93bf870ce39f39feb3d27dbb32db9134bb0e711dde75f25dbaa8207992be89d7

Analysis

max time kernel
185s
max time network
189s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
08-11-2022 22:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

93bf870ce39f39feb3d27dbb32db9134bb0e711dde75f25dbaa8207992be89d7.exe
Size

60KB
MD5

04d53f4ba87e6b6b1cf64aebb03c3d06
SHA1

c4af80fc1b5d4a9e50fbaf364e8bdaa0b376d86e
SHA256

93bf870ce39f39feb3d27dbb32db9134bb0e711dde75f25dbaa8207992be89d7
SHA512

a9ca310da3f7ac6ca7bd90a5119251ff36007e95b22376e905f38fa1f2e80794b59cd3292c946cd9f9efb66ca2f2503555ceb1947eb0cdfec7581b2cdb8a45dd
SSDEEP

768:7Cn6DbPZHslJZozf90kY+PQ82TtMWYUugh4cJ8ZH0IZHK:7CnEZMUPQ82TtPZVJw0MHK

Score

8^/10

discovery exploit

Malware Config

Signatures

Possible privilege escalation attempt 14 IoCs

exploit

Processes:

icacls.exetakeown.exeicacls.exetakeown.exeicacls.exetakeown.exeicacls.exeicacls.exetakeown.exeicacls.exeicacls.exetakeown.exeicacls.exeicacls.exe

pid	process
3472	icacls.exe
3832	takeown.exe
3428	icacls.exe
3820	takeown.exe
1640	icacls.exe
4236	takeown.exe
5028	icacls.exe
1816	icacls.exe
3892	takeown.exe
4372	icacls.exe
2732	icacls.exe
5024	takeown.exe
244	icacls.exe
3132	icacls.exe

Modifies file permissions 1 TTPs 14 IoCs

discovery

File and Directory Permissions Modification

T1222

Processes:

icacls.exeicacls.exeicacls.exeicacls.exeicacls.exetakeown.exeicacls.exeicacls.exeicacls.exetakeown.exetakeown.exetakeown.exetakeown.exeicacls.exe

pid	process
3472	icacls.exe
1816	icacls.exe
2732	icacls.exe
3132	icacls.exe
1640	icacls.exe
3832	takeown.exe
244	icacls.exe
3428	icacls.exe
5028	icacls.exe
3892	takeown.exe
4236	takeown.exe
3820	takeown.exe
5024	takeown.exe
4372	icacls.exe

Drops file in System32 directory 6 IoCs

Processes:

93bf870ce39f39feb3d27dbb32db9134bb0e711dde75f25dbaa8207992be89d7.exe

description	ioc	process
File created	\??\c:\windows\SysWOW64\uudvy.exe	93bf870ce39f39feb3d27dbb32db9134bb0e711dde75f25dbaa8207992be89d7.exe
File opened for modification	\??\c:\windows\SysWOW64\uudvy.exe	93bf870ce39f39feb3d27dbb32db9134bb0e711dde75f25dbaa8207992be89d7.exe
File opened for modification	C:\Windows\SysWOW64\cmd.exe	93bf870ce39f39feb3d27dbb32db9134bb0e711dde75f25dbaa8207992be89d7.exe
File opened for modification	C:\Windows\SysWOW64\ftp.exe	93bf870ce39f39feb3d27dbb32db9134bb0e711dde75f25dbaa8207992be89d7.exe
File opened for modification	C:\Windows\SysWOW64\wscript.exe	93bf870ce39f39feb3d27dbb32db9134bb0e711dde75f25dbaa8207992be89d7.exe
File opened for modification	C:\Windows\SysWOW64\cscript.exe	93bf870ce39f39feb3d27dbb32db9134bb0e711dde75f25dbaa8207992be89d7.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

takeown.exetakeown.exetakeown.exetakeown.exe

description	pid	process
Token: SeTakeOwnershipPrivilege	5024	takeown.exe
Token: SeTakeOwnershipPrivilege	3832	takeown.exe
Token: SeTakeOwnershipPrivilege	3892	takeown.exe
Token: SeTakeOwnershipPrivilege	4236	takeown.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

93bf870ce39f39feb3d27dbb32db9134bb0e711dde75f25dbaa8207992be89d7.exe

pid process

4952 93bf870ce39f39feb3d27dbb32db9134bb0e711dde75f25dbaa8207992be89d7.exe

pid	process
4952	93bf870ce39f39feb3d27dbb32db9134bb0e711dde75f25dbaa8207992be89d7.exe

Suspicious use of WriteProcessMemory 42 IoCs

Processes:

93bf870ce39f39feb3d27dbb32db9134bb0e711dde75f25dbaa8207992be89d7.exe

description	pid	process	target process
PID 4952 wrote to memory of 3820	4952	93bf870ce39f39feb3d27dbb32db9134bb0e711dde75f25dbaa8207992be89d7.exe	takeown.exe
PID 4952 wrote to memory of 3820	4952	93bf870ce39f39feb3d27dbb32db9134bb0e711dde75f25dbaa8207992be89d7.exe	takeown.exe
PID 4952 wrote to memory of 3820	4952	93bf870ce39f39feb3d27dbb32db9134bb0e711dde75f25dbaa8207992be89d7.exe	takeown.exe
PID 4952 wrote to memory of 3472	4952	93bf870ce39f39feb3d27dbb32db9134bb0e711dde75f25dbaa8207992be89d7.exe	icacls.exe
PID 4952 wrote to memory of 3472	4952	93bf870ce39f39feb3d27dbb32db9134bb0e711dde75f25dbaa8207992be89d7.exe	icacls.exe
PID 4952 wrote to memory of 3472	4952	93bf870ce39f39feb3d27dbb32db9134bb0e711dde75f25dbaa8207992be89d7.exe	icacls.exe
PID 4952 wrote to memory of 5024	4952	93bf870ce39f39feb3d27dbb32db9134bb0e711dde75f25dbaa8207992be89d7.exe	takeown.exe
PID 4952 wrote to memory of 5024	4952	93bf870ce39f39feb3d27dbb32db9134bb0e711dde75f25dbaa8207992be89d7.exe	takeown.exe
PID 4952 wrote to memory of 5024	4952	93bf870ce39f39feb3d27dbb32db9134bb0e711dde75f25dbaa8207992be89d7.exe	takeown.exe
PID 4952 wrote to memory of 5028	4952	93bf870ce39f39feb3d27dbb32db9134bb0e711dde75f25dbaa8207992be89d7.exe	icacls.exe
PID 4952 wrote to memory of 5028	4952	93bf870ce39f39feb3d27dbb32db9134bb0e711dde75f25dbaa8207992be89d7.exe	icacls.exe
PID 4952 wrote to memory of 5028	4952	93bf870ce39f39feb3d27dbb32db9134bb0e711dde75f25dbaa8207992be89d7.exe	icacls.exe
PID 4952 wrote to memory of 1640	4952	93bf870ce39f39feb3d27dbb32db9134bb0e711dde75f25dbaa8207992be89d7.exe	icacls.exe
PID 4952 wrote to memory of 1640	4952	93bf870ce39f39feb3d27dbb32db9134bb0e711dde75f25dbaa8207992be89d7.exe	icacls.exe
PID 4952 wrote to memory of 1640	4952	93bf870ce39f39feb3d27dbb32db9134bb0e711dde75f25dbaa8207992be89d7.exe	icacls.exe
PID 4952 wrote to memory of 3832	4952	93bf870ce39f39feb3d27dbb32db9134bb0e711dde75f25dbaa8207992be89d7.exe	takeown.exe
PID 4952 wrote to memory of 3832	4952	93bf870ce39f39feb3d27dbb32db9134bb0e711dde75f25dbaa8207992be89d7.exe	takeown.exe
PID 4952 wrote to memory of 3832	4952	93bf870ce39f39feb3d27dbb32db9134bb0e711dde75f25dbaa8207992be89d7.exe	takeown.exe
PID 4952 wrote to memory of 1816	4952	93bf870ce39f39feb3d27dbb32db9134bb0e711dde75f25dbaa8207992be89d7.exe	icacls.exe
PID 4952 wrote to memory of 1816	4952	93bf870ce39f39feb3d27dbb32db9134bb0e711dde75f25dbaa8207992be89d7.exe	icacls.exe
PID 4952 wrote to memory of 1816	4952	93bf870ce39f39feb3d27dbb32db9134bb0e711dde75f25dbaa8207992be89d7.exe	icacls.exe
PID 4952 wrote to memory of 244	4952	93bf870ce39f39feb3d27dbb32db9134bb0e711dde75f25dbaa8207992be89d7.exe	icacls.exe
PID 4952 wrote to memory of 244	4952	93bf870ce39f39feb3d27dbb32db9134bb0e711dde75f25dbaa8207992be89d7.exe	icacls.exe
PID 4952 wrote to memory of 244	4952	93bf870ce39f39feb3d27dbb32db9134bb0e711dde75f25dbaa8207992be89d7.exe	icacls.exe
PID 4952 wrote to memory of 3892	4952	93bf870ce39f39feb3d27dbb32db9134bb0e711dde75f25dbaa8207992be89d7.exe	takeown.exe
PID 4952 wrote to memory of 3892	4952	93bf870ce39f39feb3d27dbb32db9134bb0e711dde75f25dbaa8207992be89d7.exe	takeown.exe
PID 4952 wrote to memory of 3892	4952	93bf870ce39f39feb3d27dbb32db9134bb0e711dde75f25dbaa8207992be89d7.exe	takeown.exe
PID 4952 wrote to memory of 4372	4952	93bf870ce39f39feb3d27dbb32db9134bb0e711dde75f25dbaa8207992be89d7.exe	icacls.exe
PID 4952 wrote to memory of 4372	4952	93bf870ce39f39feb3d27dbb32db9134bb0e711dde75f25dbaa8207992be89d7.exe	icacls.exe
PID 4952 wrote to memory of 4372	4952	93bf870ce39f39feb3d27dbb32db9134bb0e711dde75f25dbaa8207992be89d7.exe	icacls.exe
PID 4952 wrote to memory of 3428	4952	93bf870ce39f39feb3d27dbb32db9134bb0e711dde75f25dbaa8207992be89d7.exe	icacls.exe
PID 4952 wrote to memory of 3428	4952	93bf870ce39f39feb3d27dbb32db9134bb0e711dde75f25dbaa8207992be89d7.exe	icacls.exe
PID 4952 wrote to memory of 3428	4952	93bf870ce39f39feb3d27dbb32db9134bb0e711dde75f25dbaa8207992be89d7.exe	icacls.exe
PID 4952 wrote to memory of 4236	4952	93bf870ce39f39feb3d27dbb32db9134bb0e711dde75f25dbaa8207992be89d7.exe	takeown.exe
PID 4952 wrote to memory of 4236	4952	93bf870ce39f39feb3d27dbb32db9134bb0e711dde75f25dbaa8207992be89d7.exe	takeown.exe
PID 4952 wrote to memory of 4236	4952	93bf870ce39f39feb3d27dbb32db9134bb0e711dde75f25dbaa8207992be89d7.exe	takeown.exe
PID 4952 wrote to memory of 2732	4952	93bf870ce39f39feb3d27dbb32db9134bb0e711dde75f25dbaa8207992be89d7.exe	icacls.exe
PID 4952 wrote to memory of 2732	4952	93bf870ce39f39feb3d27dbb32db9134bb0e711dde75f25dbaa8207992be89d7.exe	icacls.exe
PID 4952 wrote to memory of 2732	4952	93bf870ce39f39feb3d27dbb32db9134bb0e711dde75f25dbaa8207992be89d7.exe	icacls.exe
PID 4952 wrote to memory of 3132	4952	93bf870ce39f39feb3d27dbb32db9134bb0e711dde75f25dbaa8207992be89d7.exe	icacls.exe
PID 4952 wrote to memory of 3132	4952	93bf870ce39f39feb3d27dbb32db9134bb0e711dde75f25dbaa8207992be89d7.exe	icacls.exe
PID 4952 wrote to memory of 3132	4952	93bf870ce39f39feb3d27dbb32db9134bb0e711dde75f25dbaa8207992be89d7.exe	icacls.exe

C:\Users\Admin\AppData\Local\Temp\93bf870ce39f39feb3d27dbb32db9134bb0e711dde75f25dbaa8207992be89d7.exe
"C:\Users\Admin\AppData\Local\Temp\93bf870ce39f39feb3d27dbb32db9134bb0e711dde75f25dbaa8207992be89d7.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4952
- C:\Windows\SysWOW64\takeown.exe
  C:\Windows\system32\takeown.exe /f "c:\windows\system32\uudvy.exe"
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:3820
- C:\Windows\SysWOW64\icacls.exe
  C:\Windows\system32\icacls.exe "c:\windows\system32\uudvy.exe" /grant SYSTEM:F
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:3472
- C:\Windows\SysWOW64\takeown.exe
  C:\Windows\system32\takeown.exe /f "C:\Windows\System32\cmd.exe"
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  - Suspicious use of AdjustPrivilegeToken
  PID:5024
- C:\Windows\SysWOW64\icacls.exe
  C:\Windows\system32\icacls.exe "C:\Windows\System32\cmd.exe" /grant SYSTEM:F
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:5028
- C:\Windows\SysWOW64\icacls.exe
  C:\Windows\system32\icacls.exe "C:\Windows\System32\cmd.exe" /grant Users:F
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:1640
- C:\Windows\SysWOW64\takeown.exe
  C:\Windows\system32\takeown.exe /f "C:\Windows\System32\ftp.exe"
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  - Suspicious use of AdjustPrivilegeToken
  PID:3832
- C:\Windows\SysWOW64\icacls.exe
  C:\Windows\system32\icacls.exe "C:\Windows\System32\ftp.exe" /grant SYSTEM:F
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:1816
- C:\Windows\SysWOW64\icacls.exe
  C:\Windows\system32\icacls.exe "C:\Windows\System32\ftp.exe" /grant Users:F
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:244
- C:\Windows\SysWOW64\takeown.exe
  C:\Windows\system32\takeown.exe /f "C:\Windows\System32\wscript.exe"
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  - Suspicious use of AdjustPrivilegeToken
  PID:3892
- C:\Windows\SysWOW64\icacls.exe
  C:\Windows\system32\icacls.exe "C:\Windows\System32\wscript.exe" /grant Users:F
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:3428
- C:\Windows\SysWOW64\icacls.exe
  C:\Windows\system32\icacls.exe "C:\Windows\System32\wscript.exe" /grant SYSTEM:F
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:4372
- C:\Windows\SysWOW64\takeown.exe
  C:\Windows\system32\takeown.exe /f "C:\Windows\System32\cscript.exe"
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  - Suspicious use of AdjustPrivilegeToken
  PID:4236
- C:\Windows\SysWOW64\icacls.exe
  C:\Windows\system32\icacls.exe "C:\Windows\System32\cscript.exe" /grant SYSTEM:F
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:2732
- C:\Windows\SysWOW64\icacls.exe
  C:\Windows\system32\icacls.exe "C:\Windows\System32\cscript.exe" /grant Users:F
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:3132

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\??\c:\windows\SysWOW64\uudvy.exe

Filesize
60KB

MD5
04d53f4ba87e6b6b1cf64aebb03c3d06

SHA1
c4af80fc1b5d4a9e50fbaf364e8bdaa0b376d86e

SHA256
93bf870ce39f39feb3d27dbb32db9134bb0e711dde75f25dbaa8207992be89d7

SHA512
a9ca310da3f7ac6ca7bd90a5119251ff36007e95b22376e905f38fa1f2e80794b59cd3292c946cd9f9efb66ca2f2503555ceb1947eb0cdfec7581b2cdb8a45dd

Download Submit
memory/244-142-0x0000000000000000-mapping.dmp

Download
memory/1640-139-0x0000000000000000-mapping.dmp

Download
memory/1816-141-0x0000000000000000-mapping.dmp

Download
memory/2732-147-0x0000000000000000-mapping.dmp

Download
memory/3132-148-0x0000000000000000-mapping.dmp

Download
memory/3428-145-0x0000000000000000-mapping.dmp

Download
memory/3472-135-0x0000000000000000-mapping.dmp

Download
memory/3820-134-0x0000000000000000-mapping.dmp

Download
memory/3832-140-0x0000000000000000-mapping.dmp

Download
memory/3892-143-0x0000000000000000-mapping.dmp

Download
memory/4236-146-0x0000000000000000-mapping.dmp

Download
memory/4372-144-0x0000000000000000-mapping.dmp

Download
memory/5024-137-0x0000000000000000-mapping.dmp

Download
memory/5028-138-0x0000000000000000-mapping.dmp

Download