a7da6aed7b37d407c180f59010e8633efd05bc697631a3c30d21f6d7abcf4b41

Analysis

max time kernel
35s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
08-11-2022 08:51

Target

a7da6aed7b37d407c180f59010e8633efd05bc697631a3c30d21f6d7abcf4b41.exe
Size

72KB
MD5

034a5d389fc637d08c53eb0b683f1e81
SHA1

86b0b3bd1a6cb3a4d4920206760874db099e4957
SHA256

a7da6aed7b37d407c180f59010e8633efd05bc697631a3c30d21f6d7abcf4b41
SHA512

da3d9ef91e1a8cb205c67ae5b6489bee5455c0156d58ff8f2c771c70b140b050bf39bf5c61c8f79fc12a3b4628ee0a9417f954aa5bf87f82c3e7d93d21aa667e
SSDEEP

768:uVQhM1eScdD6f9iqDik9GG3OY8AYv1ahGMgZlvL3B6oM/Jv3QOhiD17OnWbMSu4t:uVQhccdDCFBM1a8B6oM/JP4PKTU

Score

8^/10

discovery exploit

Possible privilege escalation attempt 2 IoCs
exploit

Processes:

takeown.exeicacls.exe

pid process

832 takeown.exe
1564 icacls.exe
Modifies file permissions 1 TTPs 2 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

takeown.exeicacls.exe

pid process

832 takeown.exe
1564 icacls.exe

pid	process
832	takeown.exe
1564	icacls.exe

pid	process
832	takeown.exe
1564	icacls.exe

Drops file in System32 directory 2 IoCs

Processes:

a7da6aed7b37d407c180f59010e8633efd05bc697631a3c30d21f6d7abcf4b41.exe

description	ioc	process
File created	C:\Windows\SysWOW64\axqep.exe	a7da6aed7b37d407c180f59010e8633efd05bc697631a3c30d21f6d7abcf4b41.exe
File opened for modification	C:\Windows\SysWOW64\axqep.exe	a7da6aed7b37d407c180f59010e8633efd05bc697631a3c30d21f6d7abcf4b41.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

a7da6aed7b37d407c180f59010e8633efd05bc697631a3c30d21f6d7abcf4b41.exe

pid process

1452 a7da6aed7b37d407c180f59010e8633efd05bc697631a3c30d21f6d7abcf4b41.exe

pid	process
1452	a7da6aed7b37d407c180f59010e8633efd05bc697631a3c30d21f6d7abcf4b41.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

a7da6aed7b37d407c180f59010e8633efd05bc697631a3c30d21f6d7abcf4b41.exe

description	pid	process	target process
PID 1452 wrote to memory of 832	1452	a7da6aed7b37d407c180f59010e8633efd05bc697631a3c30d21f6d7abcf4b41.exe	takeown.exe
PID 1452 wrote to memory of 832	1452	a7da6aed7b37d407c180f59010e8633efd05bc697631a3c30d21f6d7abcf4b41.exe	takeown.exe
PID 1452 wrote to memory of 832	1452	a7da6aed7b37d407c180f59010e8633efd05bc697631a3c30d21f6d7abcf4b41.exe	takeown.exe
PID 1452 wrote to memory of 832	1452	a7da6aed7b37d407c180f59010e8633efd05bc697631a3c30d21f6d7abcf4b41.exe	takeown.exe
PID 1452 wrote to memory of 1564	1452	a7da6aed7b37d407c180f59010e8633efd05bc697631a3c30d21f6d7abcf4b41.exe	icacls.exe
PID 1452 wrote to memory of 1564	1452	a7da6aed7b37d407c180f59010e8633efd05bc697631a3c30d21f6d7abcf4b41.exe	icacls.exe
PID 1452 wrote to memory of 1564	1452	a7da6aed7b37d407c180f59010e8633efd05bc697631a3c30d21f6d7abcf4b41.exe	icacls.exe
PID 1452 wrote to memory of 1564	1452	a7da6aed7b37d407c180f59010e8633efd05bc697631a3c30d21f6d7abcf4b41.exe	icacls.exe

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Windows\SysWOW64\axqep.exe

Filesize
72KB

MD5
034a5d389fc637d08c53eb0b683f1e81

SHA1
86b0b3bd1a6cb3a4d4920206760874db099e4957

SHA256
a7da6aed7b37d407c180f59010e8633efd05bc697631a3c30d21f6d7abcf4b41

SHA512
da3d9ef91e1a8cb205c67ae5b6489bee5455c0156d58ff8f2c771c70b140b050bf39bf5c61c8f79fc12a3b4628ee0a9417f954aa5bf87f82c3e7d93d21aa667e

Download Submit
memory/832-57-0x0000000000000000-mapping.dmp

Download
memory/1452-56-0x0000000075041000-0x0000000075043000-memory.dmp

Filesize
8KB

Download
memory/1564-59-0x0000000000000000-mapping.dmp

Download