aa872676e5a6cd015e39fa9f0eae4864b2fc15cd8cd01ccfce6ac0ad8808d0f1

General

Target

aa872676e5a6cd015e39fa9f0eae4864b2fc15cd8cd01ccfce6ac0ad8808d0f1.exe
Size

56KB
MD5

5591211a3b6591dcfdda3254820eb446
SHA1

25f0b212b9e083f900fbc14f8fc900295a4b9b4c
SHA256

aa872676e5a6cd015e39fa9f0eae4864b2fc15cd8cd01ccfce6ac0ad8808d0f1
SHA512

c26bcdcd35e8676b9a2e520c783596c7bb24f68f81b166ad5e0ac9de7f222fd7e5a5a46c6e915e5a491622c58ddd668593303df93e5d710ebfc72cf269777e45
SSDEEP

768:V2Yi/RoaeqRHphT0uoUVdPEV2Ux9l8pwrdgbElTZ2ZeT:c5/RpwUVdMYkl8YdjMeT

Score

8^/10

discovery exploit

Malware Config

Signatures

Possible privilege escalation attempt 14 IoCs

exploit

Processes:

icacls.exetakeown.exeicacls.exetakeown.exeicacls.exeicacls.exetakeown.exeicacls.exetakeown.exeicacls.exeicacls.exeicacls.exetakeown.exeicacls.exe

pid	process
212	icacls.exe
1324	takeown.exe
872	icacls.exe
2084	takeown.exe
2040	icacls.exe
812	icacls.exe
316	takeown.exe
3528	icacls.exe
4276	takeown.exe
1984	icacls.exe
4348	icacls.exe
2892	icacls.exe
1584	takeown.exe
2452	icacls.exe

Modifies file permissions 1 TTPs 14 IoCs

discovery

File and Directory Permissions Modification

T1222

Processes:

takeown.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exetakeown.exeicacls.exeicacls.exetakeown.exetakeown.exeicacls.exeicacls.exetakeown.exe

pid	process
2084	takeown.exe
2040	icacls.exe
872	icacls.exe
212	icacls.exe
3528	icacls.exe
2452	icacls.exe
4276	takeown.exe
2892	icacls.exe
812	icacls.exe
316	takeown.exe
1584	takeown.exe
1984	icacls.exe
4348	icacls.exe
1324	takeown.exe

Drops file in System32 directory 6 IoCs

Processes:

aa872676e5a6cd015e39fa9f0eae4864b2fc15cd8cd01ccfce6ac0ad8808d0f1.exe

description	ioc	process
File created	\??\c:\windows\SysWOW64\kuyf.exe	aa872676e5a6cd015e39fa9f0eae4864b2fc15cd8cd01ccfce6ac0ad8808d0f1.exe
File opened for modification	\??\c:\windows\SysWOW64\kuyf.exe	aa872676e5a6cd015e39fa9f0eae4864b2fc15cd8cd01ccfce6ac0ad8808d0f1.exe
File opened for modification	C:\Windows\SysWOW64\cmd.exe	aa872676e5a6cd015e39fa9f0eae4864b2fc15cd8cd01ccfce6ac0ad8808d0f1.exe
File opened for modification	C:\Windows\SysWOW64\ftp.exe	aa872676e5a6cd015e39fa9f0eae4864b2fc15cd8cd01ccfce6ac0ad8808d0f1.exe
File opened for modification	C:\Windows\SysWOW64\wscript.exe	aa872676e5a6cd015e39fa9f0eae4864b2fc15cd8cd01ccfce6ac0ad8808d0f1.exe
File opened for modification	C:\Windows\SysWOW64\cscript.exe	aa872676e5a6cd015e39fa9f0eae4864b2fc15cd8cd01ccfce6ac0ad8808d0f1.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

takeown.exetakeown.exetakeown.exetakeown.exe

description	pid	process
Token: SeTakeOwnershipPrivilege	4276	takeown.exe
Token: SeTakeOwnershipPrivilege	1324	takeown.exe
Token: SeTakeOwnershipPrivilege	316	takeown.exe
Token: SeTakeOwnershipPrivilege	1584	takeown.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

aa872676e5a6cd015e39fa9f0eae4864b2fc15cd8cd01ccfce6ac0ad8808d0f1.exe

pid process

1528 aa872676e5a6cd015e39fa9f0eae4864b2fc15cd8cd01ccfce6ac0ad8808d0f1.exe

pid	process
1528	aa872676e5a6cd015e39fa9f0eae4864b2fc15cd8cd01ccfce6ac0ad8808d0f1.exe

Suspicious use of WriteProcessMemory 42 IoCs

Processes:

aa872676e5a6cd015e39fa9f0eae4864b2fc15cd8cd01ccfce6ac0ad8808d0f1.exe

description	pid	process	target process
PID 1528 wrote to memory of 2084	1528	aa872676e5a6cd015e39fa9f0eae4864b2fc15cd8cd01ccfce6ac0ad8808d0f1.exe	takeown.exe
PID 1528 wrote to memory of 2084	1528	aa872676e5a6cd015e39fa9f0eae4864b2fc15cd8cd01ccfce6ac0ad8808d0f1.exe	takeown.exe
PID 1528 wrote to memory of 2084	1528	aa872676e5a6cd015e39fa9f0eae4864b2fc15cd8cd01ccfce6ac0ad8808d0f1.exe	takeown.exe
PID 1528 wrote to memory of 2040	1528	aa872676e5a6cd015e39fa9f0eae4864b2fc15cd8cd01ccfce6ac0ad8808d0f1.exe	icacls.exe
PID 1528 wrote to memory of 2040	1528	aa872676e5a6cd015e39fa9f0eae4864b2fc15cd8cd01ccfce6ac0ad8808d0f1.exe	icacls.exe
PID 1528 wrote to memory of 2040	1528	aa872676e5a6cd015e39fa9f0eae4864b2fc15cd8cd01ccfce6ac0ad8808d0f1.exe	icacls.exe
PID 1528 wrote to memory of 4276	1528	aa872676e5a6cd015e39fa9f0eae4864b2fc15cd8cd01ccfce6ac0ad8808d0f1.exe	takeown.exe
PID 1528 wrote to memory of 4276	1528	aa872676e5a6cd015e39fa9f0eae4864b2fc15cd8cd01ccfce6ac0ad8808d0f1.exe	takeown.exe
PID 1528 wrote to memory of 4276	1528	aa872676e5a6cd015e39fa9f0eae4864b2fc15cd8cd01ccfce6ac0ad8808d0f1.exe	takeown.exe
PID 1528 wrote to memory of 4348	1528	aa872676e5a6cd015e39fa9f0eae4864b2fc15cd8cd01ccfce6ac0ad8808d0f1.exe	icacls.exe
PID 1528 wrote to memory of 4348	1528	aa872676e5a6cd015e39fa9f0eae4864b2fc15cd8cd01ccfce6ac0ad8808d0f1.exe	icacls.exe
PID 1528 wrote to memory of 4348	1528	aa872676e5a6cd015e39fa9f0eae4864b2fc15cd8cd01ccfce6ac0ad8808d0f1.exe	icacls.exe
PID 1528 wrote to memory of 1984	1528	aa872676e5a6cd015e39fa9f0eae4864b2fc15cd8cd01ccfce6ac0ad8808d0f1.exe	icacls.exe
PID 1528 wrote to memory of 1984	1528	aa872676e5a6cd015e39fa9f0eae4864b2fc15cd8cd01ccfce6ac0ad8808d0f1.exe	icacls.exe
PID 1528 wrote to memory of 1984	1528	aa872676e5a6cd015e39fa9f0eae4864b2fc15cd8cd01ccfce6ac0ad8808d0f1.exe	icacls.exe
PID 1528 wrote to memory of 1324	1528	aa872676e5a6cd015e39fa9f0eae4864b2fc15cd8cd01ccfce6ac0ad8808d0f1.exe	takeown.exe
PID 1528 wrote to memory of 1324	1528	aa872676e5a6cd015e39fa9f0eae4864b2fc15cd8cd01ccfce6ac0ad8808d0f1.exe	takeown.exe
PID 1528 wrote to memory of 1324	1528	aa872676e5a6cd015e39fa9f0eae4864b2fc15cd8cd01ccfce6ac0ad8808d0f1.exe	takeown.exe
PID 1528 wrote to memory of 812	1528	aa872676e5a6cd015e39fa9f0eae4864b2fc15cd8cd01ccfce6ac0ad8808d0f1.exe	icacls.exe
PID 1528 wrote to memory of 812	1528	aa872676e5a6cd015e39fa9f0eae4864b2fc15cd8cd01ccfce6ac0ad8808d0f1.exe	icacls.exe
PID 1528 wrote to memory of 812	1528	aa872676e5a6cd015e39fa9f0eae4864b2fc15cd8cd01ccfce6ac0ad8808d0f1.exe	icacls.exe
PID 1528 wrote to memory of 2892	1528	aa872676e5a6cd015e39fa9f0eae4864b2fc15cd8cd01ccfce6ac0ad8808d0f1.exe	icacls.exe
PID 1528 wrote to memory of 2892	1528	aa872676e5a6cd015e39fa9f0eae4864b2fc15cd8cd01ccfce6ac0ad8808d0f1.exe	icacls.exe
PID 1528 wrote to memory of 2892	1528	aa872676e5a6cd015e39fa9f0eae4864b2fc15cd8cd01ccfce6ac0ad8808d0f1.exe	icacls.exe
PID 1528 wrote to memory of 316	1528	aa872676e5a6cd015e39fa9f0eae4864b2fc15cd8cd01ccfce6ac0ad8808d0f1.exe	takeown.exe
PID 1528 wrote to memory of 316	1528	aa872676e5a6cd015e39fa9f0eae4864b2fc15cd8cd01ccfce6ac0ad8808d0f1.exe	takeown.exe
PID 1528 wrote to memory of 316	1528	aa872676e5a6cd015e39fa9f0eae4864b2fc15cd8cd01ccfce6ac0ad8808d0f1.exe	takeown.exe
PID 1528 wrote to memory of 212	1528	aa872676e5a6cd015e39fa9f0eae4864b2fc15cd8cd01ccfce6ac0ad8808d0f1.exe	icacls.exe
PID 1528 wrote to memory of 212	1528	aa872676e5a6cd015e39fa9f0eae4864b2fc15cd8cd01ccfce6ac0ad8808d0f1.exe	icacls.exe
PID 1528 wrote to memory of 212	1528	aa872676e5a6cd015e39fa9f0eae4864b2fc15cd8cd01ccfce6ac0ad8808d0f1.exe	icacls.exe
PID 1528 wrote to memory of 872	1528	aa872676e5a6cd015e39fa9f0eae4864b2fc15cd8cd01ccfce6ac0ad8808d0f1.exe	icacls.exe
PID 1528 wrote to memory of 872	1528	aa872676e5a6cd015e39fa9f0eae4864b2fc15cd8cd01ccfce6ac0ad8808d0f1.exe	icacls.exe
PID 1528 wrote to memory of 872	1528	aa872676e5a6cd015e39fa9f0eae4864b2fc15cd8cd01ccfce6ac0ad8808d0f1.exe	icacls.exe
PID 1528 wrote to memory of 1584	1528	aa872676e5a6cd015e39fa9f0eae4864b2fc15cd8cd01ccfce6ac0ad8808d0f1.exe	takeown.exe
PID 1528 wrote to memory of 1584	1528	aa872676e5a6cd015e39fa9f0eae4864b2fc15cd8cd01ccfce6ac0ad8808d0f1.exe	takeown.exe
PID 1528 wrote to memory of 1584	1528	aa872676e5a6cd015e39fa9f0eae4864b2fc15cd8cd01ccfce6ac0ad8808d0f1.exe	takeown.exe
PID 1528 wrote to memory of 2452	1528	aa872676e5a6cd015e39fa9f0eae4864b2fc15cd8cd01ccfce6ac0ad8808d0f1.exe	icacls.exe
PID 1528 wrote to memory of 2452	1528	aa872676e5a6cd015e39fa9f0eae4864b2fc15cd8cd01ccfce6ac0ad8808d0f1.exe	icacls.exe
PID 1528 wrote to memory of 2452	1528	aa872676e5a6cd015e39fa9f0eae4864b2fc15cd8cd01ccfce6ac0ad8808d0f1.exe	icacls.exe
PID 1528 wrote to memory of 3528	1528	aa872676e5a6cd015e39fa9f0eae4864b2fc15cd8cd01ccfce6ac0ad8808d0f1.exe	icacls.exe
PID 1528 wrote to memory of 3528	1528	aa872676e5a6cd015e39fa9f0eae4864b2fc15cd8cd01ccfce6ac0ad8808d0f1.exe	icacls.exe
PID 1528 wrote to memory of 3528	1528	aa872676e5a6cd015e39fa9f0eae4864b2fc15cd8cd01ccfce6ac0ad8808d0f1.exe	icacls.exe

C:\Users\Admin\AppData\Local\Temp\aa872676e5a6cd015e39fa9f0eae4864b2fc15cd8cd01ccfce6ac0ad8808d0f1.exe
"C:\Users\Admin\AppData\Local\Temp\aa872676e5a6cd015e39fa9f0eae4864b2fc15cd8cd01ccfce6ac0ad8808d0f1.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1528

C:\Windows\SysWOW64\takeown.exe
C:\Windows\system32\takeown.exe /f "c:\windows\system32\kuyf.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:2084

C:\Windows\SysWOW64\icacls.exe
C:\Windows\system32\icacls.exe "c:\windows\system32\kuyf.exe" /grant SYSTEM:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:2040

C:\Windows\SysWOW64\takeown.exe
C:\Windows\system32\takeown.exe /f "C:\Windows\System32\cmd.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:4276

C:\Windows\SysWOW64\icacls.exe
C:\Windows\system32\icacls.exe "C:\Windows\System32\cmd.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1984

C:\Windows\SysWOW64\icacls.exe
C:\Windows\system32\icacls.exe "C:\Windows\System32\cmd.exe" /grant SYSTEM:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:4348

C:\Windows\SysWOW64\takeown.exe
C:\Windows\system32\takeown.exe /f "C:\Windows\System32\ftp.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:1324

C:\Windows\SysWOW64\icacls.exe
C:\Windows\system32\icacls.exe "C:\Windows\System32\ftp.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:2892

C:\Windows\SysWOW64\icacls.exe
C:\Windows\system32\icacls.exe "C:\Windows\System32\ftp.exe" /grant SYSTEM:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:812

C:\Windows\SysWOW64\takeown.exe
C:\Windows\system32\takeown.exe /f "C:\Windows\System32\wscript.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:316

C:\Windows\SysWOW64\icacls.exe
C:\Windows\system32\icacls.exe "C:\Windows\System32\wscript.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:872

C:\Windows\SysWOW64\icacls.exe
C:\Windows\system32\icacls.exe "C:\Windows\System32\wscript.exe" /grant SYSTEM:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:212

C:\Windows\SysWOW64\takeown.exe
C:\Windows\system32\takeown.exe /f "C:\Windows\System32\cscript.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:1584

C:\Windows\SysWOW64\icacls.exe
C:\Windows\system32\icacls.exe "C:\Windows\System32\cscript.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:3528

C:\Windows\SysWOW64\icacls.exe
C:\Windows\system32\icacls.exe "C:\Windows\System32\cscript.exe" /grant SYSTEM:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:2452

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

1

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\??\c:\windows\SysWOW64\kuyf.exe
Filesize
56KB

MD5
5591211a3b6591dcfdda3254820eb446

SHA1
25f0b212b9e083f900fbc14f8fc900295a4b9b4c

SHA256
aa872676e5a6cd015e39fa9f0eae4864b2fc15cd8cd01ccfce6ac0ad8808d0f1

SHA512
c26bcdcd35e8676b9a2e520c783596c7bb24f68f81b166ad5e0ac9de7f222fd7e5a5a46c6e915e5a491622c58ddd668593303df93e5d710ebfc72cf269777e45

Download Submit
memory/212-144-0x0000000000000000-mapping.dmp

Download
memory/316-143-0x0000000000000000-mapping.dmp

Download
memory/812-141-0x0000000000000000-mapping.dmp

Download
memory/872-145-0x0000000000000000-mapping.dmp

Download
memory/1324-140-0x0000000000000000-mapping.dmp

Download
memory/1584-146-0x0000000000000000-mapping.dmp

Download
memory/1984-139-0x0000000000000000-mapping.dmp

Download
memory/2040-135-0x0000000000000000-mapping.dmp

Download
memory/2084-134-0x0000000000000000-mapping.dmp

Download
memory/2452-147-0x0000000000000000-mapping.dmp

Download
memory/2892-142-0x0000000000000000-mapping.dmp

Download
memory/3528-148-0x0000000000000000-mapping.dmp

Download
memory/4276-137-0x0000000000000000-mapping.dmp

Download
memory/4348-138-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads