985f5eafb6a8a188adb1f5969f410aafbc1853a16ee5e182bc14fbebe18025aa

Analysis

max time kernel
31s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07-11-2022 11:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

985f5eafb6a8a188adb1f5969f410aafbc1853a16ee5e182bc14fbebe18025aa.exe
Size

68KB
MD5

072fe3db05d9d49802ecdd5e1233fe86
SHA1

696c07ad40f8a5cee2a5de15393689b489be6ae8
SHA256

985f5eafb6a8a188adb1f5969f410aafbc1853a16ee5e182bc14fbebe18025aa
SHA512

a0ce0013c13cfdebf0cda24297291656c71fe933c8f50b7d07ace13883bba84906be2a6097011518dfb97bb6e9b55eff02eecaab4c29b01dfc3ccf2d14cf8e5c
SSDEEP

1536:CU1/lCNT4B7U44KtNQ+FY6eABkA4X0g4RLSl:CMlVBU6tNQwh14H9l

Score

8^/10

discovery exploit

Malware Config

Signatures

Possible privilege escalation attempt 2 IoCs
exploit

Processes:

takeown.exeicacls.exe

pid process

672 takeown.exe
240 icacls.exe
Modifies file permissions 1 TTPs 2 IoCs
discovery

File Permissions Modification
T1222

Processes:

takeown.exeicacls.exe

pid process

672 takeown.exe
240 icacls.exe

pid	process
672	takeown.exe
240	icacls.exe

pid	process
672	takeown.exe
240	icacls.exe

Drops file in System32 directory 2 IoCs

Processes:

985f5eafb6a8a188adb1f5969f410aafbc1853a16ee5e182bc14fbebe18025aa.exe

description	ioc	process
File created	C:\Windows\SysWOW64\zdmyh.exe	985f5eafb6a8a188adb1f5969f410aafbc1853a16ee5e182bc14fbebe18025aa.exe
File opened for modification	C:\Windows\SysWOW64\zdmyh.exe	985f5eafb6a8a188adb1f5969f410aafbc1853a16ee5e182bc14fbebe18025aa.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

985f5eafb6a8a188adb1f5969f410aafbc1853a16ee5e182bc14fbebe18025aa.exe

pid process

1348 985f5eafb6a8a188adb1f5969f410aafbc1853a16ee5e182bc14fbebe18025aa.exe

pid	process
1348	985f5eafb6a8a188adb1f5969f410aafbc1853a16ee5e182bc14fbebe18025aa.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

985f5eafb6a8a188adb1f5969f410aafbc1853a16ee5e182bc14fbebe18025aa.exe

description	pid	process	target process
PID 1348 wrote to memory of 672	1348	985f5eafb6a8a188adb1f5969f410aafbc1853a16ee5e182bc14fbebe18025aa.exe	takeown.exe
PID 1348 wrote to memory of 672	1348	985f5eafb6a8a188adb1f5969f410aafbc1853a16ee5e182bc14fbebe18025aa.exe	takeown.exe
PID 1348 wrote to memory of 672	1348	985f5eafb6a8a188adb1f5969f410aafbc1853a16ee5e182bc14fbebe18025aa.exe	takeown.exe
PID 1348 wrote to memory of 672	1348	985f5eafb6a8a188adb1f5969f410aafbc1853a16ee5e182bc14fbebe18025aa.exe	takeown.exe
PID 1348 wrote to memory of 240	1348	985f5eafb6a8a188adb1f5969f410aafbc1853a16ee5e182bc14fbebe18025aa.exe	icacls.exe
PID 1348 wrote to memory of 240	1348	985f5eafb6a8a188adb1f5969f410aafbc1853a16ee5e182bc14fbebe18025aa.exe	icacls.exe
PID 1348 wrote to memory of 240	1348	985f5eafb6a8a188adb1f5969f410aafbc1853a16ee5e182bc14fbebe18025aa.exe	icacls.exe
PID 1348 wrote to memory of 240	1348	985f5eafb6a8a188adb1f5969f410aafbc1853a16ee5e182bc14fbebe18025aa.exe	icacls.exe

C:\Users\Admin\AppData\Local\Temp\985f5eafb6a8a188adb1f5969f410aafbc1853a16ee5e182bc14fbebe18025aa.exe
"C:\Users\Admin\AppData\Local\Temp\985f5eafb6a8a188adb1f5969f410aafbc1853a16ee5e182bc14fbebe18025aa.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1348

C:\Windows\SysWOW64\takeown.exe
C:\Windows\system32\takeown.exe /f "C:\Windows\system32\zdmyh.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:672

C:\Windows\SysWOW64\icacls.exe
C:\Windows\system32\icacls.exe "C:\Windows\system32\zdmyh.exe" /grant SYSTEM:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:240

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\zdmyh.exe
Filesize
68KB

MD5
072fe3db05d9d49802ecdd5e1233fe86

SHA1
696c07ad40f8a5cee2a5de15393689b489be6ae8

SHA256
985f5eafb6a8a188adb1f5969f410aafbc1853a16ee5e182bc14fbebe18025aa

SHA512
a0ce0013c13cfdebf0cda24297291656c71fe933c8f50b7d07ace13883bba84906be2a6097011518dfb97bb6e9b55eff02eecaab4c29b01dfc3ccf2d14cf8e5c

Download Submit
memory/240-59-0x0000000000000000-mapping.dmp

Download
memory/672-57-0x0000000000000000-mapping.dmp

Download
memory/1348-56-0x0000000074F41000-0x0000000074F43000-memory.dmp

Filesize
8KB

Download