fb6d3d41280c25be02ea3ed2558d95c6f7b98355f40a5da3c69f614229fbec90

Analysis

max time kernel
17s
max time network
35s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
18-11-2022 23:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fb6d3d41280c25be02ea3ed2558d95c6f7b98355f40a5da3c69f614229fbec90.exe
Size

72KB
MD5

1c45e58b5a6ce9b89b93d95c496793c0
SHA1

8a2a081af94babcf2fabad9ffdeef6f350214634
SHA256

fb6d3d41280c25be02ea3ed2558d95c6f7b98355f40a5da3c69f614229fbec90
SHA512

6c3186aee4bebdd7aa3bb229ad6bd09166ac313d90beca11b1f5147732ceb4b6ea7598ed000089ef939dfb5342259a9646f23624885b5f26bf16fcfbfd19a946
SSDEEP

1536:lEXD1jNtuBJtRxXUfMLBeRjjaa18buWF:wrt6/bXUfMLBeBB1m

Score

8^/10

discovery exploit

Malware Config

Signatures

Possible privilege escalation attempt 2 IoCs
exploit

Processes:

takeown.exeicacls.exe

pid process

1544 takeown.exe
432 icacls.exe
Modifies file permissions 1 TTPs 2 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

takeown.exeicacls.exe

pid process

1544 takeown.exe
432 icacls.exe

pid	process
1544	takeown.exe
432	icacls.exe

pid	process
1544	takeown.exe
432	icacls.exe

Drops file in System32 directory 2 IoCs

Processes:

fb6d3d41280c25be02ea3ed2558d95c6f7b98355f40a5da3c69f614229fbec90.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\jawtm.exe	fb6d3d41280c25be02ea3ed2558d95c6f7b98355f40a5da3c69f614229fbec90.exe
File created	C:\Windows\SysWOW64\jawtm.exe	fb6d3d41280c25be02ea3ed2558d95c6f7b98355f40a5da3c69f614229fbec90.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

fb6d3d41280c25be02ea3ed2558d95c6f7b98355f40a5da3c69f614229fbec90.exe

pid process

1728 fb6d3d41280c25be02ea3ed2558d95c6f7b98355f40a5da3c69f614229fbec90.exe

pid	process
1728	fb6d3d41280c25be02ea3ed2558d95c6f7b98355f40a5da3c69f614229fbec90.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

fb6d3d41280c25be02ea3ed2558d95c6f7b98355f40a5da3c69f614229fbec90.exe

description	pid	process	target process
PID 1728 wrote to memory of 1544	1728	fb6d3d41280c25be02ea3ed2558d95c6f7b98355f40a5da3c69f614229fbec90.exe	takeown.exe
PID 1728 wrote to memory of 1544	1728	fb6d3d41280c25be02ea3ed2558d95c6f7b98355f40a5da3c69f614229fbec90.exe	takeown.exe
PID 1728 wrote to memory of 1544	1728	fb6d3d41280c25be02ea3ed2558d95c6f7b98355f40a5da3c69f614229fbec90.exe	takeown.exe
PID 1728 wrote to memory of 1544	1728	fb6d3d41280c25be02ea3ed2558d95c6f7b98355f40a5da3c69f614229fbec90.exe	takeown.exe
PID 1728 wrote to memory of 432	1728	fb6d3d41280c25be02ea3ed2558d95c6f7b98355f40a5da3c69f614229fbec90.exe	icacls.exe
PID 1728 wrote to memory of 432	1728	fb6d3d41280c25be02ea3ed2558d95c6f7b98355f40a5da3c69f614229fbec90.exe	icacls.exe
PID 1728 wrote to memory of 432	1728	fb6d3d41280c25be02ea3ed2558d95c6f7b98355f40a5da3c69f614229fbec90.exe	icacls.exe
PID 1728 wrote to memory of 432	1728	fb6d3d41280c25be02ea3ed2558d95c6f7b98355f40a5da3c69f614229fbec90.exe	icacls.exe

C:\Users\Admin\AppData\Local\Temp\fb6d3d41280c25be02ea3ed2558d95c6f7b98355f40a5da3c69f614229fbec90.exe
"C:\Users\Admin\AppData\Local\Temp\fb6d3d41280c25be02ea3ed2558d95c6f7b98355f40a5da3c69f614229fbec90.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1728

C:\Windows\SysWOW64\takeown.exe
C:\Windows\system32\takeown.exe /f "C:\Windows\system32\jawtm.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1544

C:\Windows\SysWOW64\icacls.exe
C:\Windows\system32\icacls.exe "C:\Windows\system32\jawtm.exe" /grant SYSTEM:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:432

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\jawtm.exe
Filesize
72KB

MD5
1c45e58b5a6ce9b89b93d95c496793c0

SHA1
8a2a081af94babcf2fabad9ffdeef6f350214634

SHA256
fb6d3d41280c25be02ea3ed2558d95c6f7b98355f40a5da3c69f614229fbec90

SHA512
6c3186aee4bebdd7aa3bb229ad6bd09166ac313d90beca11b1f5147732ceb4b6ea7598ed000089ef939dfb5342259a9646f23624885b5f26bf16fcfbfd19a946

Download Submit
memory/432-59-0x0000000000000000-mapping.dmp

Download
memory/1544-57-0x0000000000000000-mapping.dmp

Download
memory/1728-56-0x00000000759F1000-0x00000000759F3000-memory.dmp

Filesize
8KB

Download