dfdea2bd42d4e88414736e773c84d365b074219b79dc0248386dc23edf37aa68

Analysis

max time kernel
34s
max time network
42s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07-11-2022 09:59

Target

dfdea2bd42d4e88414736e773c84d365b074219b79dc0248386dc23edf37aa68.exe
Size

56KB
MD5

0d2b38415941d62f462315f6ce8ca851
SHA1

826af20b72d2f40fbbb3cb4cf10a87dc948c18b1
SHA256

dfdea2bd42d4e88414736e773c84d365b074219b79dc0248386dc23edf37aa68
SHA512

c9d3efc0381131a274d08d678aae40d7a10c662b1ea45b7489ac9439bf1b58d6cc0740485cab9860065420ea93d986726ea12dc63101de033b76b12f604d524b
SSDEEP

1536:3STDBwjgBI0VoOba/969CkQuIrg3MBLqg2byk:3SNrVoOm/96skQuIrgMBOkk

Score

8^/10

discovery exploit

Possible privilege escalation attempt 2 IoCs
exploit

Processes:

takeown.exeicacls.exe

pid process

1812 takeown.exe
2020 icacls.exe
Modifies file permissions 1 TTPs 2 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

takeown.exeicacls.exe

pid process

1812 takeown.exe
2020 icacls.exe

pid	process
1812	takeown.exe
2020	icacls.exe

pid	process
1812	takeown.exe
2020	icacls.exe

Drops file in System32 directory 2 IoCs

Processes:

dfdea2bd42d4e88414736e773c84d365b074219b79dc0248386dc23edf37aa68.exe

description	ioc	process
File created	\??\c:\windows\SysWOW64\ivnr.exe	dfdea2bd42d4e88414736e773c84d365b074219b79dc0248386dc23edf37aa68.exe
File opened for modification	\??\c:\windows\SysWOW64\ivnr.exe	dfdea2bd42d4e88414736e773c84d365b074219b79dc0248386dc23edf37aa68.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

dfdea2bd42d4e88414736e773c84d365b074219b79dc0248386dc23edf37aa68.exe

pid process

1612 dfdea2bd42d4e88414736e773c84d365b074219b79dc0248386dc23edf37aa68.exe

pid	process
1612	dfdea2bd42d4e88414736e773c84d365b074219b79dc0248386dc23edf37aa68.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

dfdea2bd42d4e88414736e773c84d365b074219b79dc0248386dc23edf37aa68.exe

description	pid	process	target process
PID 1612 wrote to memory of 1812	1612	dfdea2bd42d4e88414736e773c84d365b074219b79dc0248386dc23edf37aa68.exe	takeown.exe
PID 1612 wrote to memory of 1812	1612	dfdea2bd42d4e88414736e773c84d365b074219b79dc0248386dc23edf37aa68.exe	takeown.exe
PID 1612 wrote to memory of 1812	1612	dfdea2bd42d4e88414736e773c84d365b074219b79dc0248386dc23edf37aa68.exe	takeown.exe
PID 1612 wrote to memory of 1812	1612	dfdea2bd42d4e88414736e773c84d365b074219b79dc0248386dc23edf37aa68.exe	takeown.exe
PID 1612 wrote to memory of 2020	1612	dfdea2bd42d4e88414736e773c84d365b074219b79dc0248386dc23edf37aa68.exe	icacls.exe
PID 1612 wrote to memory of 2020	1612	dfdea2bd42d4e88414736e773c84d365b074219b79dc0248386dc23edf37aa68.exe	icacls.exe
PID 1612 wrote to memory of 2020	1612	dfdea2bd42d4e88414736e773c84d365b074219b79dc0248386dc23edf37aa68.exe	icacls.exe
PID 1612 wrote to memory of 2020	1612	dfdea2bd42d4e88414736e773c84d365b074219b79dc0248386dc23edf37aa68.exe	icacls.exe

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

\??\c:\windows\SysWOW64\ivnr.exe

Filesize
56KB

MD5
0d2b38415941d62f462315f6ce8ca851

SHA1
826af20b72d2f40fbbb3cb4cf10a87dc948c18b1

SHA256
dfdea2bd42d4e88414736e773c84d365b074219b79dc0248386dc23edf37aa68

SHA512
c9d3efc0381131a274d08d678aae40d7a10c662b1ea45b7489ac9439bf1b58d6cc0740485cab9860065420ea93d986726ea12dc63101de033b76b12f604d524b

Download Submit
memory/1812-56-0x0000000000000000-mapping.dmp

Download
memory/2020-57-0x0000000000000000-mapping.dmp

Download