0aec93146603f0f0c0ef5bc074c34f17491bb477416a5c3acf09065ca8accea0

Analysis

max time kernel
45s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
08-11-2022 09:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0aec93146603f0f0c0ef5bc074c34f17491bb477416a5c3acf09065ca8accea0.exe
Size

68KB
MD5

0ea23ae31c365f335d8f7ae2bd9102e0
SHA1

55ec98cf8e28a6bb9466110d7011d8047fe4fc9e
SHA256

0aec93146603f0f0c0ef5bc074c34f17491bb477416a5c3acf09065ca8accea0
SHA512

edfee3213aa9a6edc2b52012833f256bc5a4b6e2ab9667e2b2843a49cd7da2c6ecce897e9c3442dc91282de340cae351ce72f7296bdd7455ce56949a910759ee
SSDEEP

768:LePg5Ixbki+FsefB9hehPMsmpeh+VZxuLifUBpbDci0Wh1GeZ6Z6jr0FyRWvp4u7:LACFONMN1ZxuLnt6cjrAXOdSeRW

Score

8^/10

discovery exploit

Malware Config

Signatures

Possible privilege escalation attempt 2 IoCs
exploit

Processes:

takeown.exeicacls.exe

pid process

1688 takeown.exe
1376 icacls.exe
Modifies file permissions 1 TTPs 2 IoCs
discovery

File Permissions Modification
T1222

Processes:

takeown.exeicacls.exe

pid process

1688 takeown.exe
1376 icacls.exe

pid	process
1688	takeown.exe
1376	icacls.exe

pid	process
1688	takeown.exe
1376	icacls.exe

Drops file in System32 directory 2 IoCs

Processes:

0aec93146603f0f0c0ef5bc074c34f17491bb477416a5c3acf09065ca8accea0.exe

description	ioc	process
File created	C:\Windows\SysWOW64\rzfdq.exe	0aec93146603f0f0c0ef5bc074c34f17491bb477416a5c3acf09065ca8accea0.exe
File opened for modification	C:\Windows\SysWOW64\rzfdq.exe	0aec93146603f0f0c0ef5bc074c34f17491bb477416a5c3acf09065ca8accea0.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

0aec93146603f0f0c0ef5bc074c34f17491bb477416a5c3acf09065ca8accea0.exe

pid process

1468 0aec93146603f0f0c0ef5bc074c34f17491bb477416a5c3acf09065ca8accea0.exe

pid	process
1468	0aec93146603f0f0c0ef5bc074c34f17491bb477416a5c3acf09065ca8accea0.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

0aec93146603f0f0c0ef5bc074c34f17491bb477416a5c3acf09065ca8accea0.exe

description	pid	process	target process
PID 1468 wrote to memory of 1688	1468	0aec93146603f0f0c0ef5bc074c34f17491bb477416a5c3acf09065ca8accea0.exe	takeown.exe
PID 1468 wrote to memory of 1688	1468	0aec93146603f0f0c0ef5bc074c34f17491bb477416a5c3acf09065ca8accea0.exe	takeown.exe
PID 1468 wrote to memory of 1688	1468	0aec93146603f0f0c0ef5bc074c34f17491bb477416a5c3acf09065ca8accea0.exe	takeown.exe
PID 1468 wrote to memory of 1688	1468	0aec93146603f0f0c0ef5bc074c34f17491bb477416a5c3acf09065ca8accea0.exe	takeown.exe
PID 1468 wrote to memory of 1376	1468	0aec93146603f0f0c0ef5bc074c34f17491bb477416a5c3acf09065ca8accea0.exe	icacls.exe
PID 1468 wrote to memory of 1376	1468	0aec93146603f0f0c0ef5bc074c34f17491bb477416a5c3acf09065ca8accea0.exe	icacls.exe
PID 1468 wrote to memory of 1376	1468	0aec93146603f0f0c0ef5bc074c34f17491bb477416a5c3acf09065ca8accea0.exe	icacls.exe
PID 1468 wrote to memory of 1376	1468	0aec93146603f0f0c0ef5bc074c34f17491bb477416a5c3acf09065ca8accea0.exe	icacls.exe

C:\Users\Admin\AppData\Local\Temp\0aec93146603f0f0c0ef5bc074c34f17491bb477416a5c3acf09065ca8accea0.exe
"C:\Users\Admin\AppData\Local\Temp\0aec93146603f0f0c0ef5bc074c34f17491bb477416a5c3acf09065ca8accea0.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1468

C:\Windows\SysWOW64\takeown.exe
C:\Windows\system32\takeown.exe /f "C:\Windows\system32\rzfdq.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1688

C:\Windows\SysWOW64\icacls.exe
C:\Windows\system32\icacls.exe "C:\Windows\system32\rzfdq.exe" /grant SYSTEM:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1376

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\rzfdq.exe
Filesize
68KB

MD5
0ea23ae31c365f335d8f7ae2bd9102e0

SHA1
55ec98cf8e28a6bb9466110d7011d8047fe4fc9e

SHA256
0aec93146603f0f0c0ef5bc074c34f17491bb477416a5c3acf09065ca8accea0

SHA512
edfee3213aa9a6edc2b52012833f256bc5a4b6e2ab9667e2b2843a49cd7da2c6ecce897e9c3442dc91282de340cae351ce72f7296bdd7455ce56949a910759ee

Download Submit
memory/1376-59-0x0000000000000000-mapping.dmp

Download
memory/1468-56-0x0000000076BA1000-0x0000000076BA3000-memory.dmp

Filesize
8KB

Download
memory/1688-57-0x0000000000000000-mapping.dmp

Download