6ce97fcf349275a6d4c4ed9ff6c80f40d70c3c1fb7cd410d147d831eeacd3a2d

General

Target

6ce97fcf349275a6d4c4ed9ff6c80f40d70c3c1fb7cd410d147d831eeacd3a2d.exe
Size

40KB
MD5

4ca93c3705fcd67739a69cb13decf510
SHA1

ae727231dee8fe009e675c0ee87c9598a0835910
SHA256

6ce97fcf349275a6d4c4ed9ff6c80f40d70c3c1fb7cd410d147d831eeacd3a2d
SHA512

7ef5e5e3eb454ffda8a258e0ac0eb4c07a756e534565165fe3696b462a11d5384adbd067d71298ca84efdbe199302c83be1181208c560d12e756855976f0a7d5
SSDEEP

384:/Tg5JPGmKafMP2n5NYm0KssnniZNNXb+4nl+A4p8T/4TYRxIfOMMCmUDbAYIbYYo:/6JPGPen5hVIN06T/4OIffNd

Score

8^/10

discovery exploit

Malware Config

Signatures

Possible privilege escalation attempt 8 IoCs
exploit

Processes:

takeown.exeicacls.exetakeown.exeicacls.exetakeown.exeicacls.exetakeown.exeicacls.exe

pid process

956 takeown.exe
1908 icacls.exe
972 takeown.exe
1820 icacls.exe
1556 takeown.exe
1284 icacls.exe
304 takeown.exe
1676 icacls.exe
Modifies file permissions 1 TTPs 8 IoCs
discovery

File Permissions Modification
T1222

Processes:

takeown.exeicacls.exetakeown.exeicacls.exetakeown.exeicacls.exetakeown.exeicacls.exe

pid process

972 takeown.exe
1820 icacls.exe
1556 takeown.exe
1284 icacls.exe
304 takeown.exe
1676 icacls.exe
956 takeown.exe
1908 icacls.exe

pid	process
956	takeown.exe
1908	icacls.exe
972	takeown.exe
1820	icacls.exe
1556	takeown.exe
1284	icacls.exe
304	takeown.exe
1676	icacls.exe

pid	process
972	takeown.exe
1820	icacls.exe
1556	takeown.exe
1284	icacls.exe
304	takeown.exe
1676	icacls.exe
956	takeown.exe
1908	icacls.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

takeown.exetakeown.exetakeown.exetakeown.exe

description	pid	process
Token: SeTakeOwnershipPrivilege	1556	takeown.exe
Token: SeTakeOwnershipPrivilege	972	takeown.exe
Token: SeTakeOwnershipPrivilege	956	takeown.exe
Token: SeTakeOwnershipPrivilege	304	takeown.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

6ce97fcf349275a6d4c4ed9ff6c80f40d70c3c1fb7cd410d147d831eeacd3a2d.exe

pid process

1348 6ce97fcf349275a6d4c4ed9ff6c80f40d70c3c1fb7cd410d147d831eeacd3a2d.exe

pid	process
1348	6ce97fcf349275a6d4c4ed9ff6c80f40d70c3c1fb7cd410d147d831eeacd3a2d.exe

Suspicious use of WriteProcessMemory 32 IoCs

Processes:

6ce97fcf349275a6d4c4ed9ff6c80f40d70c3c1fb7cd410d147d831eeacd3a2d.exe

description	pid	process	target process
PID 1348 wrote to memory of 1556	1348	6ce97fcf349275a6d4c4ed9ff6c80f40d70c3c1fb7cd410d147d831eeacd3a2d.exe	takeown.exe
PID 1348 wrote to memory of 1556	1348	6ce97fcf349275a6d4c4ed9ff6c80f40d70c3c1fb7cd410d147d831eeacd3a2d.exe	takeown.exe
PID 1348 wrote to memory of 1556	1348	6ce97fcf349275a6d4c4ed9ff6c80f40d70c3c1fb7cd410d147d831eeacd3a2d.exe	takeown.exe
PID 1348 wrote to memory of 1556	1348	6ce97fcf349275a6d4c4ed9ff6c80f40d70c3c1fb7cd410d147d831eeacd3a2d.exe	takeown.exe
PID 1348 wrote to memory of 1284	1348	6ce97fcf349275a6d4c4ed9ff6c80f40d70c3c1fb7cd410d147d831eeacd3a2d.exe	icacls.exe
PID 1348 wrote to memory of 1284	1348	6ce97fcf349275a6d4c4ed9ff6c80f40d70c3c1fb7cd410d147d831eeacd3a2d.exe	icacls.exe
PID 1348 wrote to memory of 1284	1348	6ce97fcf349275a6d4c4ed9ff6c80f40d70c3c1fb7cd410d147d831eeacd3a2d.exe	icacls.exe
PID 1348 wrote to memory of 1284	1348	6ce97fcf349275a6d4c4ed9ff6c80f40d70c3c1fb7cd410d147d831eeacd3a2d.exe	icacls.exe
PID 1348 wrote to memory of 304	1348	6ce97fcf349275a6d4c4ed9ff6c80f40d70c3c1fb7cd410d147d831eeacd3a2d.exe	takeown.exe
PID 1348 wrote to memory of 304	1348	6ce97fcf349275a6d4c4ed9ff6c80f40d70c3c1fb7cd410d147d831eeacd3a2d.exe	takeown.exe
PID 1348 wrote to memory of 304	1348	6ce97fcf349275a6d4c4ed9ff6c80f40d70c3c1fb7cd410d147d831eeacd3a2d.exe	takeown.exe
PID 1348 wrote to memory of 304	1348	6ce97fcf349275a6d4c4ed9ff6c80f40d70c3c1fb7cd410d147d831eeacd3a2d.exe	takeown.exe
PID 1348 wrote to memory of 1676	1348	6ce97fcf349275a6d4c4ed9ff6c80f40d70c3c1fb7cd410d147d831eeacd3a2d.exe	icacls.exe
PID 1348 wrote to memory of 1676	1348	6ce97fcf349275a6d4c4ed9ff6c80f40d70c3c1fb7cd410d147d831eeacd3a2d.exe	icacls.exe
PID 1348 wrote to memory of 1676	1348	6ce97fcf349275a6d4c4ed9ff6c80f40d70c3c1fb7cd410d147d831eeacd3a2d.exe	icacls.exe
PID 1348 wrote to memory of 1676	1348	6ce97fcf349275a6d4c4ed9ff6c80f40d70c3c1fb7cd410d147d831eeacd3a2d.exe	icacls.exe
PID 1348 wrote to memory of 956	1348	6ce97fcf349275a6d4c4ed9ff6c80f40d70c3c1fb7cd410d147d831eeacd3a2d.exe	takeown.exe
PID 1348 wrote to memory of 956	1348	6ce97fcf349275a6d4c4ed9ff6c80f40d70c3c1fb7cd410d147d831eeacd3a2d.exe	takeown.exe
PID 1348 wrote to memory of 956	1348	6ce97fcf349275a6d4c4ed9ff6c80f40d70c3c1fb7cd410d147d831eeacd3a2d.exe	takeown.exe
PID 1348 wrote to memory of 956	1348	6ce97fcf349275a6d4c4ed9ff6c80f40d70c3c1fb7cd410d147d831eeacd3a2d.exe	takeown.exe
PID 1348 wrote to memory of 1908	1348	6ce97fcf349275a6d4c4ed9ff6c80f40d70c3c1fb7cd410d147d831eeacd3a2d.exe	icacls.exe
PID 1348 wrote to memory of 1908	1348	6ce97fcf349275a6d4c4ed9ff6c80f40d70c3c1fb7cd410d147d831eeacd3a2d.exe	icacls.exe
PID 1348 wrote to memory of 1908	1348	6ce97fcf349275a6d4c4ed9ff6c80f40d70c3c1fb7cd410d147d831eeacd3a2d.exe	icacls.exe
PID 1348 wrote to memory of 1908	1348	6ce97fcf349275a6d4c4ed9ff6c80f40d70c3c1fb7cd410d147d831eeacd3a2d.exe	icacls.exe
PID 1348 wrote to memory of 972	1348	6ce97fcf349275a6d4c4ed9ff6c80f40d70c3c1fb7cd410d147d831eeacd3a2d.exe	takeown.exe
PID 1348 wrote to memory of 972	1348	6ce97fcf349275a6d4c4ed9ff6c80f40d70c3c1fb7cd410d147d831eeacd3a2d.exe	takeown.exe
PID 1348 wrote to memory of 972	1348	6ce97fcf349275a6d4c4ed9ff6c80f40d70c3c1fb7cd410d147d831eeacd3a2d.exe	takeown.exe
PID 1348 wrote to memory of 972	1348	6ce97fcf349275a6d4c4ed9ff6c80f40d70c3c1fb7cd410d147d831eeacd3a2d.exe	takeown.exe
PID 1348 wrote to memory of 1820	1348	6ce97fcf349275a6d4c4ed9ff6c80f40d70c3c1fb7cd410d147d831eeacd3a2d.exe	icacls.exe
PID 1348 wrote to memory of 1820	1348	6ce97fcf349275a6d4c4ed9ff6c80f40d70c3c1fb7cd410d147d831eeacd3a2d.exe	icacls.exe
PID 1348 wrote to memory of 1820	1348	6ce97fcf349275a6d4c4ed9ff6c80f40d70c3c1fb7cd410d147d831eeacd3a2d.exe	icacls.exe
PID 1348 wrote to memory of 1820	1348	6ce97fcf349275a6d4c4ed9ff6c80f40d70c3c1fb7cd410d147d831eeacd3a2d.exe	icacls.exe

C:\Users\Admin\AppData\Local\Temp\6ce97fcf349275a6d4c4ed9ff6c80f40d70c3c1fb7cd410d147d831eeacd3a2d.exe
"C:\Users\Admin\AppData\Local\Temp\6ce97fcf349275a6d4c4ed9ff6c80f40d70c3c1fb7cd410d147d831eeacd3a2d.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1348

C:\Windows\SysWOW64\takeown.exe
C:\Windows\System32\takeown.exe /f "C:\Windows\System32\cmd.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:1556

C:\Windows\SysWOW64\icacls.exe
C:\Windows\System32\icacls.exe "C:\Windows\System32\cmd.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1284

C:\Windows\SysWOW64\takeown.exe
C:\Windows\System32\takeown.exe /f "C:\Windows\System32\ftp.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:304

C:\Windows\SysWOW64\icacls.exe
C:\Windows\System32\icacls.exe "C:\Windows\System32\ftp.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1676

C:\Windows\SysWOW64\takeown.exe
C:\Windows\System32\takeown.exe /f "C:\Windows\System32\wscript.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:956

C:\Windows\SysWOW64\icacls.exe
C:\Windows\System32\icacls.exe "C:\Windows\System32\wscript.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1908

C:\Windows\SysWOW64\takeown.exe
C:\Windows\System32\takeown.exe /f "C:\Windows\System32\cscript.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:972

C:\Windows\SysWOW64\icacls.exe
C:\Windows\System32\icacls.exe "C:\Windows\System32\cscript.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1820

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File Permissions Modification

1

T1222

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/304-58-0x0000000000000000-mapping.dmp

Download
memory/956-60-0x0000000000000000-mapping.dmp

Download
memory/972-62-0x0000000000000000-mapping.dmp

Download
memory/1284-57-0x0000000000000000-mapping.dmp

Download
memory/1556-56-0x0000000000000000-mapping.dmp

Download
memory/1676-59-0x0000000000000000-mapping.dmp

Download
memory/1820-63-0x0000000000000000-mapping.dmp

Download
memory/1908-61-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing