afd965d29e108545069935476f5eacd7ea056b469efe22333677e85449771775

Analysis

max time kernel
36s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
08-11-2022 22:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

afd965d29e108545069935476f5eacd7ea056b469efe22333677e85449771775.exe
Size

36KB
MD5

0ac093850db6f6c1933b255eaa164140
SHA1

a01cd1405ace798e46e30108b9ce49b89cfe954c
SHA256

afd965d29e108545069935476f5eacd7ea056b469efe22333677e85449771775
SHA512

46504ec1db2579086375fa03ddf4fb92bd5f75fb028dfa858dd6c44de8f59f56a6047984d5524c296b655249fc5dc944691bf1dbe28e6655562ff10f9dd0021b
SSDEEP

384:/TMHXsISsl3e7Mf7bNPF4CybpUzfAMue84wGohuEWT3VQRjL0NW4XCrobl5X+YRH:/4sInl3e7Mflvp84drEGooI4SrGhtz2E

Score

8^/10

discovery exploit persistence

Malware Config

Signatures

Possible privilege escalation attempt 2 IoCs
exploit

Processes:

icacls.exetakeown.exe

pid process

1640 icacls.exe
832 takeown.exe
Modifies file permissions 1 TTPs 2 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

takeown.exeicacls.exe

pid process

832 takeown.exe
1640 icacls.exe

pid	process
1640	icacls.exe
832	takeown.exe

pid	process
832	takeown.exe
1640	icacls.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

afd965d29e108545069935476f5eacd7ea056b469efe22333677e85449771775.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	afd965d29e108545069935476f5eacd7ea056b469efe22333677e85449771775.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\dPjaa = "C:\\Windows\\system32\\nxhch.exe"	afd965d29e108545069935476f5eacd7ea056b469efe22333677e85449771775.exe

Drops file in System32 directory 2 IoCs

Processes:

afd965d29e108545069935476f5eacd7ea056b469efe22333677e85449771775.exe

description	ioc	process
File created	C:\Windows\SysWOW64\nxhch.exe	afd965d29e108545069935476f5eacd7ea056b469efe22333677e85449771775.exe
File opened for modification	C:\Windows\SysWOW64\nxhch.exe	afd965d29e108545069935476f5eacd7ea056b469efe22333677e85449771775.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

afd965d29e108545069935476f5eacd7ea056b469efe22333677e85449771775.exe

pid process

1148 afd965d29e108545069935476f5eacd7ea056b469efe22333677e85449771775.exe

pid	process
1148	afd965d29e108545069935476f5eacd7ea056b469efe22333677e85449771775.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

afd965d29e108545069935476f5eacd7ea056b469efe22333677e85449771775.exe

description	pid	process	target process
PID 1148 wrote to memory of 832	1148	afd965d29e108545069935476f5eacd7ea056b469efe22333677e85449771775.exe	takeown.exe
PID 1148 wrote to memory of 832	1148	afd965d29e108545069935476f5eacd7ea056b469efe22333677e85449771775.exe	takeown.exe
PID 1148 wrote to memory of 832	1148	afd965d29e108545069935476f5eacd7ea056b469efe22333677e85449771775.exe	takeown.exe
PID 1148 wrote to memory of 832	1148	afd965d29e108545069935476f5eacd7ea056b469efe22333677e85449771775.exe	takeown.exe
PID 1148 wrote to memory of 1640	1148	afd965d29e108545069935476f5eacd7ea056b469efe22333677e85449771775.exe	icacls.exe
PID 1148 wrote to memory of 1640	1148	afd965d29e108545069935476f5eacd7ea056b469efe22333677e85449771775.exe	icacls.exe
PID 1148 wrote to memory of 1640	1148	afd965d29e108545069935476f5eacd7ea056b469efe22333677e85449771775.exe	icacls.exe
PID 1148 wrote to memory of 1640	1148	afd965d29e108545069935476f5eacd7ea056b469efe22333677e85449771775.exe	icacls.exe

C:\Users\Admin\AppData\Local\Temp\afd965d29e108545069935476f5eacd7ea056b469efe22333677e85449771775.exe
"C:\Users\Admin\AppData\Local\Temp\afd965d29e108545069935476f5eacd7ea056b469efe22333677e85449771775.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1148
- C:\Windows\SysWOW64\takeown.exe
  C:\Windows\system32\takeown.exe /f "C:\Windows\system32\nxhch.exe"
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:832
- C:\Windows\SysWOW64\icacls.exe
  C:\Windows\system32\icacls.exe "C:\Windows\system32\nxhch.exe" /grant Users:F
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:1640

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\nxhch.exe

Filesize
36KB

MD5
0ac093850db6f6c1933b255eaa164140

SHA1
a01cd1405ace798e46e30108b9ce49b89cfe954c

SHA256
afd965d29e108545069935476f5eacd7ea056b469efe22333677e85449771775

SHA512
46504ec1db2579086375fa03ddf4fb92bd5f75fb028dfa858dd6c44de8f59f56a6047984d5524c296b655249fc5dc944691bf1dbe28e6655562ff10f9dd0021b

Download Submit
memory/832-56-0x0000000000000000-mapping.dmp

Download
memory/1640-57-0x0000000000000000-mapping.dmp

Download