68a1e51af03c1bf76aa2d388249819f3b5c519dcc6c9eefeaec85af16d15cfbf

Analysis

max time kernel
46s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
07-11-2022 12:36

Target

68a1e51af03c1bf76aa2d388249819f3b5c519dcc6c9eefeaec85af16d15cfbf.exe
Size

68KB
MD5

0c5b142e4185e130b90411ec1392b0a1
SHA1

11880fc4b89758d1a98e74945ae3db3fbd71a01d
SHA256

68a1e51af03c1bf76aa2d388249819f3b5c519dcc6c9eefeaec85af16d15cfbf
SHA512

4a7dc982fb28f8cf404f31243a8d6c99da5273a51583ca67506dd845ee086efc0b2d6008c3825d5110def099ece35e1c0479f343171fa1d5cbf9e40ccf5c2ae9
SSDEEP

768:4DJXk7lSA2SoPfT3Dw8qLsytLA575ztRIvzeSJQJIWtEZVn1mZbvH1ogHlhcWSQI:4CgOs0cbCe3RS18lhco/Q

Score

8^/10

discovery exploit

Possible privilege escalation attempt 2 IoCs
exploit

Processes:

takeown.exeicacls.exe

pid process

1180 takeown.exe
2028 icacls.exe
Modifies file permissions 1 TTPs 2 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

takeown.exeicacls.exe

pid process

1180 takeown.exe
2028 icacls.exe

pid	process
1180	takeown.exe
2028	icacls.exe

pid	process
1180	takeown.exe
2028	icacls.exe

Drops file in System32 directory 2 IoCs

Processes:

68a1e51af03c1bf76aa2d388249819f3b5c519dcc6c9eefeaec85af16d15cfbf.exe

description	ioc	process
File created	C:\Windows\SysWOW64\dzlh.exe	68a1e51af03c1bf76aa2d388249819f3b5c519dcc6c9eefeaec85af16d15cfbf.exe
File opened for modification	C:\Windows\SysWOW64\dzlh.exe	68a1e51af03c1bf76aa2d388249819f3b5c519dcc6c9eefeaec85af16d15cfbf.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

68a1e51af03c1bf76aa2d388249819f3b5c519dcc6c9eefeaec85af16d15cfbf.exe

pid process

1416 68a1e51af03c1bf76aa2d388249819f3b5c519dcc6c9eefeaec85af16d15cfbf.exe

pid	process
1416	68a1e51af03c1bf76aa2d388249819f3b5c519dcc6c9eefeaec85af16d15cfbf.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

68a1e51af03c1bf76aa2d388249819f3b5c519dcc6c9eefeaec85af16d15cfbf.exe

description	pid	process	target process
PID 1416 wrote to memory of 1180	1416	68a1e51af03c1bf76aa2d388249819f3b5c519dcc6c9eefeaec85af16d15cfbf.exe	takeown.exe
PID 1416 wrote to memory of 1180	1416	68a1e51af03c1bf76aa2d388249819f3b5c519dcc6c9eefeaec85af16d15cfbf.exe	takeown.exe
PID 1416 wrote to memory of 1180	1416	68a1e51af03c1bf76aa2d388249819f3b5c519dcc6c9eefeaec85af16d15cfbf.exe	takeown.exe
PID 1416 wrote to memory of 1180	1416	68a1e51af03c1bf76aa2d388249819f3b5c519dcc6c9eefeaec85af16d15cfbf.exe	takeown.exe
PID 1416 wrote to memory of 2028	1416	68a1e51af03c1bf76aa2d388249819f3b5c519dcc6c9eefeaec85af16d15cfbf.exe	icacls.exe
PID 1416 wrote to memory of 2028	1416	68a1e51af03c1bf76aa2d388249819f3b5c519dcc6c9eefeaec85af16d15cfbf.exe	icacls.exe
PID 1416 wrote to memory of 2028	1416	68a1e51af03c1bf76aa2d388249819f3b5c519dcc6c9eefeaec85af16d15cfbf.exe	icacls.exe
PID 1416 wrote to memory of 2028	1416	68a1e51af03c1bf76aa2d388249819f3b5c519dcc6c9eefeaec85af16d15cfbf.exe	icacls.exe

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Windows\SysWOW64\dzlh.exe

Filesize
68KB

MD5
0c5b142e4185e130b90411ec1392b0a1

SHA1
11880fc4b89758d1a98e74945ae3db3fbd71a01d

SHA256
68a1e51af03c1bf76aa2d388249819f3b5c519dcc6c9eefeaec85af16d15cfbf

SHA512
4a7dc982fb28f8cf404f31243a8d6c99da5273a51583ca67506dd845ee086efc0b2d6008c3825d5110def099ece35e1c0479f343171fa1d5cbf9e40ccf5c2ae9

Download Submit
memory/1180-57-0x0000000000000000-mapping.dmp

Download
memory/1416-56-0x0000000074DC1000-0x0000000074DC3000-memory.dmp

Filesize
8KB

Download
memory/2028-59-0x0000000000000000-mapping.dmp

Download