0f98884a4b61823751e4d15411c716e503b1532b81f14d0862d5eedea5d3ebee

Analysis

max time kernel
169s
max time network
198s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
07-11-2022 05:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0f98884a4b61823751e4d15411c716e503b1532b81f14d0862d5eedea5d3ebee.exe
Size

60KB
MD5

04889728c050d67be39f3fe3b4122376
SHA1

dc31aa70c065b9d7d34a758c38a4a23db500f7d9
SHA256

0f98884a4b61823751e4d15411c716e503b1532b81f14d0862d5eedea5d3ebee
SHA512

e0655018923fec9cd6f2d061fc7b39c89fd6484b950569ac12ed8d4243900cf85cd0c05493133ffe8b10eabb080919f0ea95fde1b80bdfbd1a48f8e3cba6175e
SSDEEP

768:j846E20pHTcEthIScmbPu5Q3Nen+4RN5EvjuHwWs4eNE1tV7xaUlvXM:j8TRI7dbPusNen+4RN5uK0ZMvl/M

Score

8^/10

discovery exploit persistence

Malware Config

Signatures

Possible privilege escalation attempt 2 IoCs
exploit

Processes:

takeown.exeicacls.exe

pid process

3672 takeown.exe
4376 icacls.exe
Modifies file permissions 1 TTPs 2 IoCs
discovery

File Permissions Modification
T1222

Processes:

takeown.exeicacls.exe

pid process

3672 takeown.exe
4376 icacls.exe

pid	process
3672	takeown.exe
4376	icacls.exe

pid	process
3672	takeown.exe
4376	icacls.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

0f98884a4b61823751e4d15411c716e503b1532b81f14d0862d5eedea5d3ebee.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	0f98884a4b61823751e4d15411c716e503b1532b81f14d0862d5eedea5d3ebee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\rbrdkxr = "C:\\Windows\\system32\\eiefg.exe"	0f98884a4b61823751e4d15411c716e503b1532b81f14d0862d5eedea5d3ebee.exe

Drops file in System32 directory 2 IoCs

Processes:

0f98884a4b61823751e4d15411c716e503b1532b81f14d0862d5eedea5d3ebee.exe

description	ioc	process
File created	C:\Windows\SysWOW64\eiefg.exe	0f98884a4b61823751e4d15411c716e503b1532b81f14d0862d5eedea5d3ebee.exe
File opened for modification	C:\Windows\SysWOW64\eiefg.exe	0f98884a4b61823751e4d15411c716e503b1532b81f14d0862d5eedea5d3ebee.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

0f98884a4b61823751e4d15411c716e503b1532b81f14d0862d5eedea5d3ebee.exe

pid process

4740 0f98884a4b61823751e4d15411c716e503b1532b81f14d0862d5eedea5d3ebee.exe

pid	process
4740	0f98884a4b61823751e4d15411c716e503b1532b81f14d0862d5eedea5d3ebee.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

0f98884a4b61823751e4d15411c716e503b1532b81f14d0862d5eedea5d3ebee.exe

description	pid	process	target process
PID 4740 wrote to memory of 3672	4740	0f98884a4b61823751e4d15411c716e503b1532b81f14d0862d5eedea5d3ebee.exe	takeown.exe
PID 4740 wrote to memory of 3672	4740	0f98884a4b61823751e4d15411c716e503b1532b81f14d0862d5eedea5d3ebee.exe	takeown.exe
PID 4740 wrote to memory of 3672	4740	0f98884a4b61823751e4d15411c716e503b1532b81f14d0862d5eedea5d3ebee.exe	takeown.exe
PID 4740 wrote to memory of 4376	4740	0f98884a4b61823751e4d15411c716e503b1532b81f14d0862d5eedea5d3ebee.exe	icacls.exe
PID 4740 wrote to memory of 4376	4740	0f98884a4b61823751e4d15411c716e503b1532b81f14d0862d5eedea5d3ebee.exe	icacls.exe
PID 4740 wrote to memory of 4376	4740	0f98884a4b61823751e4d15411c716e503b1532b81f14d0862d5eedea5d3ebee.exe	icacls.exe

C:\Users\Admin\AppData\Local\Temp\0f98884a4b61823751e4d15411c716e503b1532b81f14d0862d5eedea5d3ebee.exe
"C:\Users\Admin\AppData\Local\Temp\0f98884a4b61823751e4d15411c716e503b1532b81f14d0862d5eedea5d3ebee.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4740

C:\Windows\SysWOW64\takeown.exe
C:\Windows\system32\takeown.exe /f "C:\Windows\system32\eiefg.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:3672

C:\Windows\SysWOW64\icacls.exe
C:\Windows\system32\icacls.exe "C:\Windows\system32\eiefg.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:4376

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

File Permissions Modification

T1222

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\eiefg.exe
Filesize
60KB

MD5
04889728c050d67be39f3fe3b4122376

SHA1
dc31aa70c065b9d7d34a758c38a4a23db500f7d9

SHA256
0f98884a4b61823751e4d15411c716e503b1532b81f14d0862d5eedea5d3ebee

SHA512
e0655018923fec9cd6f2d061fc7b39c89fd6484b950569ac12ed8d4243900cf85cd0c05493133ffe8b10eabb080919f0ea95fde1b80bdfbd1a48f8e3cba6175e

Download Submit
memory/3672-134-0x0000000000000000-mapping.dmp

Download
memory/4376-135-0x0000000000000000-mapping.dmp

Download