88b2f85cdf9380a2bbfed6fb45bb0d9ef9dcfa1e68019a9e708a4b10aca165f3

Analysis

max time kernel
73s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07-11-2022 11:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

88b2f85cdf9380a2bbfed6fb45bb0d9ef9dcfa1e68019a9e708a4b10aca165f3.exe
Size

40KB
MD5

0f76358e5c2bbf8c46c2559272b25ca6
SHA1

81e2f49d2a6c2e9f4b768bebb382e847f3069a74
SHA256

88b2f85cdf9380a2bbfed6fb45bb0d9ef9dcfa1e68019a9e708a4b10aca165f3
SHA512

64aec74be2351c5f90f4c41244b3e5875ced252731b2bc0c6e3f673094354754f47b77ef8340354a7e80dd82017d07342ae836ea530b7cd9ff7a33b1fb3c62a5
SSDEEP

768:/uDu9GYNdVIYKiZynNVMlxcwa4cFBMdzQj0ZiTcwwuUCYD:/uDtkXlDcwa4c0dopYD

Score

8^/10

discovery exploit persistence

Malware Config

Signatures

Possible privilege escalation attempt 2 IoCs

exploit

pid	Process
996	icacls.exe
892	takeown.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
892	takeown.exe
996	icacls.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\vuzhs = "C:\\Windows\\system32\\sdwxo.exe"	88b2f85cdf9380a2bbfed6fb45bb0d9ef9dcfa1e68019a9e708a4b10aca165f3.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	88b2f85cdf9380a2bbfed6fb45bb0d9ef9dcfa1e68019a9e708a4b10aca165f3.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\sdwxo.exe	88b2f85cdf9380a2bbfed6fb45bb0d9ef9dcfa1e68019a9e708a4b10aca165f3.exe
File opened for modification	C:\Windows\SysWOW64\sdwxo.exe	88b2f85cdf9380a2bbfed6fb45bb0d9ef9dcfa1e68019a9e708a4b10aca165f3.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1644	88b2f85cdf9380a2bbfed6fb45bb0d9ef9dcfa1e68019a9e708a4b10aca165f3.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1644 wrote to memory of 892	1644	88b2f85cdf9380a2bbfed6fb45bb0d9ef9dcfa1e68019a9e708a4b10aca165f3.exe	28
PID 1644 wrote to memory of 892	1644	88b2f85cdf9380a2bbfed6fb45bb0d9ef9dcfa1e68019a9e708a4b10aca165f3.exe	28
PID 1644 wrote to memory of 892	1644	88b2f85cdf9380a2bbfed6fb45bb0d9ef9dcfa1e68019a9e708a4b10aca165f3.exe	28
PID 1644 wrote to memory of 892	1644	88b2f85cdf9380a2bbfed6fb45bb0d9ef9dcfa1e68019a9e708a4b10aca165f3.exe	28
PID 1644 wrote to memory of 996	1644	88b2f85cdf9380a2bbfed6fb45bb0d9ef9dcfa1e68019a9e708a4b10aca165f3.exe	30
PID 1644 wrote to memory of 996	1644	88b2f85cdf9380a2bbfed6fb45bb0d9ef9dcfa1e68019a9e708a4b10aca165f3.exe	30
PID 1644 wrote to memory of 996	1644	88b2f85cdf9380a2bbfed6fb45bb0d9ef9dcfa1e68019a9e708a4b10aca165f3.exe	30
PID 1644 wrote to memory of 996	1644	88b2f85cdf9380a2bbfed6fb45bb0d9ef9dcfa1e68019a9e708a4b10aca165f3.exe	30

C:\Users\Admin\AppData\Local\Temp\88b2f85cdf9380a2bbfed6fb45bb0d9ef9dcfa1e68019a9e708a4b10aca165f3.exe
"C:\Users\Admin\AppData\Local\Temp\88b2f85cdf9380a2bbfed6fb45bb0d9ef9dcfa1e68019a9e708a4b10aca165f3.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1644
- C:\Windows\SysWOW64\takeown.exe
  C:\Windows\system32\takeown.exe /f "C:\Windows\system32\sdwxo.exe"
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:892
- C:\Windows\SysWOW64\icacls.exe
  C:\Windows\system32\icacls.exe "C:\Windows\system32\sdwxo.exe" /grant Users:F
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:996

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\sdwxo.exe

Filesize
40KB

MD5
0f76358e5c2bbf8c46c2559272b25ca6

SHA1
81e2f49d2a6c2e9f4b768bebb382e847f3069a74

SHA256
88b2f85cdf9380a2bbfed6fb45bb0d9ef9dcfa1e68019a9e708a4b10aca165f3

SHA512
64aec74be2351c5f90f4c41244b3e5875ced252731b2bc0c6e3f673094354754f47b77ef8340354a7e80dd82017d07342ae836ea530b7cd9ff7a33b1fb3c62a5

Download Submit
memory/892-56-0x0000000000000000-mapping.dmp

Download
memory/996-57-0x0000000000000000-mapping.dmp

Download