134067df9a813752b9551424bbd3d196e6bd695b5a991e2caaf6260b1f7f0075

Analysis

max time kernel
19s
max time network
50s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
08-11-2022 09:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

134067df9a813752b9551424bbd3d196e6bd695b5a991e2caaf6260b1f7f0075.exe
Size

72KB
MD5

0ce83cefec533da1b55a19fb5fbc5a91
SHA1

274d8fadc082bad379f72e459b6be282db079aee
SHA256

134067df9a813752b9551424bbd3d196e6bd695b5a991e2caaf6260b1f7f0075
SHA512

0fd2130f2f1ff2f276b93272e688d062429b3fe614525b6716a9ac797e8e240eb38bbfc6ae2ce9e3f01411175da63fc5eba7a0c3960e89a56f2c75f7f98746dc
SSDEEP

1536:1aO7qWmNYhwMLeOB4NGMciVOwRRl7hXXjp:1thwMVTiVOwRDdV

Score

8^/10

discovery exploit

Malware Config

Signatures

Possible privilege escalation attempt 2 IoCs
exploit

Processes:

takeown.exeicacls.exe

pid process

1376 takeown.exe
952 icacls.exe
Modifies file permissions 1 TTPs 2 IoCs
discovery

File Permissions Modification
T1222

Processes:

takeown.exeicacls.exe

pid process

1376 takeown.exe
952 icacls.exe

pid	process
1376	takeown.exe
952	icacls.exe

pid	process
1376	takeown.exe
952	icacls.exe

Drops file in System32 directory 2 IoCs

Processes:

134067df9a813752b9551424bbd3d196e6bd695b5a991e2caaf6260b1f7f0075.exe

description	ioc	process
File created	C:\Windows\SysWOW64\rwela.exe	134067df9a813752b9551424bbd3d196e6bd695b5a991e2caaf6260b1f7f0075.exe
File opened for modification	C:\Windows\SysWOW64\rwela.exe	134067df9a813752b9551424bbd3d196e6bd695b5a991e2caaf6260b1f7f0075.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

134067df9a813752b9551424bbd3d196e6bd695b5a991e2caaf6260b1f7f0075.exe

pid process

880 134067df9a813752b9551424bbd3d196e6bd695b5a991e2caaf6260b1f7f0075.exe

pid	process
880	134067df9a813752b9551424bbd3d196e6bd695b5a991e2caaf6260b1f7f0075.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

134067df9a813752b9551424bbd3d196e6bd695b5a991e2caaf6260b1f7f0075.exe

description	pid	process	target process
PID 880 wrote to memory of 1376	880	134067df9a813752b9551424bbd3d196e6bd695b5a991e2caaf6260b1f7f0075.exe	takeown.exe
PID 880 wrote to memory of 1376	880	134067df9a813752b9551424bbd3d196e6bd695b5a991e2caaf6260b1f7f0075.exe	takeown.exe
PID 880 wrote to memory of 1376	880	134067df9a813752b9551424bbd3d196e6bd695b5a991e2caaf6260b1f7f0075.exe	takeown.exe
PID 880 wrote to memory of 1376	880	134067df9a813752b9551424bbd3d196e6bd695b5a991e2caaf6260b1f7f0075.exe	takeown.exe
PID 880 wrote to memory of 952	880	134067df9a813752b9551424bbd3d196e6bd695b5a991e2caaf6260b1f7f0075.exe	icacls.exe
PID 880 wrote to memory of 952	880	134067df9a813752b9551424bbd3d196e6bd695b5a991e2caaf6260b1f7f0075.exe	icacls.exe
PID 880 wrote to memory of 952	880	134067df9a813752b9551424bbd3d196e6bd695b5a991e2caaf6260b1f7f0075.exe	icacls.exe
PID 880 wrote to memory of 952	880	134067df9a813752b9551424bbd3d196e6bd695b5a991e2caaf6260b1f7f0075.exe	icacls.exe

C:\Users\Admin\AppData\Local\Temp\134067df9a813752b9551424bbd3d196e6bd695b5a991e2caaf6260b1f7f0075.exe
"C:\Users\Admin\AppData\Local\Temp\134067df9a813752b9551424bbd3d196e6bd695b5a991e2caaf6260b1f7f0075.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:880

C:\Windows\SysWOW64\takeown.exe
C:\Windows\system32\takeown.exe /f "C:\Windows\system32\rwela.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1376

C:\Windows\SysWOW64\icacls.exe
C:\Windows\system32\icacls.exe "C:\Windows\system32\rwela.exe" /grant SYSTEM:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:952

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\rwela.exe
Filesize
72KB

MD5
0ce83cefec533da1b55a19fb5fbc5a91

SHA1
274d8fadc082bad379f72e459b6be282db079aee

SHA256
134067df9a813752b9551424bbd3d196e6bd695b5a991e2caaf6260b1f7f0075

SHA512
0fd2130f2f1ff2f276b93272e688d062429b3fe614525b6716a9ac797e8e240eb38bbfc6ae2ce9e3f01411175da63fc5eba7a0c3960e89a56f2c75f7f98746dc

Download Submit
memory/880-56-0x0000000075831000-0x0000000075833000-memory.dmp

Filesize
8KB

Download
memory/952-59-0x0000000000000000-mapping.dmp

Download
memory/1376-57-0x0000000000000000-mapping.dmp

Download