d157c219b89a630caef4b4100d037961c7e7cd20529d8a83a1112a9d58e91e48

General

Target

d157c219b89a630caef4b4100d037961c7e7cd20529d8a83a1112a9d58e91e48.exe
Size

72KB
MD5

0b395f3aea7877f5c87cba043b8b3936
SHA1

b518ad66a9adecc3bcd8611dbd878b8e31e4d146
SHA256

d157c219b89a630caef4b4100d037961c7e7cd20529d8a83a1112a9d58e91e48
SHA512

7a91c1ad8dab0420b1258029f24ffcafdd4f6be4f32faeb1410400224820f4356f06403d318f38dcff076ff2d13d3df0a6e8781a000c36d2835285c852e4229f
SSDEEP

768:gbxhVsnrcN1Mdu2s5kDjFz8D83ksomhjfEyHRd7+c+qL6HYKi6BuM80JpBjPXgv:gbxhzT2jbUm5lHP7+N6MTJHrgv

Score

8^/10

discovery exploit

Malware Config

Signatures

Possible privilege escalation attempt 34 IoCs

exploit

Processes:

takeown.exeicacls.exetakeown.exeicacls.exetakeown.exetakeown.exeicacls.exetakeown.exeicacls.exetakeown.exetakeown.exeicacls.exeicacls.exeicacls.exetakeown.exeicacls.exeicacls.exetakeown.exetakeown.exeicacls.exetakeown.exeicacls.exetakeown.exeicacls.exetakeown.exeicacls.exetakeown.exetakeown.exeicacls.exetakeown.exetakeown.exeicacls.exeicacls.exeicacls.exe

pid	process
3172	takeown.exe
1840	icacls.exe
4672	takeown.exe
1844	icacls.exe
2568	takeown.exe
2576	takeown.exe
3016	icacls.exe
1000	takeown.exe
5040	icacls.exe
3308	takeown.exe
4160	takeown.exe
2248	icacls.exe
1708	icacls.exe
5064	icacls.exe
3508	takeown.exe
2332	icacls.exe
2124	icacls.exe
932	takeown.exe
1084	takeown.exe
5012	icacls.exe
4924	takeown.exe
1484	icacls.exe
4600	takeown.exe
2740	icacls.exe
3324	takeown.exe
1336	icacls.exe
1920	takeown.exe
1016	takeown.exe
4660	icacls.exe
1964	takeown.exe
4880	takeown.exe
2496	icacls.exe
2316	icacls.exe
2128	icacls.exe

Modifies file permissions 1 TTPs 34 IoCs

discovery

File and Directory Permissions Modification

T1222

Processes:

takeown.exetakeown.exeicacls.exeicacls.exetakeown.exeicacls.exetakeown.exeicacls.exetakeown.exetakeown.exeicacls.exetakeown.exeicacls.exeicacls.exeicacls.exetakeown.exetakeown.exeicacls.exetakeown.exeicacls.exeicacls.exetakeown.exetakeown.exetakeown.exeicacls.exeicacls.exeicacls.exetakeown.exetakeown.exetakeown.exetakeown.exeicacls.exeicacls.exeicacls.exe

pid	process
1000	takeown.exe
4600	takeown.exe
1844	icacls.exe
2248	icacls.exe
1084	takeown.exe
2332	icacls.exe
3172	takeown.exe
2128	icacls.exe
1920	takeown.exe
3324	takeown.exe
1336	icacls.exe
4672	takeown.exe
4660	icacls.exe
1484	icacls.exe
3016	icacls.exe
1016	takeown.exe
4924	takeown.exe
2496	icacls.exe
3508	takeown.exe
1840	icacls.exe
2740	icacls.exe
1964	takeown.exe
4160	takeown.exe
2576	takeown.exe
2124	icacls.exe
5040	icacls.exe
5064	icacls.exe
932	takeown.exe
3308	takeown.exe
4880	takeown.exe
2568	takeown.exe
1708	icacls.exe
5012	icacls.exe
2316	icacls.exe

Drops file in System32 directory 6 IoCs

Processes:

d157c219b89a630caef4b4100d037961c7e7cd20529d8a83a1112a9d58e91e48.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\ftp.exe	d157c219b89a630caef4b4100d037961c7e7cd20529d8a83a1112a9d58e91e48.exe
File opened for modification	C:\Windows\SysWOW64\wscript.exe	d157c219b89a630caef4b4100d037961c7e7cd20529d8a83a1112a9d58e91e48.exe
File opened for modification	C:\Windows\SysWOW64\cscript.exe	d157c219b89a630caef4b4100d037961c7e7cd20529d8a83a1112a9d58e91e48.exe
File created	C:\Windows\SysWOW64\qpvtu.exe	d157c219b89a630caef4b4100d037961c7e7cd20529d8a83a1112a9d58e91e48.exe
File opened for modification	C:\Windows\SysWOW64\qpvtu.exe	d157c219b89a630caef4b4100d037961c7e7cd20529d8a83a1112a9d58e91e48.exe
File opened for modification	C:\Windows\SysWOW64\cmd.exe	d157c219b89a630caef4b4100d037961c7e7cd20529d8a83a1112a9d58e91e48.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

Processes:

takeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exe

description	pid	process
Token: SeTakeOwnershipPrivilege	1084	takeown.exe
Token: SeTakeOwnershipPrivilege	2576	takeown.exe
Token: SeTakeOwnershipPrivilege	3172	takeown.exe
Token: SeTakeOwnershipPrivilege	3508	takeown.exe
Token: SeTakeOwnershipPrivilege	1000	takeown.exe
Token: SeTakeOwnershipPrivilege	4672	takeown.exe
Token: SeTakeOwnershipPrivilege	4600	takeown.exe
Token: SeTakeOwnershipPrivilege	2568	takeown.exe
Token: SeTakeOwnershipPrivilege	1016	takeown.exe
Token: SeTakeOwnershipPrivilege	1920	takeown.exe
Token: SeTakeOwnershipPrivilege	4924	takeown.exe
Token: SeTakeOwnershipPrivilege	1964	takeown.exe
Token: SeTakeOwnershipPrivilege	3308	takeown.exe
Token: SeTakeOwnershipPrivilege	4160	takeown.exe
Token: SeTakeOwnershipPrivilege	3324	takeown.exe
Token: SeTakeOwnershipPrivilege	932	takeown.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

d157c219b89a630caef4b4100d037961c7e7cd20529d8a83a1112a9d58e91e48.exe

pid process

4500 d157c219b89a630caef4b4100d037961c7e7cd20529d8a83a1112a9d58e91e48.exe

pid	process
4500	d157c219b89a630caef4b4100d037961c7e7cd20529d8a83a1112a9d58e91e48.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

d157c219b89a630caef4b4100d037961c7e7cd20529d8a83a1112a9d58e91e48.exe

description	pid	process	target process
PID 4500 wrote to memory of 4880	4500	d157c219b89a630caef4b4100d037961c7e7cd20529d8a83a1112a9d58e91e48.exe	takeown.exe
PID 4500 wrote to memory of 4880	4500	d157c219b89a630caef4b4100d037961c7e7cd20529d8a83a1112a9d58e91e48.exe	takeown.exe
PID 4500 wrote to memory of 4880	4500	d157c219b89a630caef4b4100d037961c7e7cd20529d8a83a1112a9d58e91e48.exe	takeown.exe
PID 4500 wrote to memory of 2248	4500	d157c219b89a630caef4b4100d037961c7e7cd20529d8a83a1112a9d58e91e48.exe	icacls.exe
PID 4500 wrote to memory of 2248	4500	d157c219b89a630caef4b4100d037961c7e7cd20529d8a83a1112a9d58e91e48.exe	icacls.exe
PID 4500 wrote to memory of 2248	4500	d157c219b89a630caef4b4100d037961c7e7cd20529d8a83a1112a9d58e91e48.exe	icacls.exe
PID 4500 wrote to memory of 1084	4500	d157c219b89a630caef4b4100d037961c7e7cd20529d8a83a1112a9d58e91e48.exe	takeown.exe
PID 4500 wrote to memory of 1084	4500	d157c219b89a630caef4b4100d037961c7e7cd20529d8a83a1112a9d58e91e48.exe	takeown.exe
PID 4500 wrote to memory of 1084	4500	d157c219b89a630caef4b4100d037961c7e7cd20529d8a83a1112a9d58e91e48.exe	takeown.exe
PID 4500 wrote to memory of 2332	4500	d157c219b89a630caef4b4100d037961c7e7cd20529d8a83a1112a9d58e91e48.exe	icacls.exe
PID 4500 wrote to memory of 2332	4500	d157c219b89a630caef4b4100d037961c7e7cd20529d8a83a1112a9d58e91e48.exe	icacls.exe
PID 4500 wrote to memory of 2332	4500	d157c219b89a630caef4b4100d037961c7e7cd20529d8a83a1112a9d58e91e48.exe	icacls.exe
PID 4500 wrote to memory of 2576	4500	d157c219b89a630caef4b4100d037961c7e7cd20529d8a83a1112a9d58e91e48.exe	takeown.exe
PID 4500 wrote to memory of 2576	4500	d157c219b89a630caef4b4100d037961c7e7cd20529d8a83a1112a9d58e91e48.exe	takeown.exe
PID 4500 wrote to memory of 2576	4500	d157c219b89a630caef4b4100d037961c7e7cd20529d8a83a1112a9d58e91e48.exe	takeown.exe
PID 4500 wrote to memory of 2124	4500	d157c219b89a630caef4b4100d037961c7e7cd20529d8a83a1112a9d58e91e48.exe	icacls.exe
PID 4500 wrote to memory of 2124	4500	d157c219b89a630caef4b4100d037961c7e7cd20529d8a83a1112a9d58e91e48.exe	icacls.exe
PID 4500 wrote to memory of 2124	4500	d157c219b89a630caef4b4100d037961c7e7cd20529d8a83a1112a9d58e91e48.exe	icacls.exe
PID 4500 wrote to memory of 3172	4500	d157c219b89a630caef4b4100d037961c7e7cd20529d8a83a1112a9d58e91e48.exe	takeown.exe
PID 4500 wrote to memory of 3172	4500	d157c219b89a630caef4b4100d037961c7e7cd20529d8a83a1112a9d58e91e48.exe	takeown.exe
PID 4500 wrote to memory of 3172	4500	d157c219b89a630caef4b4100d037961c7e7cd20529d8a83a1112a9d58e91e48.exe	takeown.exe
PID 4500 wrote to memory of 2128	4500	d157c219b89a630caef4b4100d037961c7e7cd20529d8a83a1112a9d58e91e48.exe	icacls.exe
PID 4500 wrote to memory of 2128	4500	d157c219b89a630caef4b4100d037961c7e7cd20529d8a83a1112a9d58e91e48.exe	icacls.exe
PID 4500 wrote to memory of 2128	4500	d157c219b89a630caef4b4100d037961c7e7cd20529d8a83a1112a9d58e91e48.exe	icacls.exe
PID 4500 wrote to memory of 3508	4500	d157c219b89a630caef4b4100d037961c7e7cd20529d8a83a1112a9d58e91e48.exe	takeown.exe
PID 4500 wrote to memory of 3508	4500	d157c219b89a630caef4b4100d037961c7e7cd20529d8a83a1112a9d58e91e48.exe	takeown.exe
PID 4500 wrote to memory of 3508	4500	d157c219b89a630caef4b4100d037961c7e7cd20529d8a83a1112a9d58e91e48.exe	takeown.exe
PID 4500 wrote to memory of 3016	4500	d157c219b89a630caef4b4100d037961c7e7cd20529d8a83a1112a9d58e91e48.exe	icacls.exe
PID 4500 wrote to memory of 3016	4500	d157c219b89a630caef4b4100d037961c7e7cd20529d8a83a1112a9d58e91e48.exe	icacls.exe
PID 4500 wrote to memory of 3016	4500	d157c219b89a630caef4b4100d037961c7e7cd20529d8a83a1112a9d58e91e48.exe	icacls.exe
PID 4500 wrote to memory of 1000	4500	d157c219b89a630caef4b4100d037961c7e7cd20529d8a83a1112a9d58e91e48.exe	takeown.exe
PID 4500 wrote to memory of 1000	4500	d157c219b89a630caef4b4100d037961c7e7cd20529d8a83a1112a9d58e91e48.exe	takeown.exe
PID 4500 wrote to memory of 1000	4500	d157c219b89a630caef4b4100d037961c7e7cd20529d8a83a1112a9d58e91e48.exe	takeown.exe
PID 4500 wrote to memory of 1840	4500	d157c219b89a630caef4b4100d037961c7e7cd20529d8a83a1112a9d58e91e48.exe	icacls.exe
PID 4500 wrote to memory of 1840	4500	d157c219b89a630caef4b4100d037961c7e7cd20529d8a83a1112a9d58e91e48.exe	icacls.exe
PID 4500 wrote to memory of 1840	4500	d157c219b89a630caef4b4100d037961c7e7cd20529d8a83a1112a9d58e91e48.exe	icacls.exe
PID 4500 wrote to memory of 4672	4500	d157c219b89a630caef4b4100d037961c7e7cd20529d8a83a1112a9d58e91e48.exe	takeown.exe
PID 4500 wrote to memory of 4672	4500	d157c219b89a630caef4b4100d037961c7e7cd20529d8a83a1112a9d58e91e48.exe	takeown.exe
PID 4500 wrote to memory of 4672	4500	d157c219b89a630caef4b4100d037961c7e7cd20529d8a83a1112a9d58e91e48.exe	takeown.exe
PID 4500 wrote to memory of 5040	4500	d157c219b89a630caef4b4100d037961c7e7cd20529d8a83a1112a9d58e91e48.exe	icacls.exe
PID 4500 wrote to memory of 5040	4500	d157c219b89a630caef4b4100d037961c7e7cd20529d8a83a1112a9d58e91e48.exe	icacls.exe
PID 4500 wrote to memory of 5040	4500	d157c219b89a630caef4b4100d037961c7e7cd20529d8a83a1112a9d58e91e48.exe	icacls.exe
PID 4500 wrote to memory of 4600	4500	d157c219b89a630caef4b4100d037961c7e7cd20529d8a83a1112a9d58e91e48.exe	takeown.exe
PID 4500 wrote to memory of 4600	4500	d157c219b89a630caef4b4100d037961c7e7cd20529d8a83a1112a9d58e91e48.exe	takeown.exe
PID 4500 wrote to memory of 4600	4500	d157c219b89a630caef4b4100d037961c7e7cd20529d8a83a1112a9d58e91e48.exe	takeown.exe
PID 4500 wrote to memory of 1844	4500	d157c219b89a630caef4b4100d037961c7e7cd20529d8a83a1112a9d58e91e48.exe	icacls.exe
PID 4500 wrote to memory of 1844	4500	d157c219b89a630caef4b4100d037961c7e7cd20529d8a83a1112a9d58e91e48.exe	icacls.exe
PID 4500 wrote to memory of 1844	4500	d157c219b89a630caef4b4100d037961c7e7cd20529d8a83a1112a9d58e91e48.exe	icacls.exe
PID 4500 wrote to memory of 2568	4500	d157c219b89a630caef4b4100d037961c7e7cd20529d8a83a1112a9d58e91e48.exe	takeown.exe
PID 4500 wrote to memory of 2568	4500	d157c219b89a630caef4b4100d037961c7e7cd20529d8a83a1112a9d58e91e48.exe	takeown.exe
PID 4500 wrote to memory of 2568	4500	d157c219b89a630caef4b4100d037961c7e7cd20529d8a83a1112a9d58e91e48.exe	takeown.exe
PID 4500 wrote to memory of 1708	4500	d157c219b89a630caef4b4100d037961c7e7cd20529d8a83a1112a9d58e91e48.exe	icacls.exe
PID 4500 wrote to memory of 1708	4500	d157c219b89a630caef4b4100d037961c7e7cd20529d8a83a1112a9d58e91e48.exe	icacls.exe
PID 4500 wrote to memory of 1708	4500	d157c219b89a630caef4b4100d037961c7e7cd20529d8a83a1112a9d58e91e48.exe	icacls.exe
PID 4500 wrote to memory of 1016	4500	d157c219b89a630caef4b4100d037961c7e7cd20529d8a83a1112a9d58e91e48.exe	takeown.exe
PID 4500 wrote to memory of 1016	4500	d157c219b89a630caef4b4100d037961c7e7cd20529d8a83a1112a9d58e91e48.exe	takeown.exe
PID 4500 wrote to memory of 1016	4500	d157c219b89a630caef4b4100d037961c7e7cd20529d8a83a1112a9d58e91e48.exe	takeown.exe
PID 4500 wrote to memory of 4660	4500	d157c219b89a630caef4b4100d037961c7e7cd20529d8a83a1112a9d58e91e48.exe	icacls.exe
PID 4500 wrote to memory of 4660	4500	d157c219b89a630caef4b4100d037961c7e7cd20529d8a83a1112a9d58e91e48.exe	icacls.exe
PID 4500 wrote to memory of 4660	4500	d157c219b89a630caef4b4100d037961c7e7cd20529d8a83a1112a9d58e91e48.exe	icacls.exe
PID 4500 wrote to memory of 1920	4500	d157c219b89a630caef4b4100d037961c7e7cd20529d8a83a1112a9d58e91e48.exe	takeown.exe
PID 4500 wrote to memory of 1920	4500	d157c219b89a630caef4b4100d037961c7e7cd20529d8a83a1112a9d58e91e48.exe	takeown.exe
PID 4500 wrote to memory of 1920	4500	d157c219b89a630caef4b4100d037961c7e7cd20529d8a83a1112a9d58e91e48.exe	takeown.exe
PID 4500 wrote to memory of 5012	4500	d157c219b89a630caef4b4100d037961c7e7cd20529d8a83a1112a9d58e91e48.exe	icacls.exe

C:\Users\Admin\AppData\Local\Temp\d157c219b89a630caef4b4100d037961c7e7cd20529d8a83a1112a9d58e91e48.exe
"C:\Users\Admin\AppData\Local\Temp\d157c219b89a630caef4b4100d037961c7e7cd20529d8a83a1112a9d58e91e48.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4500

C:\Windows\SysWOW64\takeown.exe
C:\Windows\system32\takeown.exe /f "C:\Windows\system32\qpvtu.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:4880

C:\Windows\SysWOW64\icacls.exe
C:\Windows\system32\icacls.exe "C:\Windows\system32\qpvtu.exe" /grant SYSTEM:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:2248

C:\Windows\SysWOW64\takeown.exe
takeown.exe /f "C:\Windows\System32\cmd.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:1084

C:\Windows\SysWOW64\icacls.exe
icacls.exe "C:\Windows\System32\cmd.exe" /grant SYSTEM:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:2332

C:\Windows\SysWOW64\takeown.exe
takeown.exe /f "C:\Windows\System32\cmd.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:2576

C:\Windows\SysWOW64\icacls.exe
icacls.exe "C:\Windows\System32\cmd.exe" /grant SYSTEM:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:2124

C:\Windows\SysWOW64\takeown.exe
takeown.exe /f "C:\Windows\System32\ftp.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:3172

C:\Windows\SysWOW64\icacls.exe
icacls.exe "C:\Windows\System32\ftp.exe" /grant SYSTEM:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:2128

C:\Windows\SysWOW64\takeown.exe
takeown.exe /f "C:\Windows\System32\ftp.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:3508

C:\Windows\SysWOW64\icacls.exe
icacls.exe "C:\Windows\System32\ftp.exe" /grant SYSTEM:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:3016

C:\Windows\SysWOW64\takeown.exe
takeown.exe /f "C:\Windows\System32\wscript.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:1000

C:\Windows\SysWOW64\icacls.exe
icacls.exe "C:\Windows\System32\wscript.exe" /grant SYSTEM:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1840

C:\Windows\SysWOW64\takeown.exe
takeown.exe /f "C:\Windows\System32\wscript.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:4672

C:\Windows\SysWOW64\icacls.exe
icacls.exe "C:\Windows\System32\wscript.exe" /grant SYSTEM:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:5040

C:\Windows\SysWOW64\takeown.exe
takeown.exe /f "C:\Windows\System32\cscript.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:4600

C:\Windows\SysWOW64\icacls.exe
icacls.exe "C:\Windows\System32\cscript.exe" /grant SYSTEM:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1844

C:\Windows\SysWOW64\takeown.exe
takeown.exe /f "C:\Windows\System32\cscript.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:2568

C:\Windows\SysWOW64\icacls.exe
icacls.exe "C:\Windows\System32\cscript.exe" /grant SYSTEM:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1708

C:\Windows\SysWOW64\takeown.exe
takeown.exe /f "C:\Windows\SysWOW64\cmd.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:1016

C:\Windows\SysWOW64\icacls.exe
icacls.exe "C:\Windows\SysWOW64\cmd.exe" /grant SYSTEM:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:4660

C:\Windows\SysWOW64\takeown.exe
takeown.exe /f "C:\Windows\SysWOW64\cmd.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:1920

C:\Windows\SysWOW64\icacls.exe
icacls.exe "C:\Windows\SysWOW64\cmd.exe" /grant SYSTEM:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:5012

C:\Windows\SysWOW64\takeown.exe
takeown.exe /f "C:\Windows\SysWOW64\ftp.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:4924

C:\Windows\SysWOW64\icacls.exe
icacls.exe "C:\Windows\SysWOW64\ftp.exe" /grant SYSTEM:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:2740

C:\Windows\SysWOW64\takeown.exe
takeown.exe /f "C:\Windows\SysWOW64\ftp.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:1964

C:\Windows\SysWOW64\icacls.exe
icacls.exe "C:\Windows\SysWOW64\ftp.exe" /grant SYSTEM:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:5064

C:\Windows\SysWOW64\takeown.exe
takeown.exe /f "C:\Windows\SysWOW64\wscript.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:3308

C:\Windows\SysWOW64\icacls.exe
icacls.exe "C:\Windows\SysWOW64\wscript.exe" /grant SYSTEM:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1484

C:\Windows\SysWOW64\takeown.exe
takeown.exe /f "C:\Windows\SysWOW64\wscript.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:4160

C:\Windows\SysWOW64\icacls.exe
icacls.exe "C:\Windows\SysWOW64\wscript.exe" /grant SYSTEM:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:2496

C:\Windows\SysWOW64\takeown.exe
takeown.exe /f "C:\Windows\SysWOW64\cscript.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:3324

C:\Windows\SysWOW64\icacls.exe
icacls.exe "C:\Windows\SysWOW64\cscript.exe" /grant SYSTEM:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:2316

C:\Windows\SysWOW64\takeown.exe
takeown.exe /f "C:\Windows\SysWOW64\cscript.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:932

C:\Windows\SysWOW64\icacls.exe
icacls.exe "C:\Windows\SysWOW64\cscript.exe" /grant SYSTEM:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1336

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

1

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\qpvtu.exe
Filesize
72KB

MD5
0b395f3aea7877f5c87cba043b8b3936

SHA1
b518ad66a9adecc3bcd8611dbd878b8e31e4d146

SHA256
d157c219b89a630caef4b4100d037961c7e7cd20529d8a83a1112a9d58e91e48

SHA512
7a91c1ad8dab0420b1258029f24ffcafdd4f6be4f32faeb1410400224820f4356f06403d318f38dcff076ff2d13d3df0a6e8781a000c36d2835285c852e4229f

Download Submit
memory/932-167-0x0000000000000000-mapping.dmp

Download
memory/1000-145-0x0000000000000000-mapping.dmp

Download
memory/1016-153-0x0000000000000000-mapping.dmp

Download
memory/1084-137-0x0000000000000000-mapping.dmp

Download
memory/1336-168-0x0000000000000000-mapping.dmp

Download
memory/1484-162-0x0000000000000000-mapping.dmp

Download
memory/1708-152-0x0000000000000000-mapping.dmp

Download
memory/1840-146-0x0000000000000000-mapping.dmp

Download
memory/1844-150-0x0000000000000000-mapping.dmp

Download
memory/1920-155-0x0000000000000000-mapping.dmp

Download
memory/1964-159-0x0000000000000000-mapping.dmp

Download
memory/2124-140-0x0000000000000000-mapping.dmp

Download
memory/2128-142-0x0000000000000000-mapping.dmp

Download
memory/2248-136-0x0000000000000000-mapping.dmp

Download
memory/2316-166-0x0000000000000000-mapping.dmp

Download
memory/2332-138-0x0000000000000000-mapping.dmp

Download
memory/2496-164-0x0000000000000000-mapping.dmp

Download
memory/2568-151-0x0000000000000000-mapping.dmp

Download
memory/2576-139-0x0000000000000000-mapping.dmp

Download
memory/2740-158-0x0000000000000000-mapping.dmp

Download
memory/3016-144-0x0000000000000000-mapping.dmp

Download
memory/3172-141-0x0000000000000000-mapping.dmp

Download
memory/3308-161-0x0000000000000000-mapping.dmp

Download
memory/3324-165-0x0000000000000000-mapping.dmp

Download
memory/3508-143-0x0000000000000000-mapping.dmp

Download
memory/4160-163-0x0000000000000000-mapping.dmp

Download
memory/4600-149-0x0000000000000000-mapping.dmp

Download
memory/4660-154-0x0000000000000000-mapping.dmp

Download
memory/4672-147-0x0000000000000000-mapping.dmp

Download
memory/4880-134-0x0000000000000000-mapping.dmp

Download
memory/4924-157-0x0000000000000000-mapping.dmp

Download
memory/5012-156-0x0000000000000000-mapping.dmp

Download
memory/5040-148-0x0000000000000000-mapping.dmp

Download
memory/5064-160-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads