3b0ea7cfddf72045bb952a7991e817053f42bc6a93dc98d3a3b411a2ad109c10

General

Target

3b0ea7cfddf72045bb952a7991e817053f42bc6a93dc98d3a3b411a2ad109c10.exe
Size

60KB
MD5

0680f7da6630e9e3927f2ab51cc86176
SHA1

e4b4b1c8ed1253c17a10760561cbf1d98249702f
SHA256

3b0ea7cfddf72045bb952a7991e817053f42bc6a93dc98d3a3b411a2ad109c10
SHA512

d8e814cbedb3b07c0c31dde09d196ee968abecd67545473e7d48dbdb8f0b5e033c3bbe6cac90bc7fde0657d77b413ff4674bfc8e8c7fd9d2d9da9c99778aba8c
SSDEEP

768:ZYIW166zXOxkJYnHVaSPKRpqRzKBAQs8NpvgEYZ0wzS3/AEZRR:ZYrN+xBgSGpqRzKuQsHjPzSIoRR

Score

8^/10

discovery exploit

Malware Config

Signatures

Possible privilege escalation attempt 14 IoCs

exploit

Processes:

icacls.exetakeown.exetakeown.exeicacls.exetakeown.exetakeown.exeicacls.exetakeown.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exe

pid	process
2176	icacls.exe
3888	takeown.exe
2112	takeown.exe
3088	icacls.exe
3632	takeown.exe
1956	takeown.exe
2336	icacls.exe
2224	takeown.exe
2584	icacls.exe
2924	icacls.exe
3644	icacls.exe
3952	icacls.exe
2732	icacls.exe
2976	icacls.exe

Modifies file permissions 1 TTPs 14 IoCs

discovery

File and Directory Permissions Modification

T1222

Processes:

takeown.exetakeown.exeicacls.exeicacls.exeicacls.exetakeown.exetakeown.exeicacls.exeicacls.exeicacls.exeicacls.exetakeown.exeicacls.exeicacls.exe

pid	process
3632	takeown.exe
2224	takeown.exe
3644	icacls.exe
3952	icacls.exe
2732	icacls.exe
3888	takeown.exe
2112	takeown.exe
2336	icacls.exe
2176	icacls.exe
2976	icacls.exe
2924	icacls.exe
1956	takeown.exe
3088	icacls.exe
2584	icacls.exe

Drops file in System32 directory 6 IoCs

Processes:

3b0ea7cfddf72045bb952a7991e817053f42bc6a93dc98d3a3b411a2ad109c10.exe

description	ioc	process
File created	\??\c:\windows\SysWOW64\jupxz.exe	3b0ea7cfddf72045bb952a7991e817053f42bc6a93dc98d3a3b411a2ad109c10.exe
File opened for modification	\??\c:\windows\SysWOW64\jupxz.exe	3b0ea7cfddf72045bb952a7991e817053f42bc6a93dc98d3a3b411a2ad109c10.exe
File opened for modification	C:\Windows\SysWOW64\cmd.exe	3b0ea7cfddf72045bb952a7991e817053f42bc6a93dc98d3a3b411a2ad109c10.exe
File opened for modification	C:\Windows\SysWOW64\ftp.exe	3b0ea7cfddf72045bb952a7991e817053f42bc6a93dc98d3a3b411a2ad109c10.exe
File opened for modification	C:\Windows\SysWOW64\wscript.exe	3b0ea7cfddf72045bb952a7991e817053f42bc6a93dc98d3a3b411a2ad109c10.exe
File opened for modification	C:\Windows\SysWOW64\cscript.exe	3b0ea7cfddf72045bb952a7991e817053f42bc6a93dc98d3a3b411a2ad109c10.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

takeown.exetakeown.exetakeown.exetakeown.exe

description	pid	process
Token: SeTakeOwnershipPrivilege	2112	takeown.exe
Token: SeTakeOwnershipPrivilege	3632	takeown.exe
Token: SeTakeOwnershipPrivilege	2224	takeown.exe
Token: SeTakeOwnershipPrivilege	3888	takeown.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

3b0ea7cfddf72045bb952a7991e817053f42bc6a93dc98d3a3b411a2ad109c10.exe

pid process

5004 3b0ea7cfddf72045bb952a7991e817053f42bc6a93dc98d3a3b411a2ad109c10.exe

pid	process
5004	3b0ea7cfddf72045bb952a7991e817053f42bc6a93dc98d3a3b411a2ad109c10.exe

Suspicious use of WriteProcessMemory 42 IoCs

Processes:

3b0ea7cfddf72045bb952a7991e817053f42bc6a93dc98d3a3b411a2ad109c10.exe

description	pid	process	target process
PID 5004 wrote to memory of 1956	5004	3b0ea7cfddf72045bb952a7991e817053f42bc6a93dc98d3a3b411a2ad109c10.exe	takeown.exe
PID 5004 wrote to memory of 1956	5004	3b0ea7cfddf72045bb952a7991e817053f42bc6a93dc98d3a3b411a2ad109c10.exe	takeown.exe
PID 5004 wrote to memory of 1956	5004	3b0ea7cfddf72045bb952a7991e817053f42bc6a93dc98d3a3b411a2ad109c10.exe	takeown.exe
PID 5004 wrote to memory of 3952	5004	3b0ea7cfddf72045bb952a7991e817053f42bc6a93dc98d3a3b411a2ad109c10.exe	icacls.exe
PID 5004 wrote to memory of 3952	5004	3b0ea7cfddf72045bb952a7991e817053f42bc6a93dc98d3a3b411a2ad109c10.exe	icacls.exe
PID 5004 wrote to memory of 3952	5004	3b0ea7cfddf72045bb952a7991e817053f42bc6a93dc98d3a3b411a2ad109c10.exe	icacls.exe
PID 5004 wrote to memory of 2112	5004	3b0ea7cfddf72045bb952a7991e817053f42bc6a93dc98d3a3b411a2ad109c10.exe	takeown.exe
PID 5004 wrote to memory of 2112	5004	3b0ea7cfddf72045bb952a7991e817053f42bc6a93dc98d3a3b411a2ad109c10.exe	takeown.exe
PID 5004 wrote to memory of 2112	5004	3b0ea7cfddf72045bb952a7991e817053f42bc6a93dc98d3a3b411a2ad109c10.exe	takeown.exe
PID 5004 wrote to memory of 2732	5004	3b0ea7cfddf72045bb952a7991e817053f42bc6a93dc98d3a3b411a2ad109c10.exe	icacls.exe
PID 5004 wrote to memory of 2732	5004	3b0ea7cfddf72045bb952a7991e817053f42bc6a93dc98d3a3b411a2ad109c10.exe	icacls.exe
PID 5004 wrote to memory of 2732	5004	3b0ea7cfddf72045bb952a7991e817053f42bc6a93dc98d3a3b411a2ad109c10.exe	icacls.exe
PID 5004 wrote to memory of 3088	5004	3b0ea7cfddf72045bb952a7991e817053f42bc6a93dc98d3a3b411a2ad109c10.exe	icacls.exe
PID 5004 wrote to memory of 3088	5004	3b0ea7cfddf72045bb952a7991e817053f42bc6a93dc98d3a3b411a2ad109c10.exe	icacls.exe
PID 5004 wrote to memory of 3088	5004	3b0ea7cfddf72045bb952a7991e817053f42bc6a93dc98d3a3b411a2ad109c10.exe	icacls.exe
PID 5004 wrote to memory of 3632	5004	3b0ea7cfddf72045bb952a7991e817053f42bc6a93dc98d3a3b411a2ad109c10.exe	takeown.exe
PID 5004 wrote to memory of 3632	5004	3b0ea7cfddf72045bb952a7991e817053f42bc6a93dc98d3a3b411a2ad109c10.exe	takeown.exe
PID 5004 wrote to memory of 3632	5004	3b0ea7cfddf72045bb952a7991e817053f42bc6a93dc98d3a3b411a2ad109c10.exe	takeown.exe
PID 5004 wrote to memory of 2176	5004	3b0ea7cfddf72045bb952a7991e817053f42bc6a93dc98d3a3b411a2ad109c10.exe	icacls.exe
PID 5004 wrote to memory of 2176	5004	3b0ea7cfddf72045bb952a7991e817053f42bc6a93dc98d3a3b411a2ad109c10.exe	icacls.exe
PID 5004 wrote to memory of 2176	5004	3b0ea7cfddf72045bb952a7991e817053f42bc6a93dc98d3a3b411a2ad109c10.exe	icacls.exe
PID 5004 wrote to memory of 2336	5004	3b0ea7cfddf72045bb952a7991e817053f42bc6a93dc98d3a3b411a2ad109c10.exe	icacls.exe
PID 5004 wrote to memory of 2336	5004	3b0ea7cfddf72045bb952a7991e817053f42bc6a93dc98d3a3b411a2ad109c10.exe	icacls.exe
PID 5004 wrote to memory of 2336	5004	3b0ea7cfddf72045bb952a7991e817053f42bc6a93dc98d3a3b411a2ad109c10.exe	icacls.exe
PID 5004 wrote to memory of 2224	5004	3b0ea7cfddf72045bb952a7991e817053f42bc6a93dc98d3a3b411a2ad109c10.exe	takeown.exe
PID 5004 wrote to memory of 2224	5004	3b0ea7cfddf72045bb952a7991e817053f42bc6a93dc98d3a3b411a2ad109c10.exe	takeown.exe
PID 5004 wrote to memory of 2224	5004	3b0ea7cfddf72045bb952a7991e817053f42bc6a93dc98d3a3b411a2ad109c10.exe	takeown.exe
PID 5004 wrote to memory of 2584	5004	3b0ea7cfddf72045bb952a7991e817053f42bc6a93dc98d3a3b411a2ad109c10.exe	icacls.exe
PID 5004 wrote to memory of 2584	5004	3b0ea7cfddf72045bb952a7991e817053f42bc6a93dc98d3a3b411a2ad109c10.exe	icacls.exe
PID 5004 wrote to memory of 2584	5004	3b0ea7cfddf72045bb952a7991e817053f42bc6a93dc98d3a3b411a2ad109c10.exe	icacls.exe
PID 5004 wrote to memory of 2976	5004	3b0ea7cfddf72045bb952a7991e817053f42bc6a93dc98d3a3b411a2ad109c10.exe	icacls.exe
PID 5004 wrote to memory of 2976	5004	3b0ea7cfddf72045bb952a7991e817053f42bc6a93dc98d3a3b411a2ad109c10.exe	icacls.exe
PID 5004 wrote to memory of 2976	5004	3b0ea7cfddf72045bb952a7991e817053f42bc6a93dc98d3a3b411a2ad109c10.exe	icacls.exe
PID 5004 wrote to memory of 3888	5004	3b0ea7cfddf72045bb952a7991e817053f42bc6a93dc98d3a3b411a2ad109c10.exe	takeown.exe
PID 5004 wrote to memory of 3888	5004	3b0ea7cfddf72045bb952a7991e817053f42bc6a93dc98d3a3b411a2ad109c10.exe	takeown.exe
PID 5004 wrote to memory of 3888	5004	3b0ea7cfddf72045bb952a7991e817053f42bc6a93dc98d3a3b411a2ad109c10.exe	takeown.exe
PID 5004 wrote to memory of 3644	5004	3b0ea7cfddf72045bb952a7991e817053f42bc6a93dc98d3a3b411a2ad109c10.exe	icacls.exe
PID 5004 wrote to memory of 3644	5004	3b0ea7cfddf72045bb952a7991e817053f42bc6a93dc98d3a3b411a2ad109c10.exe	icacls.exe
PID 5004 wrote to memory of 3644	5004	3b0ea7cfddf72045bb952a7991e817053f42bc6a93dc98d3a3b411a2ad109c10.exe	icacls.exe
PID 5004 wrote to memory of 2924	5004	3b0ea7cfddf72045bb952a7991e817053f42bc6a93dc98d3a3b411a2ad109c10.exe	icacls.exe
PID 5004 wrote to memory of 2924	5004	3b0ea7cfddf72045bb952a7991e817053f42bc6a93dc98d3a3b411a2ad109c10.exe	icacls.exe
PID 5004 wrote to memory of 2924	5004	3b0ea7cfddf72045bb952a7991e817053f42bc6a93dc98d3a3b411a2ad109c10.exe	icacls.exe

C:\Users\Admin\AppData\Local\Temp\3b0ea7cfddf72045bb952a7991e817053f42bc6a93dc98d3a3b411a2ad109c10.exe
"C:\Users\Admin\AppData\Local\Temp\3b0ea7cfddf72045bb952a7991e817053f42bc6a93dc98d3a3b411a2ad109c10.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5004

C:\Windows\SysWOW64\takeown.exe
C:\Windows\system32\takeown.exe /f "c:\windows\system32\jupxz.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1956

C:\Windows\SysWOW64\icacls.exe
C:\Windows\system32\icacls.exe "c:\windows\system32\jupxz.exe" /grant SYSTEM:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:3952

C:\Windows\SysWOW64\takeown.exe
C:\Windows\system32\takeown.exe /f "C:\Windows\System32\cmd.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:2112

C:\Windows\SysWOW64\icacls.exe
C:\Windows\system32\icacls.exe "C:\Windows\System32\cmd.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:3088

C:\Windows\SysWOW64\icacls.exe
C:\Windows\system32\icacls.exe "C:\Windows\System32\cmd.exe" /grant SYSTEM:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:2732

C:\Windows\SysWOW64\takeown.exe
C:\Windows\system32\takeown.exe /f "C:\Windows\System32\ftp.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:3632

C:\Windows\SysWOW64\icacls.exe
C:\Windows\system32\icacls.exe "C:\Windows\System32\ftp.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:2336

C:\Windows\SysWOW64\icacls.exe
C:\Windows\system32\icacls.exe "C:\Windows\System32\ftp.exe" /grant SYSTEM:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:2176

C:\Windows\SysWOW64\takeown.exe
C:\Windows\system32\takeown.exe /f "C:\Windows\System32\wscript.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:2224

C:\Windows\SysWOW64\icacls.exe
C:\Windows\system32\icacls.exe "C:\Windows\System32\wscript.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:2976

C:\Windows\SysWOW64\icacls.exe
C:\Windows\system32\icacls.exe "C:\Windows\System32\wscript.exe" /grant SYSTEM:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:2584

C:\Windows\SysWOW64\takeown.exe
C:\Windows\system32\takeown.exe /f "C:\Windows\System32\cscript.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:3888

C:\Windows\SysWOW64\icacls.exe
C:\Windows\system32\icacls.exe "C:\Windows\System32\cscript.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:2924

C:\Windows\SysWOW64\icacls.exe
C:\Windows\system32\icacls.exe "C:\Windows\System32\cscript.exe" /grant SYSTEM:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:3644

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

1

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\??\c:\windows\SysWOW64\jupxz.exe
Filesize
60KB

MD5
0680f7da6630e9e3927f2ab51cc86176

SHA1
e4b4b1c8ed1253c17a10760561cbf1d98249702f

SHA256
3b0ea7cfddf72045bb952a7991e817053f42bc6a93dc98d3a3b411a2ad109c10

SHA512
d8e814cbedb3b07c0c31dde09d196ee968abecd67545473e7d48dbdb8f0b5e033c3bbe6cac90bc7fde0657d77b413ff4674bfc8e8c7fd9d2d9da9c99778aba8c

Download Submit
memory/1956-134-0x0000000000000000-mapping.dmp

Download
memory/2112-137-0x0000000000000000-mapping.dmp

Download
memory/2176-141-0x0000000000000000-mapping.dmp

Download
memory/2224-143-0x0000000000000000-mapping.dmp

Download
memory/2336-142-0x0000000000000000-mapping.dmp

Download
memory/2584-144-0x0000000000000000-mapping.dmp

Download
memory/2732-138-0x0000000000000000-mapping.dmp

Download
memory/2924-148-0x0000000000000000-mapping.dmp

Download
memory/2976-145-0x0000000000000000-mapping.dmp

Download
memory/3088-139-0x0000000000000000-mapping.dmp

Download
memory/3632-140-0x0000000000000000-mapping.dmp

Download
memory/3644-147-0x0000000000000000-mapping.dmp

Download
memory/3888-146-0x0000000000000000-mapping.dmp

Download
memory/3952-135-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads