8c56114c371cc3487b46b0a24bea94f83a9e75388ca89b4d30250958a2fa54dc

Analysis

max time kernel
149s
max time network
180s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
07-11-2022 05:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8c56114c371cc3487b46b0a24bea94f83a9e75388ca89b4d30250958a2fa54dc.exe
Size

40KB
MD5

0ce6305e04025187ecf7d77fc0b252e0
SHA1

db791b56789cb0d0607af5736776eb5d1ee6391c
SHA256

8c56114c371cc3487b46b0a24bea94f83a9e75388ca89b4d30250958a2fa54dc
SHA512

8277961cb4bddfc0dfb5449bd867129008185777db27fd7c51121228f883cd8dd1fa8bc95fc10898e8225d1b00a18448d14a54186f205cffd8d166520bad2347
SSDEEP

768:/lxovdKAmIJRz7mi3D07UeBKF5SkcZ4PKdXc1sDhl:/lm4AJPz7mGeYsdXc1stl

Score

8^/10

discovery exploit persistence

Malware Config

Signatures

Possible privilege escalation attempt 2 IoCs
exploit

Processes:

takeown.exeicacls.exe

pid process

5072 takeown.exe
5076 icacls.exe
Modifies file permissions 1 TTPs 2 IoCs
discovery

File Permissions Modification
T1222

Processes:

takeown.exeicacls.exe

pid process

5072 takeown.exe
5076 icacls.exe

pid	process
5072	takeown.exe
5076	icacls.exe

pid	process
5072	takeown.exe
5076	icacls.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

8c56114c371cc3487b46b0a24bea94f83a9e75388ca89b4d30250958a2fa54dc.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	8c56114c371cc3487b46b0a24bea94f83a9e75388ca89b4d30250958a2fa54dc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DkV = "C:\\Windows\\system32\\wrdcw.exe"	8c56114c371cc3487b46b0a24bea94f83a9e75388ca89b4d30250958a2fa54dc.exe

Drops file in System32 directory 2 IoCs

Processes:

8c56114c371cc3487b46b0a24bea94f83a9e75388ca89b4d30250958a2fa54dc.exe

description	ioc	process
File created	C:\Windows\SysWOW64\wrdcw.exe	8c56114c371cc3487b46b0a24bea94f83a9e75388ca89b4d30250958a2fa54dc.exe
File opened for modification	C:\Windows\SysWOW64\wrdcw.exe	8c56114c371cc3487b46b0a24bea94f83a9e75388ca89b4d30250958a2fa54dc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

8c56114c371cc3487b46b0a24bea94f83a9e75388ca89b4d30250958a2fa54dc.exe

pid process

5084 8c56114c371cc3487b46b0a24bea94f83a9e75388ca89b4d30250958a2fa54dc.exe

pid	process
5084	8c56114c371cc3487b46b0a24bea94f83a9e75388ca89b4d30250958a2fa54dc.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

8c56114c371cc3487b46b0a24bea94f83a9e75388ca89b4d30250958a2fa54dc.exe

description	pid	process	target process
PID 5084 wrote to memory of 5072	5084	8c56114c371cc3487b46b0a24bea94f83a9e75388ca89b4d30250958a2fa54dc.exe	takeown.exe
PID 5084 wrote to memory of 5072	5084	8c56114c371cc3487b46b0a24bea94f83a9e75388ca89b4d30250958a2fa54dc.exe	takeown.exe
PID 5084 wrote to memory of 5072	5084	8c56114c371cc3487b46b0a24bea94f83a9e75388ca89b4d30250958a2fa54dc.exe	takeown.exe
PID 5084 wrote to memory of 5076	5084	8c56114c371cc3487b46b0a24bea94f83a9e75388ca89b4d30250958a2fa54dc.exe	icacls.exe
PID 5084 wrote to memory of 5076	5084	8c56114c371cc3487b46b0a24bea94f83a9e75388ca89b4d30250958a2fa54dc.exe	icacls.exe
PID 5084 wrote to memory of 5076	5084	8c56114c371cc3487b46b0a24bea94f83a9e75388ca89b4d30250958a2fa54dc.exe	icacls.exe

C:\Users\Admin\AppData\Local\Temp\8c56114c371cc3487b46b0a24bea94f83a9e75388ca89b4d30250958a2fa54dc.exe
"C:\Users\Admin\AppData\Local\Temp\8c56114c371cc3487b46b0a24bea94f83a9e75388ca89b4d30250958a2fa54dc.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5084

C:\Windows\SysWOW64\takeown.exe
C:\Windows\system32\takeown.exe /f "C:\Windows\system32\wrdcw.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:5072

C:\Windows\SysWOW64\icacls.exe
C:\Windows\system32\icacls.exe "C:\Windows\system32\wrdcw.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:5076

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

File Permissions Modification

T1222

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\wrdcw.exe
Filesize
40KB

MD5
0ce6305e04025187ecf7d77fc0b252e0

SHA1
db791b56789cb0d0607af5736776eb5d1ee6391c

SHA256
8c56114c371cc3487b46b0a24bea94f83a9e75388ca89b4d30250958a2fa54dc

SHA512
8277961cb4bddfc0dfb5449bd867129008185777db27fd7c51121228f883cd8dd1fa8bc95fc10898e8225d1b00a18448d14a54186f205cffd8d166520bad2347

Download Submit
memory/5072-134-0x0000000000000000-mapping.dmp

Download
memory/5076-135-0x0000000000000000-mapping.dmp

Download