25ab4212c8f62de598ac8f8287aa40009fadfc9b49e7b1cb8e689a409a96953f

Analysis

max time kernel
175s
max time network
183s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
19-11-2022 04:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

25ab4212c8f62de598ac8f8287aa40009fadfc9b49e7b1cb8e689a409a96953f.exe
Size

40KB
MD5

07608be1906ed2cd5aae27bc22e74af6
SHA1

04ec071dbe5256c380ffe30b0a9eeac52924045e
SHA256

25ab4212c8f62de598ac8f8287aa40009fadfc9b49e7b1cb8e689a409a96953f
SHA512

71d30623ce7ba1fd0459c4cbbc77f7fe88782376e995e17ad20818377eb33c573ce0d7acd0ff2fe4f93145c378a9bad96bc2c94b5cf118a6dea78a27ab34b917
SSDEEP

768:/wAbd1+wF1BKUVXezBzOnpdsl9Xd8eDOwKVOyL5fDmWt:/wAbys1B9XedMCzSRwKVP5fKWt

Score

8^/10

discovery exploit persistence

Malware Config

Signatures

Possible privilege escalation attempt 2 IoCs
exploit

Processes:

takeown.exeicacls.exe

pid process

3152 takeown.exe
1292 icacls.exe
Modifies file permissions 1 TTPs 2 IoCs
discovery

File Permissions Modification
T1222

Processes:

takeown.exeicacls.exe

pid process

3152 takeown.exe
1292 icacls.exe

pid	process
3152	takeown.exe
1292	icacls.exe

pid	process
3152	takeown.exe
1292	icacls.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

25ab4212c8f62de598ac8f8287aa40009fadfc9b49e7b1cb8e689a409a96953f.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	25ab4212c8f62de598ac8f8287aa40009fadfc9b49e7b1cb8e689a409a96953f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\OIe = "C:\\Windows\\system32\\tzvr.exe"	25ab4212c8f62de598ac8f8287aa40009fadfc9b49e7b1cb8e689a409a96953f.exe

Drops file in System32 directory 2 IoCs

Processes:

25ab4212c8f62de598ac8f8287aa40009fadfc9b49e7b1cb8e689a409a96953f.exe

description	ioc	process
File created	C:\Windows\SysWOW64\tzvr.exe	25ab4212c8f62de598ac8f8287aa40009fadfc9b49e7b1cb8e689a409a96953f.exe
File opened for modification	C:\Windows\SysWOW64\tzvr.exe	25ab4212c8f62de598ac8f8287aa40009fadfc9b49e7b1cb8e689a409a96953f.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

25ab4212c8f62de598ac8f8287aa40009fadfc9b49e7b1cb8e689a409a96953f.exe

pid process

4364 25ab4212c8f62de598ac8f8287aa40009fadfc9b49e7b1cb8e689a409a96953f.exe

pid	process
4364	25ab4212c8f62de598ac8f8287aa40009fadfc9b49e7b1cb8e689a409a96953f.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

25ab4212c8f62de598ac8f8287aa40009fadfc9b49e7b1cb8e689a409a96953f.exe

description	pid	process	target process
PID 4364 wrote to memory of 3152	4364	25ab4212c8f62de598ac8f8287aa40009fadfc9b49e7b1cb8e689a409a96953f.exe	takeown.exe
PID 4364 wrote to memory of 3152	4364	25ab4212c8f62de598ac8f8287aa40009fadfc9b49e7b1cb8e689a409a96953f.exe	takeown.exe
PID 4364 wrote to memory of 3152	4364	25ab4212c8f62de598ac8f8287aa40009fadfc9b49e7b1cb8e689a409a96953f.exe	takeown.exe
PID 4364 wrote to memory of 1292	4364	25ab4212c8f62de598ac8f8287aa40009fadfc9b49e7b1cb8e689a409a96953f.exe	icacls.exe
PID 4364 wrote to memory of 1292	4364	25ab4212c8f62de598ac8f8287aa40009fadfc9b49e7b1cb8e689a409a96953f.exe	icacls.exe
PID 4364 wrote to memory of 1292	4364	25ab4212c8f62de598ac8f8287aa40009fadfc9b49e7b1cb8e689a409a96953f.exe	icacls.exe

C:\Users\Admin\AppData\Local\Temp\25ab4212c8f62de598ac8f8287aa40009fadfc9b49e7b1cb8e689a409a96953f.exe
"C:\Users\Admin\AppData\Local\Temp\25ab4212c8f62de598ac8f8287aa40009fadfc9b49e7b1cb8e689a409a96953f.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4364

C:\Windows\SysWOW64\takeown.exe
C:\Windows\system32\takeown.exe /f "C:\Windows\system32\tzvr.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:3152

C:\Windows\SysWOW64\icacls.exe
C:\Windows\system32\icacls.exe "C:\Windows\system32\tzvr.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1292

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

File Permissions Modification

T1222

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\tzvr.exe
Filesize
40KB

MD5
07608be1906ed2cd5aae27bc22e74af6

SHA1
04ec071dbe5256c380ffe30b0a9eeac52924045e

SHA256
25ab4212c8f62de598ac8f8287aa40009fadfc9b49e7b1cb8e689a409a96953f

SHA512
71d30623ce7ba1fd0459c4cbbc77f7fe88782376e995e17ad20818377eb33c573ce0d7acd0ff2fe4f93145c378a9bad96bc2c94b5cf118a6dea78a27ab34b917

Download Submit
memory/1292-135-0x0000000000000000-mapping.dmp

Download
memory/3152-134-0x0000000000000000-mapping.dmp

Download