Analysis
-
max time kernel
142s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
07-11-2022 05:39
Static task
static1
Behavioral task
behavioral1
Sample
127469ee0eb75edde59455bfd28c0a4c26bdd6e8d67544c8d8f69fe882c58aa1.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
127469ee0eb75edde59455bfd28c0a4c26bdd6e8d67544c8d8f69fe882c58aa1.exe
Resource
win10v2004-20220812-en
General
-
Target
127469ee0eb75edde59455bfd28c0a4c26bdd6e8d67544c8d8f69fe882c58aa1.exe
-
Size
40KB
-
MD5
0f604a28d1f4100fa5225bdc09852bc6
-
SHA1
f33f902e7de406ac53e4fea03f419d0f2e1299c9
-
SHA256
127469ee0eb75edde59455bfd28c0a4c26bdd6e8d67544c8d8f69fe882c58aa1
-
SHA512
2c2929b2cb5b87d4327f4731dc3124cf63f6a940dd825012558e7315ac74670695f93d9dfe095eeb3ff9716e18925e370b6d3954f5770b7ce7c1af201d1345ba
-
SSDEEP
768:/+j4cIXa9EBkZyyhbL6tJGxh4hkmuMVPgVykOy+sJ3a1Xd0WK:/U4hRkf8tt1VPgVRLQd1K
Malware Config
Signatures
-
Possible privilege escalation attempt 2 IoCs
Processes:
takeown.exeicacls.exepid process 4848 takeown.exe 1520 icacls.exe -
Modifies file permissions 1 TTPs 2 IoCs
Processes:
icacls.exetakeown.exepid process 1520 icacls.exe 4848 takeown.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
127469ee0eb75edde59455bfd28c0a4c26bdd6e8d67544c8d8f69fe882c58aa1.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run 127469ee0eb75edde59455bfd28c0a4c26bdd6e8d67544c8d8f69fe882c58aa1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\UBGH = "C:\\Windows\\system32\\oftq.exe" 127469ee0eb75edde59455bfd28c0a4c26bdd6e8d67544c8d8f69fe882c58aa1.exe -
Drops file in System32 directory 2 IoCs
Processes:
127469ee0eb75edde59455bfd28c0a4c26bdd6e8d67544c8d8f69fe882c58aa1.exedescription ioc process File created C:\Windows\SysWOW64\oftq.exe 127469ee0eb75edde59455bfd28c0a4c26bdd6e8d67544c8d8f69fe882c58aa1.exe File opened for modification C:\Windows\SysWOW64\oftq.exe 127469ee0eb75edde59455bfd28c0a4c26bdd6e8d67544c8d8f69fe882c58aa1.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
127469ee0eb75edde59455bfd28c0a4c26bdd6e8d67544c8d8f69fe882c58aa1.exepid process 3096 127469ee0eb75edde59455bfd28c0a4c26bdd6e8d67544c8d8f69fe882c58aa1.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
127469ee0eb75edde59455bfd28c0a4c26bdd6e8d67544c8d8f69fe882c58aa1.exedescription pid process target process PID 3096 wrote to memory of 4848 3096 127469ee0eb75edde59455bfd28c0a4c26bdd6e8d67544c8d8f69fe882c58aa1.exe takeown.exe PID 3096 wrote to memory of 4848 3096 127469ee0eb75edde59455bfd28c0a4c26bdd6e8d67544c8d8f69fe882c58aa1.exe takeown.exe PID 3096 wrote to memory of 4848 3096 127469ee0eb75edde59455bfd28c0a4c26bdd6e8d67544c8d8f69fe882c58aa1.exe takeown.exe PID 3096 wrote to memory of 1520 3096 127469ee0eb75edde59455bfd28c0a4c26bdd6e8d67544c8d8f69fe882c58aa1.exe icacls.exe PID 3096 wrote to memory of 1520 3096 127469ee0eb75edde59455bfd28c0a4c26bdd6e8d67544c8d8f69fe882c58aa1.exe icacls.exe PID 3096 wrote to memory of 1520 3096 127469ee0eb75edde59455bfd28c0a4c26bdd6e8d67544c8d8f69fe882c58aa1.exe icacls.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\127469ee0eb75edde59455bfd28c0a4c26bdd6e8d67544c8d8f69fe882c58aa1.exe"C:\Users\Admin\AppData\Local\Temp\127469ee0eb75edde59455bfd28c0a4c26bdd6e8d67544c8d8f69fe882c58aa1.exe"1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\takeown.exeC:\Windows\system32\takeown.exe /f "C:\Windows\system32\oftq.exe"2⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\SysWOW64\icacls.exeC:\Windows\system32\icacls.exe "C:\Windows\system32\oftq.exe" /grant Users:F2⤵
- Possible privilege escalation attempt
- Modifies file permissions
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SysWOW64\oftq.exeFilesize
40KB
MD50f604a28d1f4100fa5225bdc09852bc6
SHA1f33f902e7de406ac53e4fea03f419d0f2e1299c9
SHA256127469ee0eb75edde59455bfd28c0a4c26bdd6e8d67544c8d8f69fe882c58aa1
SHA5122c2929b2cb5b87d4327f4731dc3124cf63f6a940dd825012558e7315ac74670695f93d9dfe095eeb3ff9716e18925e370b6d3954f5770b7ce7c1af201d1345ba
-
memory/1520-135-0x0000000000000000-mapping.dmp
-
memory/4848-134-0x0000000000000000-mapping.dmp