e49097e384a29fcd83091e7a0bdbf70033a1fb7ef92d72713d962e06ffe763a4

Analysis

max time kernel
42s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07-11-2022 09:51

Target

e49097e384a29fcd83091e7a0bdbf70033a1fb7ef92d72713d962e06ffe763a4.exe
Size

72KB
MD5

056f96dd83869178cc89db4fc54d6d90
SHA1

b1634bbabcc7da99162eaa98a074b3d2d9795cca
SHA256

e49097e384a29fcd83091e7a0bdbf70033a1fb7ef92d72713d962e06ffe763a4
SHA512

4e9a796156938336b53e533c8117781e6f57d74b4d78b3c59762c67e795218a305059cc183e68d3bdc6d314cd3ec62c9a22c674290f4b5b48d7ee3cfcfd35916
SSDEEP

1536:nOLJplNXhB/+IPqtQ18PaFscIePpbeK/CeX6ZmwXCuQJ/p4+:nAJplB/+IStQ19FscIQb3imwXCuKO+

Score

8^/10

discovery exploit

Possible privilege escalation attempt 2 IoCs
exploit

Processes:

takeown.exeicacls.exe

pid process

816 takeown.exe
1352 icacls.exe
Modifies file permissions 1 TTPs 2 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

takeown.exeicacls.exe

pid process

816 takeown.exe
1352 icacls.exe

pid	process
816	takeown.exe
1352	icacls.exe

pid	process
816	takeown.exe
1352	icacls.exe

Drops file in System32 directory 2 IoCs

Processes:

e49097e384a29fcd83091e7a0bdbf70033a1fb7ef92d72713d962e06ffe763a4.exe

description	ioc	process
File created	C:\Windows\SysWOW64\rrkr.exe	e49097e384a29fcd83091e7a0bdbf70033a1fb7ef92d72713d962e06ffe763a4.exe
File opened for modification	C:\Windows\SysWOW64\rrkr.exe	e49097e384a29fcd83091e7a0bdbf70033a1fb7ef92d72713d962e06ffe763a4.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

e49097e384a29fcd83091e7a0bdbf70033a1fb7ef92d72713d962e06ffe763a4.exe

pid process

1264 e49097e384a29fcd83091e7a0bdbf70033a1fb7ef92d72713d962e06ffe763a4.exe

pid	process
1264	e49097e384a29fcd83091e7a0bdbf70033a1fb7ef92d72713d962e06ffe763a4.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

e49097e384a29fcd83091e7a0bdbf70033a1fb7ef92d72713d962e06ffe763a4.exe

description	pid	process	target process
PID 1264 wrote to memory of 816	1264	e49097e384a29fcd83091e7a0bdbf70033a1fb7ef92d72713d962e06ffe763a4.exe	takeown.exe
PID 1264 wrote to memory of 816	1264	e49097e384a29fcd83091e7a0bdbf70033a1fb7ef92d72713d962e06ffe763a4.exe	takeown.exe
PID 1264 wrote to memory of 816	1264	e49097e384a29fcd83091e7a0bdbf70033a1fb7ef92d72713d962e06ffe763a4.exe	takeown.exe
PID 1264 wrote to memory of 816	1264	e49097e384a29fcd83091e7a0bdbf70033a1fb7ef92d72713d962e06ffe763a4.exe	takeown.exe
PID 1264 wrote to memory of 1352	1264	e49097e384a29fcd83091e7a0bdbf70033a1fb7ef92d72713d962e06ffe763a4.exe	icacls.exe
PID 1264 wrote to memory of 1352	1264	e49097e384a29fcd83091e7a0bdbf70033a1fb7ef92d72713d962e06ffe763a4.exe	icacls.exe
PID 1264 wrote to memory of 1352	1264	e49097e384a29fcd83091e7a0bdbf70033a1fb7ef92d72713d962e06ffe763a4.exe	icacls.exe
PID 1264 wrote to memory of 1352	1264	e49097e384a29fcd83091e7a0bdbf70033a1fb7ef92d72713d962e06ffe763a4.exe	icacls.exe

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Windows\SysWOW64\rrkr.exe

Filesize
72KB

MD5
056f96dd83869178cc89db4fc54d6d90

SHA1
b1634bbabcc7da99162eaa98a074b3d2d9795cca

SHA256
e49097e384a29fcd83091e7a0bdbf70033a1fb7ef92d72713d962e06ffe763a4

SHA512
4e9a796156938336b53e533c8117781e6f57d74b4d78b3c59762c67e795218a305059cc183e68d3bdc6d314cd3ec62c9a22c674290f4b5b48d7ee3cfcfd35916

Download Submit
memory/816-57-0x0000000000000000-mapping.dmp

Download
memory/1264-56-0x0000000076711000-0x0000000076713000-memory.dmp

Filesize
8KB

Download
memory/1352-59-0x0000000000000000-mapping.dmp

Download