116a97b9f284905d011919d518f263d89550c257928044bda038f62f3965c2a7

General

Target

116a97b9f284905d011919d518f263d89550c257928044bda038f62f3965c2a7.exe
Size

31KB
MD5

05040dfe39ea468ef525df6c52c58e80
SHA1

f5dc32557c5c45e6bd66fb18d57e164f968908dc
SHA256

116a97b9f284905d011919d518f263d89550c257928044bda038f62f3965c2a7
SHA512

2c8d1db55689eb0e63dcc6c9d4e75df26644607bb5029d123afdbfb48ec1d34cc21ad40fcd43a52540fbff033f5e5037ea328a7025dff981ebd0880e4152b362
SSDEEP

768:tqku0P5K8KZLnR3JQCxNiwDaVQr1rDnpIOw3VzaM9o:tqku0P5zqTzrx0wGVQr1/Pwlz

Score

8^/10

discovery exploit

Malware Config

Signatures

Possible privilege escalation attempt 4 IoCs
exploit

Processes:

takeown.exeicacls.exetakeown.exeicacls.exe

pid process

4124 takeown.exe
2220 icacls.exe
428 takeown.exe
3612 icacls.exe
Modifies file permissions 1 TTPs 4 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

takeown.exeicacls.exetakeown.exeicacls.exe

pid process

4124 takeown.exe
2220 icacls.exe
428 takeown.exe
3612 icacls.exe

pid	process
4124	takeown.exe
2220	icacls.exe
428	takeown.exe
3612	icacls.exe

pid	process
4124	takeown.exe
2220	icacls.exe
428	takeown.exe
3612	icacls.exe

Drops file in System32 directory 5 IoCs

Processes:

116a97b9f284905d011919d518f263d89550c257928044bda038f62f3965c2a7.exe

description	ioc	process
File created	C:\Windows\SysWOW64\sxload.tmp	116a97b9f284905d011919d518f263d89550c257928044bda038f62f3965c2a7.exe
File opened for modification	C:\Windows\SysWOW64\123AE37.tmp	116a97b9f284905d011919d518f263d89550c257928044bda038f62f3965c2a7.exe
File created	C:\Windows\SysWOW64\dllcache\rasadhlp.dll	116a97b9f284905d011919d518f263d89550c257928044bda038f62f3965c2a7.exe
File opened for modification	C:\Windows\SysWOW64\123D047.tmp	116a97b9f284905d011919d518f263d89550c257928044bda038f62f3965c2a7.exe
File created	C:\Windows\SysWOW64\dllcache\midimap.dll	116a97b9f284905d011919d518f263d89550c257928044bda038f62f3965c2a7.exe

Drops file in Program Files directory 1 IoCs

Processes:

116a97b9f284905d011919d518f263d89550c257928044bda038f62f3965c2a7.exe

description ioc process

File created C:\Program Files (x86)\Common Files\sxlzg.tmp 116a97b9f284905d011919d518f263d89550c257928044bda038f62f3965c2a7.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Kills process with taskkill 2 IoCs
evasion

Processes:

taskkill.exetaskkill.exe

pid process

1892 taskkill.exe
3092 taskkill.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\sxlzg.tmp	116a97b9f284905d011919d518f263d89550c257928044bda038f62f3965c2a7.exe

pid	process
1892	taskkill.exe
3092	taskkill.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

116a97b9f284905d011919d518f263d89550c257928044bda038f62f3965c2a7.exetakeown.exetakeown.exetaskkill.exetaskkill.exe

description	pid	process
Token: SeDebugPrivilege	5044	116a97b9f284905d011919d518f263d89550c257928044bda038f62f3965c2a7.exe
Token: SeTakeOwnershipPrivilege	4124	takeown.exe
Token: SeTakeOwnershipPrivilege	428	takeown.exe
Token: SeDebugPrivilege	1892	taskkill.exe
Token: SeDebugPrivilege	3092	taskkill.exe

Suspicious use of FindShellTrayWindow 8 IoCs

Processes:

116a97b9f284905d011919d518f263d89550c257928044bda038f62f3965c2a7.exe

pid	process
5044	116a97b9f284905d011919d518f263d89550c257928044bda038f62f3965c2a7.exe
5044	116a97b9f284905d011919d518f263d89550c257928044bda038f62f3965c2a7.exe
5044	116a97b9f284905d011919d518f263d89550c257928044bda038f62f3965c2a7.exe
5044	116a97b9f284905d011919d518f263d89550c257928044bda038f62f3965c2a7.exe
5044	116a97b9f284905d011919d518f263d89550c257928044bda038f62f3965c2a7.exe
5044	116a97b9f284905d011919d518f263d89550c257928044bda038f62f3965c2a7.exe
5044	116a97b9f284905d011919d518f263d89550c257928044bda038f62f3965c2a7.exe
5044	116a97b9f284905d011919d518f263d89550c257928044bda038f62f3965c2a7.exe

Suspicious use of WriteProcessMemory 27 IoCs

Processes:

116a97b9f284905d011919d518f263d89550c257928044bda038f62f3965c2a7.execmd.execmd.exe

description	pid	process	target process
PID 5044 wrote to memory of 4664	5044	116a97b9f284905d011919d518f263d89550c257928044bda038f62f3965c2a7.exe	cmd.exe
PID 5044 wrote to memory of 4664	5044	116a97b9f284905d011919d518f263d89550c257928044bda038f62f3965c2a7.exe	cmd.exe
PID 5044 wrote to memory of 4664	5044	116a97b9f284905d011919d518f263d89550c257928044bda038f62f3965c2a7.exe	cmd.exe
PID 4664 wrote to memory of 4124	4664	cmd.exe	takeown.exe
PID 4664 wrote to memory of 4124	4664	cmd.exe	takeown.exe
PID 4664 wrote to memory of 4124	4664	cmd.exe	takeown.exe
PID 4664 wrote to memory of 2220	4664	cmd.exe	icacls.exe
PID 4664 wrote to memory of 2220	4664	cmd.exe	icacls.exe
PID 4664 wrote to memory of 2220	4664	cmd.exe	icacls.exe
PID 5044 wrote to memory of 5052	5044	116a97b9f284905d011919d518f263d89550c257928044bda038f62f3965c2a7.exe	cmd.exe
PID 5044 wrote to memory of 5052	5044	116a97b9f284905d011919d518f263d89550c257928044bda038f62f3965c2a7.exe	cmd.exe
PID 5044 wrote to memory of 5052	5044	116a97b9f284905d011919d518f263d89550c257928044bda038f62f3965c2a7.exe	cmd.exe
PID 5052 wrote to memory of 428	5052	cmd.exe	takeown.exe
PID 5052 wrote to memory of 428	5052	cmd.exe	takeown.exe
PID 5052 wrote to memory of 428	5052	cmd.exe	takeown.exe
PID 5052 wrote to memory of 3612	5052	cmd.exe	icacls.exe
PID 5052 wrote to memory of 3612	5052	cmd.exe	icacls.exe
PID 5052 wrote to memory of 3612	5052	cmd.exe	icacls.exe
PID 5044 wrote to memory of 1892	5044	116a97b9f284905d011919d518f263d89550c257928044bda038f62f3965c2a7.exe	taskkill.exe
PID 5044 wrote to memory of 1892	5044	116a97b9f284905d011919d518f263d89550c257928044bda038f62f3965c2a7.exe	taskkill.exe
PID 5044 wrote to memory of 1892	5044	116a97b9f284905d011919d518f263d89550c257928044bda038f62f3965c2a7.exe	taskkill.exe
PID 5044 wrote to memory of 3092	5044	116a97b9f284905d011919d518f263d89550c257928044bda038f62f3965c2a7.exe	taskkill.exe
PID 5044 wrote to memory of 3092	5044	116a97b9f284905d011919d518f263d89550c257928044bda038f62f3965c2a7.exe	taskkill.exe
PID 5044 wrote to memory of 3092	5044	116a97b9f284905d011919d518f263d89550c257928044bda038f62f3965c2a7.exe	taskkill.exe
PID 5044 wrote to memory of 4168	5044	116a97b9f284905d011919d518f263d89550c257928044bda038f62f3965c2a7.exe	cmd.exe
PID 5044 wrote to memory of 4168	5044	116a97b9f284905d011919d518f263d89550c257928044bda038f62f3965c2a7.exe	cmd.exe
PID 5044 wrote to memory of 4168	5044	116a97b9f284905d011919d518f263d89550c257928044bda038f62f3965c2a7.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\116a97b9f284905d011919d518f263d89550c257928044bda038f62f3965c2a7.exe
"C:\Users\Admin\AppData\Local\Temp\116a97b9f284905d011919d518f263d89550c257928044bda038f62f3965c2a7.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5044
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c takeown /f "C:\Windows\system32\rasadhlp.dll" && icacls "C:\Windows\system32\rasadhlp.dll" /grant administrators:F
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4664
- - C:\Windows\SysWOW64\takeown.exe
    takeown /f "C:\Windows\system32\rasadhlp.dll"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:4124
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Windows\system32\rasadhlp.dll" /grant administrators:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2220
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c takeown /f "C:\Windows\system32\midimap.dll" && icacls "C:\Windows\system32\midimap.dll" /grant administrators:F
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5052
- - C:\Windows\SysWOW64\takeown.exe
    takeown /f "C:\Windows\system32\midimap.dll"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:428
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Windows\system32\midimap.dll" /grant administrators:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:3612
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im "DragonNest.exe"
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1892
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im "sdologin.exe"
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3092
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c 1.bat
  2⤵
  PID:4168

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

1

T1222

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1.bat

Filesize
251B

MD5
195e41626b00cdde54fc9b9eb8f02e49

SHA1
ea99a6ea3a1ddf5e3519fb7f020351462d26121a

SHA256
b555da6bfba1be58b55b8a2ee413f27a51b829bae7efbe43ab06b3322fc00e72

SHA512
1acdce028dc6a5f8eecfd4925992b18b7a5080f54480160b153c48fe5633c440db3f44e23813b7786c40072556110189f2550940f4d2ec35bd917254e7092f91

Download Submit
memory/428-136-0x0000000000000000-mapping.dmp

Download
memory/1892-138-0x0000000000000000-mapping.dmp

Download
memory/2220-134-0x0000000000000000-mapping.dmp

Download
memory/3092-139-0x0000000000000000-mapping.dmp

Download
memory/3612-137-0x0000000000000000-mapping.dmp

Download
memory/4124-133-0x0000000000000000-mapping.dmp

Download
memory/4168-140-0x0000000000000000-mapping.dmp

Download
memory/4664-132-0x0000000000000000-mapping.dmp

Download
memory/5052-135-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads