3b0ea7cfddf72045bb952a7991e817053f42bc6a93dc98d3a3b411a2ad109c10

Analysis

max time kernel
21s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07-11-2022 13:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3b0ea7cfddf72045bb952a7991e817053f42bc6a93dc98d3a3b411a2ad109c10.exe
Size

60KB
MD5

0680f7da6630e9e3927f2ab51cc86176
SHA1

e4b4b1c8ed1253c17a10760561cbf1d98249702f
SHA256

3b0ea7cfddf72045bb952a7991e817053f42bc6a93dc98d3a3b411a2ad109c10
SHA512

d8e814cbedb3b07c0c31dde09d196ee968abecd67545473e7d48dbdb8f0b5e033c3bbe6cac90bc7fde0657d77b413ff4674bfc8e8c7fd9d2d9da9c99778aba8c
SSDEEP

768:ZYIW166zXOxkJYnHVaSPKRpqRzKBAQs8NpvgEYZ0wzS3/AEZRR:ZYrN+xBgSGpqRzKuQsHjPzSIoRR

Score

8^/10

discovery exploit

Malware Config

Signatures

Possible privilege escalation attempt 2 IoCs
exploit

Processes:

icacls.exetakeown.exe

pid process

2036 icacls.exe
2044 takeown.exe
Modifies file permissions 1 TTPs 2 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exetakeown.exe

pid process

2036 icacls.exe
2044 takeown.exe

pid	process
2036	icacls.exe
2044	takeown.exe

pid	process
2036	icacls.exe
2044	takeown.exe

Drops file in System32 directory 2 IoCs

Processes:

3b0ea7cfddf72045bb952a7991e817053f42bc6a93dc98d3a3b411a2ad109c10.exe

description	ioc	process
File created	\??\c:\windows\SysWOW64\jupxz.exe	3b0ea7cfddf72045bb952a7991e817053f42bc6a93dc98d3a3b411a2ad109c10.exe
File opened for modification	\??\c:\windows\SysWOW64\jupxz.exe	3b0ea7cfddf72045bb952a7991e817053f42bc6a93dc98d3a3b411a2ad109c10.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

3b0ea7cfddf72045bb952a7991e817053f42bc6a93dc98d3a3b411a2ad109c10.exe

pid process

1520 3b0ea7cfddf72045bb952a7991e817053f42bc6a93dc98d3a3b411a2ad109c10.exe

pid	process
1520	3b0ea7cfddf72045bb952a7991e817053f42bc6a93dc98d3a3b411a2ad109c10.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

3b0ea7cfddf72045bb952a7991e817053f42bc6a93dc98d3a3b411a2ad109c10.exe

description	pid	process	target process
PID 1520 wrote to memory of 2044	1520	3b0ea7cfddf72045bb952a7991e817053f42bc6a93dc98d3a3b411a2ad109c10.exe	takeown.exe
PID 1520 wrote to memory of 2044	1520	3b0ea7cfddf72045bb952a7991e817053f42bc6a93dc98d3a3b411a2ad109c10.exe	takeown.exe
PID 1520 wrote to memory of 2044	1520	3b0ea7cfddf72045bb952a7991e817053f42bc6a93dc98d3a3b411a2ad109c10.exe	takeown.exe
PID 1520 wrote to memory of 2044	1520	3b0ea7cfddf72045bb952a7991e817053f42bc6a93dc98d3a3b411a2ad109c10.exe	takeown.exe
PID 1520 wrote to memory of 2036	1520	3b0ea7cfddf72045bb952a7991e817053f42bc6a93dc98d3a3b411a2ad109c10.exe	icacls.exe
PID 1520 wrote to memory of 2036	1520	3b0ea7cfddf72045bb952a7991e817053f42bc6a93dc98d3a3b411a2ad109c10.exe	icacls.exe
PID 1520 wrote to memory of 2036	1520	3b0ea7cfddf72045bb952a7991e817053f42bc6a93dc98d3a3b411a2ad109c10.exe	icacls.exe
PID 1520 wrote to memory of 2036	1520	3b0ea7cfddf72045bb952a7991e817053f42bc6a93dc98d3a3b411a2ad109c10.exe	icacls.exe

C:\Users\Admin\AppData\Local\Temp\3b0ea7cfddf72045bb952a7991e817053f42bc6a93dc98d3a3b411a2ad109c10.exe
"C:\Users\Admin\AppData\Local\Temp\3b0ea7cfddf72045bb952a7991e817053f42bc6a93dc98d3a3b411a2ad109c10.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1520

C:\Windows\SysWOW64\takeown.exe
C:\Windows\system32\takeown.exe /f "c:\windows\system32\jupxz.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:2044

C:\Windows\SysWOW64\icacls.exe
C:\Windows\system32\icacls.exe "c:\windows\system32\jupxz.exe" /grant SYSTEM:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:2036

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\??\c:\windows\SysWOW64\jupxz.exe
Filesize
60KB

MD5
0680f7da6630e9e3927f2ab51cc86176

SHA1
e4b4b1c8ed1253c17a10760561cbf1d98249702f

SHA256
3b0ea7cfddf72045bb952a7991e817053f42bc6a93dc98d3a3b411a2ad109c10

SHA512
d8e814cbedb3b07c0c31dde09d196ee968abecd67545473e7d48dbdb8f0b5e033c3bbe6cac90bc7fde0657d77b413ff4674bfc8e8c7fd9d2d9da9c99778aba8c

Download Submit
memory/2036-57-0x0000000000000000-mapping.dmp

Download
memory/2044-56-0x0000000000000000-mapping.dmp

Download