aed6faaa247a9e1b1606f8b3858be9249f10e4e77490f494b026b0e9bd8a4146

General

Target

aed6faaa247a9e1b1606f8b3858be9249f10e4e77490f494b026b0e9bd8a4146.exe
Size

40KB
MD5

58fcb40f83c6964e2c9446b62d8fe680
SHA1

d5a300e14dadf3e1c82beabde3a0df8635964c74
SHA256

aed6faaa247a9e1b1606f8b3858be9249f10e4e77490f494b026b0e9bd8a4146
SHA512

769e4ea7f8f5e0c59ca3b7e36c9890a0596c26e9d95b0f5773d471b0a247bc6a7e8d5dc71eaf32c5965936dfea2f2ce54fa74b4e32e1c2a421fdc40307dfc798
SSDEEP

768:/afSTut+PFb0wkhu2NQU3OIFmF4oS5Yhyqc50b+:/amHm3QU3OIFmF4oSg+

Score

8^/10

discovery exploit

Malware Config

Signatures

Possible privilege escalation attempt 8 IoCs
exploit

Processes:

icacls.exetakeown.exeicacls.exetakeown.exeicacls.exetakeown.exeicacls.exetakeown.exe

pid process

4996 icacls.exe
3828 takeown.exe
2404 icacls.exe
4628 takeown.exe
3856 icacls.exe
2556 takeown.exe
3972 icacls.exe
4968 takeown.exe
Modifies file permissions 1 TTPs 8 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exetakeown.exeicacls.exetakeown.exeicacls.exetakeown.exeicacls.exetakeown.exe

pid process

4996 icacls.exe
3828 takeown.exe
2404 icacls.exe
4628 takeown.exe
3856 icacls.exe
2556 takeown.exe
3972 icacls.exe
4968 takeown.exe

pid	process
4996	icacls.exe
3828	takeown.exe
2404	icacls.exe
4628	takeown.exe
3856	icacls.exe
2556	takeown.exe
3972	icacls.exe
4968	takeown.exe

pid	process
4996	icacls.exe
3828	takeown.exe
2404	icacls.exe
4628	takeown.exe
3856	icacls.exe
2556	takeown.exe
3972	icacls.exe
4968	takeown.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

takeown.exetakeown.exetakeown.exetakeown.exe

description	pid	process
Token: SeTakeOwnershipPrivilege	2556	takeown.exe
Token: SeTakeOwnershipPrivilege	3828	takeown.exe
Token: SeTakeOwnershipPrivilege	4628	takeown.exe
Token: SeTakeOwnershipPrivilege	4968	takeown.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

aed6faaa247a9e1b1606f8b3858be9249f10e4e77490f494b026b0e9bd8a4146.exe

pid process

2180 aed6faaa247a9e1b1606f8b3858be9249f10e4e77490f494b026b0e9bd8a4146.exe

pid	process
2180	aed6faaa247a9e1b1606f8b3858be9249f10e4e77490f494b026b0e9bd8a4146.exe

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

aed6faaa247a9e1b1606f8b3858be9249f10e4e77490f494b026b0e9bd8a4146.exe

description	pid	process	target process
PID 2180 wrote to memory of 3828	2180	aed6faaa247a9e1b1606f8b3858be9249f10e4e77490f494b026b0e9bd8a4146.exe	takeown.exe
PID 2180 wrote to memory of 3828	2180	aed6faaa247a9e1b1606f8b3858be9249f10e4e77490f494b026b0e9bd8a4146.exe	takeown.exe
PID 2180 wrote to memory of 3828	2180	aed6faaa247a9e1b1606f8b3858be9249f10e4e77490f494b026b0e9bd8a4146.exe	takeown.exe
PID 2180 wrote to memory of 2404	2180	aed6faaa247a9e1b1606f8b3858be9249f10e4e77490f494b026b0e9bd8a4146.exe	icacls.exe
PID 2180 wrote to memory of 2404	2180	aed6faaa247a9e1b1606f8b3858be9249f10e4e77490f494b026b0e9bd8a4146.exe	icacls.exe
PID 2180 wrote to memory of 2404	2180	aed6faaa247a9e1b1606f8b3858be9249f10e4e77490f494b026b0e9bd8a4146.exe	icacls.exe
PID 2180 wrote to memory of 4628	2180	aed6faaa247a9e1b1606f8b3858be9249f10e4e77490f494b026b0e9bd8a4146.exe	takeown.exe
PID 2180 wrote to memory of 4628	2180	aed6faaa247a9e1b1606f8b3858be9249f10e4e77490f494b026b0e9bd8a4146.exe	takeown.exe
PID 2180 wrote to memory of 4628	2180	aed6faaa247a9e1b1606f8b3858be9249f10e4e77490f494b026b0e9bd8a4146.exe	takeown.exe
PID 2180 wrote to memory of 3856	2180	aed6faaa247a9e1b1606f8b3858be9249f10e4e77490f494b026b0e9bd8a4146.exe	icacls.exe
PID 2180 wrote to memory of 3856	2180	aed6faaa247a9e1b1606f8b3858be9249f10e4e77490f494b026b0e9bd8a4146.exe	icacls.exe
PID 2180 wrote to memory of 3856	2180	aed6faaa247a9e1b1606f8b3858be9249f10e4e77490f494b026b0e9bd8a4146.exe	icacls.exe
PID 2180 wrote to memory of 2556	2180	aed6faaa247a9e1b1606f8b3858be9249f10e4e77490f494b026b0e9bd8a4146.exe	takeown.exe
PID 2180 wrote to memory of 2556	2180	aed6faaa247a9e1b1606f8b3858be9249f10e4e77490f494b026b0e9bd8a4146.exe	takeown.exe
PID 2180 wrote to memory of 2556	2180	aed6faaa247a9e1b1606f8b3858be9249f10e4e77490f494b026b0e9bd8a4146.exe	takeown.exe
PID 2180 wrote to memory of 3972	2180	aed6faaa247a9e1b1606f8b3858be9249f10e4e77490f494b026b0e9bd8a4146.exe	icacls.exe
PID 2180 wrote to memory of 3972	2180	aed6faaa247a9e1b1606f8b3858be9249f10e4e77490f494b026b0e9bd8a4146.exe	icacls.exe
PID 2180 wrote to memory of 3972	2180	aed6faaa247a9e1b1606f8b3858be9249f10e4e77490f494b026b0e9bd8a4146.exe	icacls.exe
PID 2180 wrote to memory of 4968	2180	aed6faaa247a9e1b1606f8b3858be9249f10e4e77490f494b026b0e9bd8a4146.exe	takeown.exe
PID 2180 wrote to memory of 4968	2180	aed6faaa247a9e1b1606f8b3858be9249f10e4e77490f494b026b0e9bd8a4146.exe	takeown.exe
PID 2180 wrote to memory of 4968	2180	aed6faaa247a9e1b1606f8b3858be9249f10e4e77490f494b026b0e9bd8a4146.exe	takeown.exe
PID 2180 wrote to memory of 4996	2180	aed6faaa247a9e1b1606f8b3858be9249f10e4e77490f494b026b0e9bd8a4146.exe	icacls.exe
PID 2180 wrote to memory of 4996	2180	aed6faaa247a9e1b1606f8b3858be9249f10e4e77490f494b026b0e9bd8a4146.exe	icacls.exe
PID 2180 wrote to memory of 4996	2180	aed6faaa247a9e1b1606f8b3858be9249f10e4e77490f494b026b0e9bd8a4146.exe	icacls.exe

C:\Users\Admin\AppData\Local\Temp\aed6faaa247a9e1b1606f8b3858be9249f10e4e77490f494b026b0e9bd8a4146.exe
"C:\Users\Admin\AppData\Local\Temp\aed6faaa247a9e1b1606f8b3858be9249f10e4e77490f494b026b0e9bd8a4146.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2180

C:\Windows\SysWOW64\takeown.exe
C:\Windows\System32\takeown.exe /f "C:\Windows\System32\cmd.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:3828

C:\Windows\SysWOW64\icacls.exe
C:\Windows\System32\icacls.exe "C:\Windows\System32\cmd.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:2404

C:\Windows\SysWOW64\takeown.exe
C:\Windows\System32\takeown.exe /f "C:\Windows\System32\ftp.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:4628

C:\Windows\SysWOW64\icacls.exe
C:\Windows\System32\icacls.exe "C:\Windows\System32\ftp.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:3856

C:\Windows\SysWOW64\takeown.exe
C:\Windows\System32\takeown.exe /f "C:\Windows\System32\wscript.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:2556

C:\Windows\SysWOW64\icacls.exe
C:\Windows\System32\icacls.exe "C:\Windows\System32\wscript.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:3972

C:\Windows\SysWOW64\takeown.exe
C:\Windows\System32\takeown.exe /f "C:\Windows\System32\cscript.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:4968

C:\Windows\SysWOW64\icacls.exe
C:\Windows\System32\icacls.exe "C:\Windows\System32\cscript.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:4996

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

1

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2404-135-0x0000000000000000-mapping.dmp

Download
memory/2556-138-0x0000000000000000-mapping.dmp

Download
memory/3828-134-0x0000000000000000-mapping.dmp

Download
memory/3856-137-0x0000000000000000-mapping.dmp

Download
memory/3972-139-0x0000000000000000-mapping.dmp

Download
memory/4628-136-0x0000000000000000-mapping.dmp

Download
memory/4968-140-0x0000000000000000-mapping.dmp

Download
memory/4996-141-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing