6ce97fcf349275a6d4c4ed9ff6c80f40d70c3c1fb7cd410d147d831eeacd3a2d

General

Target

6ce97fcf349275a6d4c4ed9ff6c80f40d70c3c1fb7cd410d147d831eeacd3a2d.exe
Size

40KB
MD5

4ca93c3705fcd67739a69cb13decf510
SHA1

ae727231dee8fe009e675c0ee87c9598a0835910
SHA256

6ce97fcf349275a6d4c4ed9ff6c80f40d70c3c1fb7cd410d147d831eeacd3a2d
SHA512

7ef5e5e3eb454ffda8a258e0ac0eb4c07a756e534565165fe3696b462a11d5384adbd067d71298ca84efdbe199302c83be1181208c560d12e756855976f0a7d5
SSDEEP

384:/Tg5JPGmKafMP2n5NYm0KssnniZNNXb+4nl+A4p8T/4TYRxIfOMMCmUDbAYIbYYo:/6JPGPen5hVIN06T/4OIffNd

Score

8^/10

discovery exploit

Malware Config

Signatures

Possible privilege escalation attempt 8 IoCs
exploit

Processes:

icacls.exetakeown.exeicacls.exetakeown.exeicacls.exeicacls.exetakeown.exetakeown.exe

pid process

5024 icacls.exe
3472 takeown.exe
2436 icacls.exe
1808 takeown.exe
2368 icacls.exe
3416 icacls.exe
4964 takeown.exe
3456 takeown.exe
Modifies file permissions 1 TTPs 8 IoCs
discovery

File Permissions Modification
T1222

Processes:

icacls.exeicacls.exetakeown.exetakeown.exeicacls.exetakeown.exeicacls.exetakeown.exe

pid process

2368 icacls.exe
3416 icacls.exe
4964 takeown.exe
3456 takeown.exe
5024 icacls.exe
3472 takeown.exe
2436 icacls.exe
1808 takeown.exe

pid	process
5024	icacls.exe
3472	takeown.exe
2436	icacls.exe
1808	takeown.exe
2368	icacls.exe
3416	icacls.exe
4964	takeown.exe
3456	takeown.exe

pid	process
2368	icacls.exe
3416	icacls.exe
4964	takeown.exe
3456	takeown.exe
5024	icacls.exe
3472	takeown.exe
2436	icacls.exe
1808	takeown.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

takeown.exetakeown.exetakeown.exetakeown.exe

description	pid	process
Token: SeTakeOwnershipPrivilege	1808	takeown.exe
Token: SeTakeOwnershipPrivilege	3472	takeown.exe
Token: SeTakeOwnershipPrivilege	3456	takeown.exe
Token: SeTakeOwnershipPrivilege	4964	takeown.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

6ce97fcf349275a6d4c4ed9ff6c80f40d70c3c1fb7cd410d147d831eeacd3a2d.exe

pid process

904 6ce97fcf349275a6d4c4ed9ff6c80f40d70c3c1fb7cd410d147d831eeacd3a2d.exe

pid	process
904	6ce97fcf349275a6d4c4ed9ff6c80f40d70c3c1fb7cd410d147d831eeacd3a2d.exe

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

6ce97fcf349275a6d4c4ed9ff6c80f40d70c3c1fb7cd410d147d831eeacd3a2d.exe

description	pid	process	target process
PID 904 wrote to memory of 3472	904	6ce97fcf349275a6d4c4ed9ff6c80f40d70c3c1fb7cd410d147d831eeacd3a2d.exe	takeown.exe
PID 904 wrote to memory of 3472	904	6ce97fcf349275a6d4c4ed9ff6c80f40d70c3c1fb7cd410d147d831eeacd3a2d.exe	takeown.exe
PID 904 wrote to memory of 3472	904	6ce97fcf349275a6d4c4ed9ff6c80f40d70c3c1fb7cd410d147d831eeacd3a2d.exe	takeown.exe
PID 904 wrote to memory of 2436	904	6ce97fcf349275a6d4c4ed9ff6c80f40d70c3c1fb7cd410d147d831eeacd3a2d.exe	icacls.exe
PID 904 wrote to memory of 2436	904	6ce97fcf349275a6d4c4ed9ff6c80f40d70c3c1fb7cd410d147d831eeacd3a2d.exe	icacls.exe
PID 904 wrote to memory of 2436	904	6ce97fcf349275a6d4c4ed9ff6c80f40d70c3c1fb7cd410d147d831eeacd3a2d.exe	icacls.exe
PID 904 wrote to memory of 1808	904	6ce97fcf349275a6d4c4ed9ff6c80f40d70c3c1fb7cd410d147d831eeacd3a2d.exe	takeown.exe
PID 904 wrote to memory of 1808	904	6ce97fcf349275a6d4c4ed9ff6c80f40d70c3c1fb7cd410d147d831eeacd3a2d.exe	takeown.exe
PID 904 wrote to memory of 1808	904	6ce97fcf349275a6d4c4ed9ff6c80f40d70c3c1fb7cd410d147d831eeacd3a2d.exe	takeown.exe
PID 904 wrote to memory of 2368	904	6ce97fcf349275a6d4c4ed9ff6c80f40d70c3c1fb7cd410d147d831eeacd3a2d.exe	icacls.exe
PID 904 wrote to memory of 2368	904	6ce97fcf349275a6d4c4ed9ff6c80f40d70c3c1fb7cd410d147d831eeacd3a2d.exe	icacls.exe
PID 904 wrote to memory of 2368	904	6ce97fcf349275a6d4c4ed9ff6c80f40d70c3c1fb7cd410d147d831eeacd3a2d.exe	icacls.exe
PID 904 wrote to memory of 3456	904	6ce97fcf349275a6d4c4ed9ff6c80f40d70c3c1fb7cd410d147d831eeacd3a2d.exe	takeown.exe
PID 904 wrote to memory of 3456	904	6ce97fcf349275a6d4c4ed9ff6c80f40d70c3c1fb7cd410d147d831eeacd3a2d.exe	takeown.exe
PID 904 wrote to memory of 3456	904	6ce97fcf349275a6d4c4ed9ff6c80f40d70c3c1fb7cd410d147d831eeacd3a2d.exe	takeown.exe
PID 904 wrote to memory of 3416	904	6ce97fcf349275a6d4c4ed9ff6c80f40d70c3c1fb7cd410d147d831eeacd3a2d.exe	icacls.exe
PID 904 wrote to memory of 3416	904	6ce97fcf349275a6d4c4ed9ff6c80f40d70c3c1fb7cd410d147d831eeacd3a2d.exe	icacls.exe
PID 904 wrote to memory of 3416	904	6ce97fcf349275a6d4c4ed9ff6c80f40d70c3c1fb7cd410d147d831eeacd3a2d.exe	icacls.exe
PID 904 wrote to memory of 4964	904	6ce97fcf349275a6d4c4ed9ff6c80f40d70c3c1fb7cd410d147d831eeacd3a2d.exe	takeown.exe
PID 904 wrote to memory of 4964	904	6ce97fcf349275a6d4c4ed9ff6c80f40d70c3c1fb7cd410d147d831eeacd3a2d.exe	takeown.exe
PID 904 wrote to memory of 4964	904	6ce97fcf349275a6d4c4ed9ff6c80f40d70c3c1fb7cd410d147d831eeacd3a2d.exe	takeown.exe
PID 904 wrote to memory of 5024	904	6ce97fcf349275a6d4c4ed9ff6c80f40d70c3c1fb7cd410d147d831eeacd3a2d.exe	icacls.exe
PID 904 wrote to memory of 5024	904	6ce97fcf349275a6d4c4ed9ff6c80f40d70c3c1fb7cd410d147d831eeacd3a2d.exe	icacls.exe
PID 904 wrote to memory of 5024	904	6ce97fcf349275a6d4c4ed9ff6c80f40d70c3c1fb7cd410d147d831eeacd3a2d.exe	icacls.exe

C:\Users\Admin\AppData\Local\Temp\6ce97fcf349275a6d4c4ed9ff6c80f40d70c3c1fb7cd410d147d831eeacd3a2d.exe
"C:\Users\Admin\AppData\Local\Temp\6ce97fcf349275a6d4c4ed9ff6c80f40d70c3c1fb7cd410d147d831eeacd3a2d.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:904

C:\Windows\SysWOW64\takeown.exe
C:\Windows\System32\takeown.exe /f "C:\Windows\System32\cmd.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:3472

C:\Windows\SysWOW64\icacls.exe
C:\Windows\System32\icacls.exe "C:\Windows\System32\cmd.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:2436

C:\Windows\SysWOW64\takeown.exe
C:\Windows\System32\takeown.exe /f "C:\Windows\System32\ftp.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:1808

C:\Windows\SysWOW64\icacls.exe
C:\Windows\System32\icacls.exe "C:\Windows\System32\ftp.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:2368

C:\Windows\SysWOW64\icacls.exe
C:\Windows\System32\icacls.exe "C:\Windows\System32\wscript.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:3416

C:\Windows\SysWOW64\takeown.exe
C:\Windows\System32\takeown.exe /f "C:\Windows\System32\cscript.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:4964

C:\Windows\SysWOW64\takeown.exe
C:\Windows\System32\takeown.exe /f "C:\Windows\System32\wscript.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:3456

C:\Windows\SysWOW64\icacls.exe
C:\Windows\System32\icacls.exe "C:\Windows\System32\cscript.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:5024

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File Permissions Modification

1

T1222

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1808-136-0x0000000000000000-mapping.dmp

Download
memory/2368-137-0x0000000000000000-mapping.dmp

Download
memory/2436-135-0x0000000000000000-mapping.dmp

Download
memory/3416-139-0x0000000000000000-mapping.dmp

Download
memory/3456-138-0x0000000000000000-mapping.dmp

Download
memory/3472-134-0x0000000000000000-mapping.dmp

Download
memory/4964-140-0x0000000000000000-mapping.dmp

Download
memory/5024-141-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing