df86573c64678bd900892d28482ec70ae294246e1bed2f733a90449683b766cb

General

Target

df86573c64678bd900892d28482ec70ae294246e1bed2f733a90449683b766cb.exe
Size

40KB
MD5

4a95c8aef9c90609a132131aa2dab9d0
SHA1

884578a2619ebf1f9f377f1c294e8eb1c36ff672
SHA256

df86573c64678bd900892d28482ec70ae294246e1bed2f733a90449683b766cb
SHA512

b961d2afd8bb2321abda2b3779be6caac41c83babaa7513651a2c57b410c2e1df7fe6c5b5c087eb2d8f3ee2905a50cbf8a340d778297925971b415d2b7234eb0
SSDEEP

768:/dzRE/T8yBK7cjsNv6WauF3RRHKcxFxk0bc:/dFNcKbaPcxFxkyc

Score

8^/10

discovery exploit

Malware Config

Signatures

Possible privilege escalation attempt 8 IoCs
exploit

Processes:

takeown.exeicacls.exetakeown.exeicacls.exetakeown.exeicacls.exetakeown.exeicacls.exe

pid process

1452 takeown.exe
1764 icacls.exe
1348 takeown.exe
1380 icacls.exe
980 takeown.exe
1768 icacls.exe
1760 takeown.exe
788 icacls.exe
Modifies file permissions 1 TTPs 8 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

takeown.exeicacls.exetakeown.exeicacls.exetakeown.exeicacls.exetakeown.exeicacls.exe

pid process

1348 takeown.exe
1380 icacls.exe
980 takeown.exe
1768 icacls.exe
1760 takeown.exe
788 icacls.exe
1452 takeown.exe
1764 icacls.exe

pid	process
1452	takeown.exe
1764	icacls.exe
1348	takeown.exe
1380	icacls.exe
980	takeown.exe
1768	icacls.exe
1760	takeown.exe
788	icacls.exe

pid	process
1348	takeown.exe
1380	icacls.exe
980	takeown.exe
1768	icacls.exe
1760	takeown.exe
788	icacls.exe
1452	takeown.exe
1764	icacls.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

takeown.exetakeown.exetakeown.exetakeown.exe

description	pid	process
Token: SeTakeOwnershipPrivilege	1760	takeown.exe
Token: SeTakeOwnershipPrivilege	1452	takeown.exe
Token: SeTakeOwnershipPrivilege	1348	takeown.exe
Token: SeTakeOwnershipPrivilege	980	takeown.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

df86573c64678bd900892d28482ec70ae294246e1bed2f733a90449683b766cb.exe

pid process

1440 df86573c64678bd900892d28482ec70ae294246e1bed2f733a90449683b766cb.exe

pid	process
1440	df86573c64678bd900892d28482ec70ae294246e1bed2f733a90449683b766cb.exe

Suspicious use of WriteProcessMemory 32 IoCs

Processes:

df86573c64678bd900892d28482ec70ae294246e1bed2f733a90449683b766cb.exe

description	pid	process	target process
PID 1440 wrote to memory of 1760	1440	df86573c64678bd900892d28482ec70ae294246e1bed2f733a90449683b766cb.exe	takeown.exe
PID 1440 wrote to memory of 1760	1440	df86573c64678bd900892d28482ec70ae294246e1bed2f733a90449683b766cb.exe	takeown.exe
PID 1440 wrote to memory of 1760	1440	df86573c64678bd900892d28482ec70ae294246e1bed2f733a90449683b766cb.exe	takeown.exe
PID 1440 wrote to memory of 1760	1440	df86573c64678bd900892d28482ec70ae294246e1bed2f733a90449683b766cb.exe	takeown.exe
PID 1440 wrote to memory of 788	1440	df86573c64678bd900892d28482ec70ae294246e1bed2f733a90449683b766cb.exe	icacls.exe
PID 1440 wrote to memory of 788	1440	df86573c64678bd900892d28482ec70ae294246e1bed2f733a90449683b766cb.exe	icacls.exe
PID 1440 wrote to memory of 788	1440	df86573c64678bd900892d28482ec70ae294246e1bed2f733a90449683b766cb.exe	icacls.exe
PID 1440 wrote to memory of 788	1440	df86573c64678bd900892d28482ec70ae294246e1bed2f733a90449683b766cb.exe	icacls.exe
PID 1440 wrote to memory of 1452	1440	df86573c64678bd900892d28482ec70ae294246e1bed2f733a90449683b766cb.exe	takeown.exe
PID 1440 wrote to memory of 1452	1440	df86573c64678bd900892d28482ec70ae294246e1bed2f733a90449683b766cb.exe	takeown.exe
PID 1440 wrote to memory of 1452	1440	df86573c64678bd900892d28482ec70ae294246e1bed2f733a90449683b766cb.exe	takeown.exe
PID 1440 wrote to memory of 1452	1440	df86573c64678bd900892d28482ec70ae294246e1bed2f733a90449683b766cb.exe	takeown.exe
PID 1440 wrote to memory of 1764	1440	df86573c64678bd900892d28482ec70ae294246e1bed2f733a90449683b766cb.exe	icacls.exe
PID 1440 wrote to memory of 1764	1440	df86573c64678bd900892d28482ec70ae294246e1bed2f733a90449683b766cb.exe	icacls.exe
PID 1440 wrote to memory of 1764	1440	df86573c64678bd900892d28482ec70ae294246e1bed2f733a90449683b766cb.exe	icacls.exe
PID 1440 wrote to memory of 1764	1440	df86573c64678bd900892d28482ec70ae294246e1bed2f733a90449683b766cb.exe	icacls.exe
PID 1440 wrote to memory of 1348	1440	df86573c64678bd900892d28482ec70ae294246e1bed2f733a90449683b766cb.exe	takeown.exe
PID 1440 wrote to memory of 1348	1440	df86573c64678bd900892d28482ec70ae294246e1bed2f733a90449683b766cb.exe	takeown.exe
PID 1440 wrote to memory of 1348	1440	df86573c64678bd900892d28482ec70ae294246e1bed2f733a90449683b766cb.exe	takeown.exe
PID 1440 wrote to memory of 1348	1440	df86573c64678bd900892d28482ec70ae294246e1bed2f733a90449683b766cb.exe	takeown.exe
PID 1440 wrote to memory of 1380	1440	df86573c64678bd900892d28482ec70ae294246e1bed2f733a90449683b766cb.exe	icacls.exe
PID 1440 wrote to memory of 1380	1440	df86573c64678bd900892d28482ec70ae294246e1bed2f733a90449683b766cb.exe	icacls.exe
PID 1440 wrote to memory of 1380	1440	df86573c64678bd900892d28482ec70ae294246e1bed2f733a90449683b766cb.exe	icacls.exe
PID 1440 wrote to memory of 1380	1440	df86573c64678bd900892d28482ec70ae294246e1bed2f733a90449683b766cb.exe	icacls.exe
PID 1440 wrote to memory of 980	1440	df86573c64678bd900892d28482ec70ae294246e1bed2f733a90449683b766cb.exe	takeown.exe
PID 1440 wrote to memory of 980	1440	df86573c64678bd900892d28482ec70ae294246e1bed2f733a90449683b766cb.exe	takeown.exe
PID 1440 wrote to memory of 980	1440	df86573c64678bd900892d28482ec70ae294246e1bed2f733a90449683b766cb.exe	takeown.exe
PID 1440 wrote to memory of 980	1440	df86573c64678bd900892d28482ec70ae294246e1bed2f733a90449683b766cb.exe	takeown.exe
PID 1440 wrote to memory of 1768	1440	df86573c64678bd900892d28482ec70ae294246e1bed2f733a90449683b766cb.exe	icacls.exe
PID 1440 wrote to memory of 1768	1440	df86573c64678bd900892d28482ec70ae294246e1bed2f733a90449683b766cb.exe	icacls.exe
PID 1440 wrote to memory of 1768	1440	df86573c64678bd900892d28482ec70ae294246e1bed2f733a90449683b766cb.exe	icacls.exe
PID 1440 wrote to memory of 1768	1440	df86573c64678bd900892d28482ec70ae294246e1bed2f733a90449683b766cb.exe	icacls.exe

C:\Users\Admin\AppData\Local\Temp\df86573c64678bd900892d28482ec70ae294246e1bed2f733a90449683b766cb.exe
"C:\Users\Admin\AppData\Local\Temp\df86573c64678bd900892d28482ec70ae294246e1bed2f733a90449683b766cb.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1440

C:\Windows\SysWOW64\takeown.exe
C:\Windows\System32\takeown.exe /f "C:\Windows\System32\cmd.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:1760

C:\Windows\SysWOW64\icacls.exe
C:\Windows\System32\icacls.exe "C:\Windows\System32\cmd.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:788

C:\Windows\SysWOW64\takeown.exe
C:\Windows\System32\takeown.exe /f "C:\Windows\System32\ftp.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:1452

C:\Windows\SysWOW64\icacls.exe
C:\Windows\System32\icacls.exe "C:\Windows\System32\ftp.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1764

C:\Windows\SysWOW64\takeown.exe
C:\Windows\System32\takeown.exe /f "C:\Windows\System32\wscript.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:1348

C:\Windows\SysWOW64\icacls.exe
C:\Windows\System32\icacls.exe "C:\Windows\System32\wscript.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1380

C:\Windows\SysWOW64\takeown.exe
C:\Windows\System32\takeown.exe /f "C:\Windows\System32\cscript.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:980

C:\Windows\SysWOW64\icacls.exe
C:\Windows\System32\icacls.exe "C:\Windows\System32\cscript.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1768

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

1

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/788-57-0x0000000000000000-mapping.dmp

Download
memory/980-62-0x0000000000000000-mapping.dmp

Download
memory/1348-60-0x0000000000000000-mapping.dmp

Download
memory/1380-61-0x0000000000000000-mapping.dmp

Download
memory/1452-58-0x0000000000000000-mapping.dmp

Download
memory/1760-56-0x0000000000000000-mapping.dmp

Download
memory/1764-59-0x0000000000000000-mapping.dmp

Download
memory/1768-63-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing