dbe38745590b13d661d6abc7e705ee2b4df5e49e7f553291a21e87da95c061f6bc25260e000187f0c
SSDEEP

768:/bzBTSKGyUSN2iUBnBgPN3AC4ZsNxscq84yQl/ZNW:/bN961BBgPqCOsPscqcQl/bW

Score

8^/10

discovery exploit

Malware Config

Signatures

Possible privilege escalation attempt 8 IoCs
exploit

Processes:

icacls.exetakeown.exeicacls.exetakeown.exeicacls.exetakeown.exeicacls.exetakeown.exe

pid process

2584 icacls.exe
3276 takeown.exe
976 icacls.exe
2620 takeown.exe
3496 icacls.exe
4616 takeown.exe
4288 icacls.exe
2704 takeown.exe
Modifies file permissions 1 TTPs 8 IoCs
discovery

File Permissions Modification
T1222

Processes:

icacls.exetakeown.exeicacls.exetakeown.exeicacls.exetakeown.exeicacls.exetakeown.exe

pid process

976 icacls.exe
2620 takeown.exe
3496 icacls.exe
4616 takeown.exe
4288 icacls.exe
2704 takeown.exe
2584 icacls.exe
3276 takeown.exe

pid	process
2584	icacls.exe
3276	takeown.exe
976	icacls.exe
2620	takeown.exe
3496	icacls.exe
4616	takeown.exe
4288	icacls.exe
2704	takeown.exe

pid	process
976	icacls.exe
2620	takeown.exe
3496	icacls.exe
4616	takeown.exe
4288	icacls.exe
2704	takeown.exe
2584	icacls.exe
3276	takeown.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

takeown.exetakeown.exetakeown.exetakeown.exe

description	pid	process
Token: SeTakeOwnershipPrivilege	3276	takeown.exe
Token: SeTakeOwnershipPrivilege	2704	takeown.exe
Token: SeTakeOwnershipPrivilege	4616	takeown.exe
Token: SeTakeOwnershipPrivilege	2620	takeown.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

5f8a4293e943cd0950e3d32f021a02cfcb2f1b2f57a7d25338ae75be89c009a0.exe

pid process

3464 5f8a4293e943cd0950e3d32f021a02cfcb2f1b2f57a7d25338ae75be89c009a0.exe

pid	process
3464	5f8a4293e943cd0950e3d32f021a02cfcb2f1b2f57a7d25338ae75be89c009a0.exe

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

5f8a4293e943cd0950e3d32f021a02cfcb2f1b2f57a7d25338ae75be89c009a0.exe

description	pid	process	target process
PID 3464 wrote to memory of 4616	3464	5f8a4293e943cd0950e3d32f021a02cfcb2f1b2f57a7d25338ae75be89c009a0.exe	takeown.exe
PID 3464 wrote to memory of 4616	3464	5f8a4293e943cd0950e3d32f021a02cfcb2f1b2f57a7d25338ae75be89c009a0.exe	takeown.exe
PID 3464 wrote to memory of 4616	3464	5f8a4293e943cd0950e3d32f021a02cfcb2f1b2f57a7d25338ae75be89c009a0.exe	takeown.exe
PID 3464 wrote to memory of 4288	3464	5f8a4293e943cd0950e3d32f021a02cfcb2f1b2f57a7d25338ae75be89c009a0.exe	icacls.exe
PID 3464 wrote to memory of 4288	3464	5f8a4293e943cd0950e3d32f021a02cfcb2f1b2f57a7d25338ae75be89c009a0.exe	icacls.exe
PID 3464 wrote to memory of 4288	3464	5f8a4293e943cd0950e3d32f021a02cfcb2f1b2f57a7d25338ae75be89c009a0.exe	icacls.exe
PID 3464 wrote to memory of 2704	3464	5f8a4293e943cd0950e3d32f021a02cfcb2f1b2f57a7d25338ae75be89c009a0.exe	takeown.exe
PID 3464 wrote to memory of 2704	3464	5f8a4293e943cd0950e3d32f021a02cfcb2f1b2f57a7d25338ae75be89c009a0.exe	takeown.exe
PID 3464 wrote to memory of 2704	3464	5f8a4293e943cd0950e3d32f021a02cfcb2f1b2f57a7d25338ae75be89c009a0.exe	takeown.exe
PID 3464 wrote to memory of 2584	3464	5f8a4293e943cd0950e3d32f021a02cfcb2f1b2f57a7d25338ae75be89c009a0.exe	icacls.exe
PID 3464 wrote to memory of 2584	3464	5f8a4293e943cd0950e3d32f021a02cfcb2f1b2f57a7d25338ae75be89c009a0.exe	icacls.exe
PID 3464 wrote to memory of 2584	3464	5f8a4293e943cd0950e3d32f021a02cfcb2f1b2f57a7d25338ae75be89c009a0.exe	icacls.exe
PID 3464 wrote to memory of 3276	3464	5f8a4293e943cd0950e3d32f021a02cfcb2f1b2f57a7d25338ae75be89c009a0.exe	takeown.exe
PID 3464 wrote to memory of 3276	3464	5f8a4293e943cd0950e3d32f021a02cfcb2f1b2f57a7d25338ae75be89c009a0.exe	takeown.exe
PID 3464 wrote to memory of 3276	3464	5f8a4293e943cd0950e3d32f021a02cfcb2f1b2f57a7d25338ae75be89c009a0.exe	takeown.exe
PID 3464 wrote to memory of 976	3464	5f8a4293e943cd0950e3d32f021a02cfcb2f1b2f57a7d25338ae75be89c009a0.exe	icacls.exe
PID 3464 wrote to memory of 976	3464	5f8a4293e943cd0950e3d32f021a02cfcb2f1b2f57a7d25338ae75be89c009a0.exe	icacls.exe
PID 3464 wrote to memory of 976	3464	5f8a4293e943cd0950e3d32f021a02cfcb2f1b2f57a7d25338ae75be89c009a0.exe	icacls.exe
PID 3464 wrote to memory of 2620	3464	5f8a4293e943cd0950e3d32f021a02cfcb2f1b2f57a7d25338ae75be89c009a0.exe	takeown.exe
PID 3464 wrote to memory of 2620	3464	5f8a4293e943cd0950e3d32f021a02cfcb2f1b2f57a7d25338ae75be89c009a0.exe	takeown.exe
PID 3464 wrote to memory of 2620	3464	5f8a4293e943cd0950e3d32f021a02cfcb2f1b2f57a7d25338ae75be89c009a0.exe	takeown.exe
PID 3464 wrote to memory of 3496	3464	5f8a4293e943cd0950e3d32f021a02cfcb2f1b2f57a7d25338ae75be89c009a0.exe	icacls.exe
PID 3464 wrote to memory of 3496	3464	5f8a4293e943cd0950e3d32f021a02cfcb2f1b2f57a7d25338ae75be89c009a0.exe	icacls.exe
PID 3464 wrote to memory of 3496	3464	5f8a4293e943cd0950e3d32f021a02cfcb2f1b2f57a7d25338ae75be89c009a0.exe	icacls.exe

C:\Users\Admin\AppData\Local\Temp\5f8a4293e943cd0950e3d32f021a02cfcb2f1b2f57a7d25338ae75be89c009a0.exe
"C:\Users\Admin\AppData\Local\Temp\5f8a4293e943cd0950e3d32f021a02cfcb2f1b2f57a7d25338ae75be89c009a0.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3464

C:\Windows\SysWOW64\takeown.exe
C:\Windows\System32\takeown.exe /f "C:\Windows\System32\cmd.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:4616

C:\Windows\SysWOW64\icacls.exe
C:\Windows\System32\icacls.exe "C:\Windows\System32\cmd.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:4288

C:\Windows\SysWOW64\takeown.exe
C:\Windows\System32\takeown.exe /f "C:\Windows\System32\ftp.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:2704

C:\Windows\SysWOW64\icacls.exe
C:\Windows\System32\icacls.exe "C:\Windows\System32\ftp.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:2584

C:\Windows\SysWOW64\takeown.exe
C:\Windows\System32\takeown.exe /f "C:\Windows\System32\wscript.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:3276

C:\Windows\SysWOW64\icacls.exe
C:\Windows\System32\icacls.exe "C:\Windows\System32\wscript.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:976

C:\Windows\SysWOW64\takeown.exe
C:\Windows\System32\takeown.exe /f "C:\Windows\System32\cscript.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:2620

C:\Windows\SysWOW64\icacls.exe
C:\Windows\System32\icacls.exe "C:\Windows\System32\cscript.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:3496

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File Permissions Modification

1

T1222

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/976-139-0x0000000000000000-mapping.dmp

Download
memory/2584-137-0x0000000000000000-mapping.dmp

Download
memory/2620-140-0x0000000000000000-mapping.dmp

Download
memory/2704-136-0x0000000000000000-mapping.dmp

Download
memory/3276-138-0x0000000000000000-mapping.dmp

Download
memory/3496-141-0x0000000000000000-mapping.dmp

Download
memory/4288-135-0x0000000000000000-mapping.dmp

Download
memory/4616-134-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing