e30abbb5be0e4ac88c89999c7998751643ef37465bb606a59c11f414807e57b1

General

Target

e30abbb5be0e4ac88c89999c7998751643ef37465bb606a59c11f414807e57b1.exe
Size

56KB
MD5

0b7be4f2a06ae6e94bfe0c22c5d2caa0
SHA1

1ea53253d49c572fd424a05c5f3b820c3bdb27ea
SHA256

e30abbb5be0e4ac88c89999c7998751643ef37465bb606a59c11f414807e57b1
SHA512

4f0fd990fad84dfcbbe02ea0fa01843f738bd3ce29ed42c4519d519000fe65cce4c5877ec9ebd30130b2675fa98beb5b93060551d520a1b0ad6e263b9717a0ad
SSDEEP

768:napMKCYujBxfs2J4+5dpw8k8EcsXpIoPIog4z27eIgubraBUyj7z7p2TNeoKmsKd:nGMbX8ssI5puPC

Score

8^/10

discovery exploit

Malware Config

Signatures

Possible privilege escalation attempt 14 IoCs

exploit

Processes:

icacls.exetakeown.exeicacls.exetakeown.exeicacls.exetakeown.exetakeown.exeicacls.exeicacls.exetakeown.exeicacls.exeicacls.exeicacls.exeicacls.exe

pid	process
1796	icacls.exe
4072	takeown.exe
4220	icacls.exe
3276	takeown.exe
3108	icacls.exe
3592	takeown.exe
3880	takeown.exe
1200	icacls.exe
3472	icacls.exe
4376	takeown.exe
3940	icacls.exe
4184	icacls.exe
4392	icacls.exe
4204	icacls.exe

Modifies file permissions 1 TTPs 14 IoCs

discovery

File and Directory Permissions Modification

T1222

Processes:

icacls.exetakeown.exetakeown.exetakeown.exetakeown.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exetakeown.exeicacls.exeicacls.exe

pid	process
4184	icacls.exe
3276	takeown.exe
4072	takeown.exe
3592	takeown.exe
3880	takeown.exe
3940	icacls.exe
4392	icacls.exe
4220	icacls.exe
1796	icacls.exe
1200	icacls.exe
3472	icacls.exe
4376	takeown.exe
3108	icacls.exe
4204	icacls.exe

Drops file in System32 directory 6 IoCs

Processes:

e30abbb5be0e4ac88c89999c7998751643ef37465bb606a59c11f414807e57b1.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\ftp.exe	e30abbb5be0e4ac88c89999c7998751643ef37465bb606a59c11f414807e57b1.exe
File opened for modification	C:\Windows\SysWOW64\wscript.exe	e30abbb5be0e4ac88c89999c7998751643ef37465bb606a59c11f414807e57b1.exe
File opened for modification	C:\Windows\SysWOW64\cscript.exe	e30abbb5be0e4ac88c89999c7998751643ef37465bb606a59c11f414807e57b1.exe
File created	\??\c:\windows\SysWOW64\ktbg.exe	e30abbb5be0e4ac88c89999c7998751643ef37465bb606a59c11f414807e57b1.exe
File opened for modification	\??\c:\windows\SysWOW64\ktbg.exe	e30abbb5be0e4ac88c89999c7998751643ef37465bb606a59c11f414807e57b1.exe
File opened for modification	C:\Windows\SysWOW64\cmd.exe	e30abbb5be0e4ac88c89999c7998751643ef37465bb606a59c11f414807e57b1.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

takeown.exetakeown.exetakeown.exetakeown.exe

description	pid	process
Token: SeTakeOwnershipPrivilege	3880	takeown.exe
Token: SeTakeOwnershipPrivilege	4072	takeown.exe
Token: SeTakeOwnershipPrivilege	4376	takeown.exe
Token: SeTakeOwnershipPrivilege	3592	takeown.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

e30abbb5be0e4ac88c89999c7998751643ef37465bb606a59c11f414807e57b1.exe

pid process

2164 e30abbb5be0e4ac88c89999c7998751643ef37465bb606a59c11f414807e57b1.exe

pid	process
2164	e30abbb5be0e4ac88c89999c7998751643ef37465bb606a59c11f414807e57b1.exe

Suspicious use of WriteProcessMemory 42 IoCs

Processes:

e30abbb5be0e4ac88c89999c7998751643ef37465bb606a59c11f414807e57b1.exe

description	pid	process	target process
PID 2164 wrote to memory of 3276	2164	e30abbb5be0e4ac88c89999c7998751643ef37465bb606a59c11f414807e57b1.exe	takeown.exe
PID 2164 wrote to memory of 3276	2164	e30abbb5be0e4ac88c89999c7998751643ef37465bb606a59c11f414807e57b1.exe	takeown.exe
PID 2164 wrote to memory of 3276	2164	e30abbb5be0e4ac88c89999c7998751643ef37465bb606a59c11f414807e57b1.exe	takeown.exe
PID 2164 wrote to memory of 1796	2164	e30abbb5be0e4ac88c89999c7998751643ef37465bb606a59c11f414807e57b1.exe	icacls.exe
PID 2164 wrote to memory of 1796	2164	e30abbb5be0e4ac88c89999c7998751643ef37465bb606a59c11f414807e57b1.exe	icacls.exe
PID 2164 wrote to memory of 1796	2164	e30abbb5be0e4ac88c89999c7998751643ef37465bb606a59c11f414807e57b1.exe	icacls.exe
PID 2164 wrote to memory of 3880	2164	e30abbb5be0e4ac88c89999c7998751643ef37465bb606a59c11f414807e57b1.exe	takeown.exe
PID 2164 wrote to memory of 3880	2164	e30abbb5be0e4ac88c89999c7998751643ef37465bb606a59c11f414807e57b1.exe	takeown.exe
PID 2164 wrote to memory of 3880	2164	e30abbb5be0e4ac88c89999c7998751643ef37465bb606a59c11f414807e57b1.exe	takeown.exe
PID 2164 wrote to memory of 3472	2164	e30abbb5be0e4ac88c89999c7998751643ef37465bb606a59c11f414807e57b1.exe	icacls.exe
PID 2164 wrote to memory of 3472	2164	e30abbb5be0e4ac88c89999c7998751643ef37465bb606a59c11f414807e57b1.exe	icacls.exe
PID 2164 wrote to memory of 3472	2164	e30abbb5be0e4ac88c89999c7998751643ef37465bb606a59c11f414807e57b1.exe	icacls.exe
PID 2164 wrote to memory of 1200	2164	e30abbb5be0e4ac88c89999c7998751643ef37465bb606a59c11f414807e57b1.exe	icacls.exe
PID 2164 wrote to memory of 1200	2164	e30abbb5be0e4ac88c89999c7998751643ef37465bb606a59c11f414807e57b1.exe	icacls.exe
PID 2164 wrote to memory of 1200	2164	e30abbb5be0e4ac88c89999c7998751643ef37465bb606a59c11f414807e57b1.exe	icacls.exe
PID 2164 wrote to memory of 4072	2164	e30abbb5be0e4ac88c89999c7998751643ef37465bb606a59c11f414807e57b1.exe	takeown.exe
PID 2164 wrote to memory of 4072	2164	e30abbb5be0e4ac88c89999c7998751643ef37465bb606a59c11f414807e57b1.exe	takeown.exe
PID 2164 wrote to memory of 4072	2164	e30abbb5be0e4ac88c89999c7998751643ef37465bb606a59c11f414807e57b1.exe	takeown.exe
PID 2164 wrote to memory of 3940	2164	e30abbb5be0e4ac88c89999c7998751643ef37465bb606a59c11f414807e57b1.exe	icacls.exe
PID 2164 wrote to memory of 3940	2164	e30abbb5be0e4ac88c89999c7998751643ef37465bb606a59c11f414807e57b1.exe	icacls.exe
PID 2164 wrote to memory of 3940	2164	e30abbb5be0e4ac88c89999c7998751643ef37465bb606a59c11f414807e57b1.exe	icacls.exe
PID 2164 wrote to memory of 4184	2164	e30abbb5be0e4ac88c89999c7998751643ef37465bb606a59c11f414807e57b1.exe	icacls.exe
PID 2164 wrote to memory of 4184	2164	e30abbb5be0e4ac88c89999c7998751643ef37465bb606a59c11f414807e57b1.exe	icacls.exe
PID 2164 wrote to memory of 4184	2164	e30abbb5be0e4ac88c89999c7998751643ef37465bb606a59c11f414807e57b1.exe	icacls.exe
PID 2164 wrote to memory of 4376	2164	e30abbb5be0e4ac88c89999c7998751643ef37465bb606a59c11f414807e57b1.exe	takeown.exe
PID 2164 wrote to memory of 4376	2164	e30abbb5be0e4ac88c89999c7998751643ef37465bb606a59c11f414807e57b1.exe	takeown.exe
PID 2164 wrote to memory of 4376	2164	e30abbb5be0e4ac88c89999c7998751643ef37465bb606a59c11f414807e57b1.exe	takeown.exe
PID 2164 wrote to memory of 3108	2164	e30abbb5be0e4ac88c89999c7998751643ef37465bb606a59c11f414807e57b1.exe	icacls.exe
PID 2164 wrote to memory of 3108	2164	e30abbb5be0e4ac88c89999c7998751643ef37465bb606a59c11f414807e57b1.exe	icacls.exe
PID 2164 wrote to memory of 3108	2164	e30abbb5be0e4ac88c89999c7998751643ef37465bb606a59c11f414807e57b1.exe	icacls.exe
PID 2164 wrote to memory of 4392	2164	e30abbb5be0e4ac88c89999c7998751643ef37465bb606a59c11f414807e57b1.exe	icacls.exe
PID 2164 wrote to memory of 4392	2164	e30abbb5be0e4ac88c89999c7998751643ef37465bb606a59c11f414807e57b1.exe	icacls.exe
PID 2164 wrote to memory of 4392	2164	e30abbb5be0e4ac88c89999c7998751643ef37465bb606a59c11f414807e57b1.exe	icacls.exe
PID 2164 wrote to memory of 3592	2164	e30abbb5be0e4ac88c89999c7998751643ef37465bb606a59c11f414807e57b1.exe	takeown.exe
PID 2164 wrote to memory of 3592	2164	e30abbb5be0e4ac88c89999c7998751643ef37465bb606a59c11f414807e57b1.exe	takeown.exe
PID 2164 wrote to memory of 3592	2164	e30abbb5be0e4ac88c89999c7998751643ef37465bb606a59c11f414807e57b1.exe	takeown.exe
PID 2164 wrote to memory of 4220	2164	e30abbb5be0e4ac88c89999c7998751643ef37465bb606a59c11f414807e57b1.exe	icacls.exe
PID 2164 wrote to memory of 4220	2164	e30abbb5be0e4ac88c89999c7998751643ef37465bb606a59c11f414807e57b1.exe	icacls.exe
PID 2164 wrote to memory of 4220	2164	e30abbb5be0e4ac88c89999c7998751643ef37465bb606a59c11f414807e57b1.exe	icacls.exe
PID 2164 wrote to memory of 4204	2164	e30abbb5be0e4ac88c89999c7998751643ef37465bb606a59c11f414807e57b1.exe	icacls.exe
PID 2164 wrote to memory of 4204	2164	e30abbb5be0e4ac88c89999c7998751643ef37465bb606a59c11f414807e57b1.exe	icacls.exe
PID 2164 wrote to memory of 4204	2164	e30abbb5be0e4ac88c89999c7998751643ef37465bb606a59c11f414807e57b1.exe	icacls.exe

C:\Users\Admin\AppData\Local\Temp\e30abbb5be0e4ac88c89999c7998751643ef37465bb606a59c11f414807e57b1.exe
"C:\Users\Admin\AppData\Local\Temp\e30abbb5be0e4ac88c89999c7998751643ef37465bb606a59c11f414807e57b1.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2164

C:\Windows\SysWOW64\takeown.exe
C:\Windows\system32\takeown.exe /f "c:\windows\system32\ktbg.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:3276

C:\Windows\SysWOW64\icacls.exe
C:\Windows\system32\icacls.exe "c:\windows\system32\ktbg.exe" /grant SYSTEM:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1796

C:\Windows\SysWOW64\takeown.exe
C:\Windows\system32\takeown.exe /f "C:\Windows\System32\cmd.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:3880

C:\Windows\SysWOW64\icacls.exe
C:\Windows\system32\icacls.exe "C:\Windows\System32\cmd.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1200

C:\Windows\SysWOW64\icacls.exe
C:\Windows\system32\icacls.exe "C:\Windows\System32\cmd.exe" /grant SYSTEM:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:3472

C:\Windows\SysWOW64\takeown.exe
C:\Windows\system32\takeown.exe /f "C:\Windows\System32\ftp.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:4072

C:\Windows\SysWOW64\icacls.exe
C:\Windows\system32\icacls.exe "C:\Windows\System32\ftp.exe" /grant SYSTEM:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:3940

C:\Windows\SysWOW64\icacls.exe
C:\Windows\system32\icacls.exe "C:\Windows\System32\ftp.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:4184

C:\Windows\SysWOW64\takeown.exe
C:\Windows\system32\takeown.exe /f "C:\Windows\System32\wscript.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:4376

C:\Windows\SysWOW64\icacls.exe
C:\Windows\system32\icacls.exe "C:\Windows\System32\wscript.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:4392

C:\Windows\SysWOW64\icacls.exe
C:\Windows\system32\icacls.exe "C:\Windows\System32\wscript.exe" /grant SYSTEM:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:3108

C:\Windows\SysWOW64\takeown.exe
C:\Windows\system32\takeown.exe /f "C:\Windows\System32\cscript.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:3592

C:\Windows\SysWOW64\icacls.exe
C:\Windows\system32\icacls.exe "C:\Windows\System32\cscript.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:4204

C:\Windows\SysWOW64\icacls.exe
C:\Windows\system32\icacls.exe "C:\Windows\System32\cscript.exe" /grant SYSTEM:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:4220

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

1

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\??\c:\windows\SysWOW64\ktbg.exe

Filesize
56KB

MD5
0b7be4f2a06ae6e94bfe0c22c5d2caa0

SHA1
1ea53253d49c572fd424a05c5f3b820c3bdb27ea

SHA256
e30abbb5be0e4ac88c89999c7998751643ef37465bb606a59c11f414807e57b1

SHA512
4f0fd990fad84dfcbbe02ea0fa01843f738bd3ce29ed42c4519d519000fe65cce4c5877ec9ebd30130b2675fa98beb5b93060551d520a1b0ad6e263b9717a0ad

Download Submit
memory/1200-139-0x0000000000000000-mapping.dmp

Download
memory/1796-135-0x0000000000000000-mapping.dmp

Download
memory/3108-144-0x0000000000000000-mapping.dmp

Download
memory/3276-134-0x0000000000000000-mapping.dmp

Download
memory/3472-138-0x0000000000000000-mapping.dmp

Download
memory/3592-146-0x0000000000000000-mapping.dmp

Download
memory/3880-137-0x0000000000000000-mapping.dmp

Download
memory/3940-141-0x0000000000000000-mapping.dmp

Download
memory/4072-140-0x0000000000000000-mapping.dmp

Download
memory/4184-142-0x0000000000000000-mapping.dmp

Download
memory/4204-148-0x0000000000000000-mapping.dmp

Download
memory/4220-147-0x0000000000000000-mapping.dmp

Download
memory/4376-143-0x0000000000000000-mapping.dmp

Download
memory/4392-145-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads