df86573c64678bd900892d28482ec70ae294246e1bed2f733a90449683b766cb

General

Target

df86573c64678bd900892d28482ec70ae294246e1bed2f733a90449683b766cb.exe
Size

40KB
MD5

4a95c8aef9c90609a132131aa2dab9d0
SHA1

884578a2619ebf1f9f377f1c294e8eb1c36ff672
SHA256

df86573c64678bd900892d28482ec70ae294246e1bed2f733a90449683b766cb
SHA512

b961d2afd8bb2321abda2b3779be6caac41c83babaa7513651a2c57b410c2e1df7fe6c5b5c087eb2d8f3ee2905a50cbf8a340d778297925971b415d2b7234eb0
SSDEEP

768:/dzRE/T8yBK7cjsNv6WauF3RRHKcxFxk0bc:/dFNcKbaPcxFxkyc

Score

8^/10

discovery exploit

Malware Config

Signatures

Possible privilege escalation attempt 8 IoCs
exploit

Processes:

takeown.exeicacls.exetakeown.exetakeown.exeicacls.exeicacls.exetakeown.exeicacls.exe

pid process

8 takeown.exe
2144 icacls.exe
4248 takeown.exe
1704 takeown.exe
1840 icacls.exe
2340 icacls.exe
1424 takeown.exe
3416 icacls.exe
Modifies file permissions 1 TTPs 8 IoCs
discovery

File Permissions Modification
T1222

Processes:

takeown.exeicacls.exeicacls.exetakeown.exeicacls.exetakeown.exeicacls.exetakeown.exe

pid process

1704 takeown.exe
1840 icacls.exe
2340 icacls.exe
1424 takeown.exe
3416 icacls.exe
8 takeown.exe
2144 icacls.exe
4248 takeown.exe

pid	process
8	takeown.exe
2144	icacls.exe
4248	takeown.exe
1704	takeown.exe
1840	icacls.exe
2340	icacls.exe
1424	takeown.exe
3416	icacls.exe

pid	process
1704	takeown.exe
1840	icacls.exe
2340	icacls.exe
1424	takeown.exe
3416	icacls.exe
8	takeown.exe
2144	icacls.exe
4248	takeown.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

takeown.exetakeown.exetakeown.exetakeown.exe

description	pid	process
Token: SeTakeOwnershipPrivilege	1424	takeown.exe
Token: SeTakeOwnershipPrivilege	8	takeown.exe
Token: SeTakeOwnershipPrivilege	1704	takeown.exe
Token: SeTakeOwnershipPrivilege	4248	takeown.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

df86573c64678bd900892d28482ec70ae294246e1bed2f733a90449683b766cb.exe

pid process

2160 df86573c64678bd900892d28482ec70ae294246e1bed2f733a90449683b766cb.exe

pid	process
2160	df86573c64678bd900892d28482ec70ae294246e1bed2f733a90449683b766cb.exe

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

df86573c64678bd900892d28482ec70ae294246e1bed2f733a90449683b766cb.exe

description	pid	process	target process
PID 2160 wrote to memory of 1424	2160	df86573c64678bd900892d28482ec70ae294246e1bed2f733a90449683b766cb.exe	takeown.exe
PID 2160 wrote to memory of 1424	2160	df86573c64678bd900892d28482ec70ae294246e1bed2f733a90449683b766cb.exe	takeown.exe
PID 2160 wrote to memory of 1424	2160	df86573c64678bd900892d28482ec70ae294246e1bed2f733a90449683b766cb.exe	takeown.exe
PID 2160 wrote to memory of 2144	2160	df86573c64678bd900892d28482ec70ae294246e1bed2f733a90449683b766cb.exe	icacls.exe
PID 2160 wrote to memory of 2144	2160	df86573c64678bd900892d28482ec70ae294246e1bed2f733a90449683b766cb.exe	icacls.exe
PID 2160 wrote to memory of 2144	2160	df86573c64678bd900892d28482ec70ae294246e1bed2f733a90449683b766cb.exe	icacls.exe
PID 2160 wrote to memory of 8	2160	df86573c64678bd900892d28482ec70ae294246e1bed2f733a90449683b766cb.exe	takeown.exe
PID 2160 wrote to memory of 8	2160	df86573c64678bd900892d28482ec70ae294246e1bed2f733a90449683b766cb.exe	takeown.exe
PID 2160 wrote to memory of 8	2160	df86573c64678bd900892d28482ec70ae294246e1bed2f733a90449683b766cb.exe	takeown.exe
PID 2160 wrote to memory of 3416	2160	df86573c64678bd900892d28482ec70ae294246e1bed2f733a90449683b766cb.exe	icacls.exe
PID 2160 wrote to memory of 3416	2160	df86573c64678bd900892d28482ec70ae294246e1bed2f733a90449683b766cb.exe	icacls.exe
PID 2160 wrote to memory of 3416	2160	df86573c64678bd900892d28482ec70ae294246e1bed2f733a90449683b766cb.exe	icacls.exe
PID 2160 wrote to memory of 4248	2160	df86573c64678bd900892d28482ec70ae294246e1bed2f733a90449683b766cb.exe	takeown.exe
PID 2160 wrote to memory of 4248	2160	df86573c64678bd900892d28482ec70ae294246e1bed2f733a90449683b766cb.exe	takeown.exe
PID 2160 wrote to memory of 4248	2160	df86573c64678bd900892d28482ec70ae294246e1bed2f733a90449683b766cb.exe	takeown.exe
PID 2160 wrote to memory of 2340	2160	df86573c64678bd900892d28482ec70ae294246e1bed2f733a90449683b766cb.exe	icacls.exe
PID 2160 wrote to memory of 2340	2160	df86573c64678bd900892d28482ec70ae294246e1bed2f733a90449683b766cb.exe	icacls.exe
PID 2160 wrote to memory of 2340	2160	df86573c64678bd900892d28482ec70ae294246e1bed2f733a90449683b766cb.exe	icacls.exe
PID 2160 wrote to memory of 1704	2160	df86573c64678bd900892d28482ec70ae294246e1bed2f733a90449683b766cb.exe	takeown.exe
PID 2160 wrote to memory of 1704	2160	df86573c64678bd900892d28482ec70ae294246e1bed2f733a90449683b766cb.exe	takeown.exe
PID 2160 wrote to memory of 1704	2160	df86573c64678bd900892d28482ec70ae294246e1bed2f733a90449683b766cb.exe	takeown.exe
PID 2160 wrote to memory of 1840	2160	df86573c64678bd900892d28482ec70ae294246e1bed2f733a90449683b766cb.exe	icacls.exe
PID 2160 wrote to memory of 1840	2160	df86573c64678bd900892d28482ec70ae294246e1bed2f733a90449683b766cb.exe	icacls.exe
PID 2160 wrote to memory of 1840	2160	df86573c64678bd900892d28482ec70ae294246e1bed2f733a90449683b766cb.exe	icacls.exe

C:\Users\Admin\AppData\Local\Temp\df86573c64678bd900892d28482ec70ae294246e1bed2f733a90449683b766cb.exe
"C:\Users\Admin\AppData\Local\Temp\df86573c64678bd900892d28482ec70ae294246e1bed2f733a90449683b766cb.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2160

C:\Windows\SysWOW64\takeown.exe
C:\Windows\System32\takeown.exe /f "C:\Windows\System32\cmd.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:1424

C:\Windows\SysWOW64\icacls.exe
C:\Windows\System32\icacls.exe "C:\Windows\System32\ftp.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:3416

C:\Windows\SysWOW64\takeown.exe
C:\Windows\System32\takeown.exe /f "C:\Windows\System32\ftp.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:8

C:\Windows\SysWOW64\icacls.exe
C:\Windows\System32\icacls.exe "C:\Windows\System32\cmd.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:2144

C:\Windows\SysWOW64\takeown.exe
C:\Windows\System32\takeown.exe /f "C:\Windows\System32\wscript.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:4248

C:\Windows\SysWOW64\takeown.exe
C:\Windows\System32\takeown.exe /f "C:\Windows\System32\cscript.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:1704

C:\Windows\SysWOW64\icacls.exe
C:\Windows\System32\icacls.exe "C:\Windows\System32\cscript.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1840

C:\Windows\SysWOW64\icacls.exe
C:\Windows\System32\icacls.exe "C:\Windows\System32\wscript.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:2340

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File Permissions Modification

1

T1222

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/8-136-0x0000000000000000-mapping.dmp

Download
memory/1424-134-0x0000000000000000-mapping.dmp

Download
memory/1704-140-0x0000000000000000-mapping.dmp

Download
memory/1840-141-0x0000000000000000-mapping.dmp

Download
memory/2144-135-0x0000000000000000-mapping.dmp

Download
memory/2340-139-0x0000000000000000-mapping.dmp

Download
memory/3416-137-0x0000000000000000-mapping.dmp

Download
memory/4248-138-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing