88b2f85cdf9380a2bbfed6fb45bb0d9ef9dcfa1e68019a9e708a4b10aca165f3

Analysis

max time kernel
214s
max time network
224s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
07-11-2022 11:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

88b2f85cdf9380a2bbfed6fb45bb0d9ef9dcfa1e68019a9e708a4b10aca165f3.exe
Size

40KB
MD5

0f76358e5c2bbf8c46c2559272b25ca6
SHA1

81e2f49d2a6c2e9f4b768bebb382e847f3069a74
SHA256

88b2f85cdf9380a2bbfed6fb45bb0d9ef9dcfa1e68019a9e708a4b10aca165f3
SHA512

64aec74be2351c5f90f4c41244b3e5875ced252731b2bc0c6e3f673094354754f47b77ef8340354a7e80dd82017d07342ae836ea530b7cd9ff7a33b1fb3c62a5
SSDEEP

768:/uDu9GYNdVIYKiZynNVMlxcwa4cFBMdzQj0ZiTcwwuUCYD:/uDtkXlDcwa4c0dopYD

Score

8^/10

discovery exploit persistence

Malware Config

Signatures

Possible privilege escalation attempt 2 IoCs
exploit

Processes:

takeown.exeicacls.exe

pid process

4744 takeown.exe
1716 icacls.exe
Modifies file permissions 1 TTPs 2 IoCs
discovery

File Permissions Modification
T1222

Processes:

icacls.exetakeown.exe

pid process

1716 icacls.exe
4744 takeown.exe

pid	process
4744	takeown.exe
1716	icacls.exe

pid	process
1716	icacls.exe
4744	takeown.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

88b2f85cdf9380a2bbfed6fb45bb0d9ef9dcfa1e68019a9e708a4b10aca165f3.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	88b2f85cdf9380a2bbfed6fb45bb0d9ef9dcfa1e68019a9e708a4b10aca165f3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vuzhs = "C:\\Windows\\system32\\sdwxo.exe"	88b2f85cdf9380a2bbfed6fb45bb0d9ef9dcfa1e68019a9e708a4b10aca165f3.exe

Drops file in System32 directory 2 IoCs

Processes:

88b2f85cdf9380a2bbfed6fb45bb0d9ef9dcfa1e68019a9e708a4b10aca165f3.exe

description	ioc	process
File created	C:\Windows\SysWOW64\sdwxo.exe	88b2f85cdf9380a2bbfed6fb45bb0d9ef9dcfa1e68019a9e708a4b10aca165f3.exe
File opened for modification	C:\Windows\SysWOW64\sdwxo.exe	88b2f85cdf9380a2bbfed6fb45bb0d9ef9dcfa1e68019a9e708a4b10aca165f3.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

88b2f85cdf9380a2bbfed6fb45bb0d9ef9dcfa1e68019a9e708a4b10aca165f3.exe

pid process

2336 88b2f85cdf9380a2bbfed6fb45bb0d9ef9dcfa1e68019a9e708a4b10aca165f3.exe

pid	process
2336	88b2f85cdf9380a2bbfed6fb45bb0d9ef9dcfa1e68019a9e708a4b10aca165f3.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

88b2f85cdf9380a2bbfed6fb45bb0d9ef9dcfa1e68019a9e708a4b10aca165f3.exe

description	pid	process	target process
PID 2336 wrote to memory of 4744	2336	88b2f85cdf9380a2bbfed6fb45bb0d9ef9dcfa1e68019a9e708a4b10aca165f3.exe	takeown.exe
PID 2336 wrote to memory of 4744	2336	88b2f85cdf9380a2bbfed6fb45bb0d9ef9dcfa1e68019a9e708a4b10aca165f3.exe	takeown.exe
PID 2336 wrote to memory of 4744	2336	88b2f85cdf9380a2bbfed6fb45bb0d9ef9dcfa1e68019a9e708a4b10aca165f3.exe	takeown.exe
PID 2336 wrote to memory of 1716	2336	88b2f85cdf9380a2bbfed6fb45bb0d9ef9dcfa1e68019a9e708a4b10aca165f3.exe	icacls.exe
PID 2336 wrote to memory of 1716	2336	88b2f85cdf9380a2bbfed6fb45bb0d9ef9dcfa1e68019a9e708a4b10aca165f3.exe	icacls.exe
PID 2336 wrote to memory of 1716	2336	88b2f85cdf9380a2bbfed6fb45bb0d9ef9dcfa1e68019a9e708a4b10aca165f3.exe	icacls.exe

C:\Users\Admin\AppData\Local\Temp\88b2f85cdf9380a2bbfed6fb45bb0d9ef9dcfa1e68019a9e708a4b10aca165f3.exe
"C:\Users\Admin\AppData\Local\Temp\88b2f85cdf9380a2bbfed6fb45bb0d9ef9dcfa1e68019a9e708a4b10aca165f3.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2336

C:\Windows\SysWOW64\takeown.exe
C:\Windows\system32\takeown.exe /f "C:\Windows\system32\sdwxo.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:4744

C:\Windows\SysWOW64\icacls.exe
C:\Windows\system32\icacls.exe "C:\Windows\system32\sdwxo.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1716

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

File Permissions Modification

T1222

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\sdwxo.exe
Filesize
40KB

MD5
0f76358e5c2bbf8c46c2559272b25ca6

SHA1
81e2f49d2a6c2e9f4b768bebb382e847f3069a74

SHA256
88b2f85cdf9380a2bbfed6fb45bb0d9ef9dcfa1e68019a9e708a4b10aca165f3

SHA512
64aec74be2351c5f90f4c41244b3e5875ced252731b2bc0c6e3f673094354754f47b77ef8340354a7e80dd82017d07342ae836ea530b7cd9ff7a33b1fb3c62a5

Download Submit
memory/1716-135-0x0000000000000000-mapping.dmp

Download
memory/4744-134-0x0000000000000000-mapping.dmp

Download