aed6faaa247a9e1b1606f8b3858be9249f10e4e77490f494b026b0e9bd8a4146

General

Target

aed6faaa247a9e1b1606f8b3858be9249f10e4e77490f494b026b0e9bd8a4146.exe
Size

40KB
MD5

58fcb40f83c6964e2c9446b62d8fe680
SHA1

d5a300e14dadf3e1c82beabde3a0df8635964c74
SHA256

aed6faaa247a9e1b1606f8b3858be9249f10e4e77490f494b026b0e9bd8a4146
SHA512

769e4ea7f8f5e0c59ca3b7e36c9890a0596c26e9d95b0f5773d471b0a247bc6a7e8d5dc71eaf32c5965936dfea2f2ce54fa74b4e32e1c2a421fdc40307dfc798
SSDEEP

768:/afSTut+PFb0wkhu2NQU3OIFmF4oS5Yhyqc50b+:/amHm3QU3OIFmF4oSg+

Score

8^/10

discovery exploit

Malware Config

Signatures

Possible privilege escalation attempt 8 IoCs
exploit

Processes:

icacls.exeicacls.exetakeown.exetakeown.exeicacls.exetakeown.exeicacls.exetakeown.exe

pid process

1328 icacls.exe
1988 icacls.exe
1292 takeown.exe
2004 takeown.exe
1464 icacls.exe
280 takeown.exe
436 icacls.exe
656 takeown.exe
Modifies file permissions 1 TTPs 8 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

takeown.exetakeown.exeicacls.exetakeown.exeicacls.exetakeown.exeicacls.exeicacls.exe

pid process

1292 takeown.exe
2004 takeown.exe
1464 icacls.exe
280 takeown.exe
436 icacls.exe
656 takeown.exe
1328 icacls.exe
1988 icacls.exe

pid	process
1328	icacls.exe
1988	icacls.exe
1292	takeown.exe
2004	takeown.exe
1464	icacls.exe
280	takeown.exe
436	icacls.exe
656	takeown.exe

pid	process
1292	takeown.exe
2004	takeown.exe
1464	icacls.exe
280	takeown.exe
436	icacls.exe
656	takeown.exe
1328	icacls.exe
1988	icacls.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

takeown.exetakeown.exetakeown.exetakeown.exe

description	pid	process
Token: SeTakeOwnershipPrivilege	1292	takeown.exe
Token: SeTakeOwnershipPrivilege	280	takeown.exe
Token: SeTakeOwnershipPrivilege	2004	takeown.exe
Token: SeTakeOwnershipPrivilege	656	takeown.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

aed6faaa247a9e1b1606f8b3858be9249f10e4e77490f494b026b0e9bd8a4146.exe

pid process

936 aed6faaa247a9e1b1606f8b3858be9249f10e4e77490f494b026b0e9bd8a4146.exe

pid	process
936	aed6faaa247a9e1b1606f8b3858be9249f10e4e77490f494b026b0e9bd8a4146.exe

Suspicious use of WriteProcessMemory 32 IoCs

Processes:

aed6faaa247a9e1b1606f8b3858be9249f10e4e77490f494b026b0e9bd8a4146.exe

description	pid	process	target process
PID 936 wrote to memory of 280	936	aed6faaa247a9e1b1606f8b3858be9249f10e4e77490f494b026b0e9bd8a4146.exe	takeown.exe
PID 936 wrote to memory of 280	936	aed6faaa247a9e1b1606f8b3858be9249f10e4e77490f494b026b0e9bd8a4146.exe	takeown.exe
PID 936 wrote to memory of 280	936	aed6faaa247a9e1b1606f8b3858be9249f10e4e77490f494b026b0e9bd8a4146.exe	takeown.exe
PID 936 wrote to memory of 280	936	aed6faaa247a9e1b1606f8b3858be9249f10e4e77490f494b026b0e9bd8a4146.exe	takeown.exe
PID 936 wrote to memory of 436	936	aed6faaa247a9e1b1606f8b3858be9249f10e4e77490f494b026b0e9bd8a4146.exe	icacls.exe
PID 936 wrote to memory of 436	936	aed6faaa247a9e1b1606f8b3858be9249f10e4e77490f494b026b0e9bd8a4146.exe	icacls.exe
PID 936 wrote to memory of 436	936	aed6faaa247a9e1b1606f8b3858be9249f10e4e77490f494b026b0e9bd8a4146.exe	icacls.exe
PID 936 wrote to memory of 436	936	aed6faaa247a9e1b1606f8b3858be9249f10e4e77490f494b026b0e9bd8a4146.exe	icacls.exe
PID 936 wrote to memory of 656	936	aed6faaa247a9e1b1606f8b3858be9249f10e4e77490f494b026b0e9bd8a4146.exe	takeown.exe
PID 936 wrote to memory of 656	936	aed6faaa247a9e1b1606f8b3858be9249f10e4e77490f494b026b0e9bd8a4146.exe	takeown.exe
PID 936 wrote to memory of 656	936	aed6faaa247a9e1b1606f8b3858be9249f10e4e77490f494b026b0e9bd8a4146.exe	takeown.exe
PID 936 wrote to memory of 656	936	aed6faaa247a9e1b1606f8b3858be9249f10e4e77490f494b026b0e9bd8a4146.exe	takeown.exe
PID 936 wrote to memory of 1328	936	aed6faaa247a9e1b1606f8b3858be9249f10e4e77490f494b026b0e9bd8a4146.exe	icacls.exe
PID 936 wrote to memory of 1328	936	aed6faaa247a9e1b1606f8b3858be9249f10e4e77490f494b026b0e9bd8a4146.exe	icacls.exe
PID 936 wrote to memory of 1328	936	aed6faaa247a9e1b1606f8b3858be9249f10e4e77490f494b026b0e9bd8a4146.exe	icacls.exe
PID 936 wrote to memory of 1328	936	aed6faaa247a9e1b1606f8b3858be9249f10e4e77490f494b026b0e9bd8a4146.exe	icacls.exe
PID 936 wrote to memory of 1292	936	aed6faaa247a9e1b1606f8b3858be9249f10e4e77490f494b026b0e9bd8a4146.exe	takeown.exe
PID 936 wrote to memory of 1292	936	aed6faaa247a9e1b1606f8b3858be9249f10e4e77490f494b026b0e9bd8a4146.exe	takeown.exe
PID 936 wrote to memory of 1292	936	aed6faaa247a9e1b1606f8b3858be9249f10e4e77490f494b026b0e9bd8a4146.exe	takeown.exe
PID 936 wrote to memory of 1292	936	aed6faaa247a9e1b1606f8b3858be9249f10e4e77490f494b026b0e9bd8a4146.exe	takeown.exe
PID 936 wrote to memory of 1988	936	aed6faaa247a9e1b1606f8b3858be9249f10e4e77490f494b026b0e9bd8a4146.exe	icacls.exe
PID 936 wrote to memory of 1988	936	aed6faaa247a9e1b1606f8b3858be9249f10e4e77490f494b026b0e9bd8a4146.exe	icacls.exe
PID 936 wrote to memory of 1988	936	aed6faaa247a9e1b1606f8b3858be9249f10e4e77490f494b026b0e9bd8a4146.exe	icacls.exe
PID 936 wrote to memory of 1988	936	aed6faaa247a9e1b1606f8b3858be9249f10e4e77490f494b026b0e9bd8a4146.exe	icacls.exe
PID 936 wrote to memory of 2004	936	aed6faaa247a9e1b1606f8b3858be9249f10e4e77490f494b026b0e9bd8a4146.exe	takeown.exe
PID 936 wrote to memory of 2004	936	aed6faaa247a9e1b1606f8b3858be9249f10e4e77490f494b026b0e9bd8a4146.exe	takeown.exe
PID 936 wrote to memory of 2004	936	aed6faaa247a9e1b1606f8b3858be9249f10e4e77490f494b026b0e9bd8a4146.exe	takeown.exe
PID 936 wrote to memory of 2004	936	aed6faaa247a9e1b1606f8b3858be9249f10e4e77490f494b026b0e9bd8a4146.exe	takeown.exe
PID 936 wrote to memory of 1464	936	aed6faaa247a9e1b1606f8b3858be9249f10e4e77490f494b026b0e9bd8a4146.exe	icacls.exe
PID 936 wrote to memory of 1464	936	aed6faaa247a9e1b1606f8b3858be9249f10e4e77490f494b026b0e9bd8a4146.exe	icacls.exe
PID 936 wrote to memory of 1464	936	aed6faaa247a9e1b1606f8b3858be9249f10e4e77490f494b026b0e9bd8a4146.exe	icacls.exe
PID 936 wrote to memory of 1464	936	aed6faaa247a9e1b1606f8b3858be9249f10e4e77490f494b026b0e9bd8a4146.exe	icacls.exe

C:\Users\Admin\AppData\Local\Temp\aed6faaa247a9e1b1606f8b3858be9249f10e4e77490f494b026b0e9bd8a4146.exe
"C:\Users\Admin\AppData\Local\Temp\aed6faaa247a9e1b1606f8b3858be9249f10e4e77490f494b026b0e9bd8a4146.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:936

C:\Windows\SysWOW64\takeown.exe
C:\Windows\System32\takeown.exe /f "C:\Windows\System32\cmd.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:280

C:\Windows\SysWOW64\icacls.exe
C:\Windows\System32\icacls.exe "C:\Windows\System32\cmd.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:436

C:\Windows\SysWOW64\takeown.exe
C:\Windows\System32\takeown.exe /f "C:\Windows\System32\ftp.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:656

C:\Windows\SysWOW64\icacls.exe
C:\Windows\System32\icacls.exe "C:\Windows\System32\ftp.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1328

C:\Windows\SysWOW64\icacls.exe
C:\Windows\System32\icacls.exe "C:\Windows\System32\wscript.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1988

C:\Windows\SysWOW64\takeown.exe
C:\Windows\System32\takeown.exe /f "C:\Windows\System32\wscript.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:1292

C:\Windows\SysWOW64\takeown.exe
C:\Windows\System32\takeown.exe /f "C:\Windows\System32\cscript.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:2004

C:\Windows\SysWOW64\icacls.exe
C:\Windows\System32\icacls.exe "C:\Windows\System32\cscript.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1464

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

1

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/280-56-0x0000000000000000-mapping.dmp

Download
memory/436-57-0x0000000000000000-mapping.dmp

Download
memory/656-58-0x0000000000000000-mapping.dmp

Download
memory/1292-60-0x0000000000000000-mapping.dmp

Download
memory/1328-59-0x0000000000000000-mapping.dmp

Download
memory/1464-63-0x0000000000000000-mapping.dmp

Download
memory/1988-61-0x0000000000000000-mapping.dmp

Download
memory/2004-62-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing