7d72b60f4530b1e737f117ff4da196a49aceef70b1b90a5f7875c3197dcb7d5c

General

Target

7d72b60f4530b1e737f117ff4da196a49aceef70b1b90a5f7875c3197dcb7d5c.exe
Size

40KB
MD5

420e66c94fa92a84d6a6a0693aadd2f0
SHA1

76ab9090301c225949be30ad8d3050d2932686a1
SHA256

7d72b60f4530b1e737f117ff4da196a49aceef70b1b90a5f7875c3197dcb7d5c
SHA512

33b85f294f69e8a362171d79e12589f829233eccbd78d2349842f706b91b132a8e8d19a34170bbdf22d0c33d6cae801dcc396059f3732dae656950212e008717
SSDEEP

768:/2I3OmRXn+XcBKT8ubtV+roOzohbAtL3fCe/KKMv1R3hQQNX:/2I3fn1BKgueoOzohbAtL3K3hQ4X

Score

8^/10

discovery exploit

Malware Config

Signatures

Possible privilege escalation attempt 8 IoCs
exploit

Processes:

icacls.exetakeown.exeicacls.exetakeown.exeicacls.exetakeown.exeicacls.exetakeown.exe

pid process

1584 icacls.exe
428 takeown.exe
1772 icacls.exe
520 takeown.exe
1800 icacls.exe
1176 takeown.exe
572 icacls.exe
292 takeown.exe
Modifies file permissions 1 TTPs 8 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

takeown.exeicacls.exetakeown.exeicacls.exetakeown.exeicacls.exetakeown.exeicacls.exe

pid process

428 takeown.exe
1772 icacls.exe
520 takeown.exe
1800 icacls.exe
1176 takeown.exe
572 icacls.exe
292 takeown.exe
1584 icacls.exe

pid	process
1584	icacls.exe
428	takeown.exe
1772	icacls.exe
520	takeown.exe
1800	icacls.exe
1176	takeown.exe
572	icacls.exe
292	takeown.exe

pid	process
428	takeown.exe
1772	icacls.exe
520	takeown.exe
1800	icacls.exe
1176	takeown.exe
572	icacls.exe
292	takeown.exe
1584	icacls.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

takeown.exetakeown.exetakeown.exetakeown.exe

description	pid	process
Token: SeTakeOwnershipPrivilege	520	takeown.exe
Token: SeTakeOwnershipPrivilege	292	takeown.exe
Token: SeTakeOwnershipPrivilege	1176	takeown.exe
Token: SeTakeOwnershipPrivilege	428	takeown.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

7d72b60f4530b1e737f117ff4da196a49aceef70b1b90a5f7875c3197dcb7d5c.exe

pid process

760 7d72b60f4530b1e737f117ff4da196a49aceef70b1b90a5f7875c3197dcb7d5c.exe

pid	process
760	7d72b60f4530b1e737f117ff4da196a49aceef70b1b90a5f7875c3197dcb7d5c.exe

Suspicious use of WriteProcessMemory 32 IoCs

Processes:

7d72b60f4530b1e737f117ff4da196a49aceef70b1b90a5f7875c3197dcb7d5c.exe

description	pid	process	target process
PID 760 wrote to memory of 428	760	7d72b60f4530b1e737f117ff4da196a49aceef70b1b90a5f7875c3197dcb7d5c.exe	takeown.exe
PID 760 wrote to memory of 428	760	7d72b60f4530b1e737f117ff4da196a49aceef70b1b90a5f7875c3197dcb7d5c.exe	takeown.exe
PID 760 wrote to memory of 428	760	7d72b60f4530b1e737f117ff4da196a49aceef70b1b90a5f7875c3197dcb7d5c.exe	takeown.exe
PID 760 wrote to memory of 428	760	7d72b60f4530b1e737f117ff4da196a49aceef70b1b90a5f7875c3197dcb7d5c.exe	takeown.exe
PID 760 wrote to memory of 1772	760	7d72b60f4530b1e737f117ff4da196a49aceef70b1b90a5f7875c3197dcb7d5c.exe	icacls.exe
PID 760 wrote to memory of 1772	760	7d72b60f4530b1e737f117ff4da196a49aceef70b1b90a5f7875c3197dcb7d5c.exe	icacls.exe
PID 760 wrote to memory of 1772	760	7d72b60f4530b1e737f117ff4da196a49aceef70b1b90a5f7875c3197dcb7d5c.exe	icacls.exe
PID 760 wrote to memory of 1772	760	7d72b60f4530b1e737f117ff4da196a49aceef70b1b90a5f7875c3197dcb7d5c.exe	icacls.exe
PID 760 wrote to memory of 520	760	7d72b60f4530b1e737f117ff4da196a49aceef70b1b90a5f7875c3197dcb7d5c.exe	takeown.exe
PID 760 wrote to memory of 520	760	7d72b60f4530b1e737f117ff4da196a49aceef70b1b90a5f7875c3197dcb7d5c.exe	takeown.exe
PID 760 wrote to memory of 520	760	7d72b60f4530b1e737f117ff4da196a49aceef70b1b90a5f7875c3197dcb7d5c.exe	takeown.exe
PID 760 wrote to memory of 520	760	7d72b60f4530b1e737f117ff4da196a49aceef70b1b90a5f7875c3197dcb7d5c.exe	takeown.exe
PID 760 wrote to memory of 1800	760	7d72b60f4530b1e737f117ff4da196a49aceef70b1b90a5f7875c3197dcb7d5c.exe	icacls.exe
PID 760 wrote to memory of 1800	760	7d72b60f4530b1e737f117ff4da196a49aceef70b1b90a5f7875c3197dcb7d5c.exe	icacls.exe
PID 760 wrote to memory of 1800	760	7d72b60f4530b1e737f117ff4da196a49aceef70b1b90a5f7875c3197dcb7d5c.exe	icacls.exe
PID 760 wrote to memory of 1800	760	7d72b60f4530b1e737f117ff4da196a49aceef70b1b90a5f7875c3197dcb7d5c.exe	icacls.exe
PID 760 wrote to memory of 1176	760	7d72b60f4530b1e737f117ff4da196a49aceef70b1b90a5f7875c3197dcb7d5c.exe	takeown.exe
PID 760 wrote to memory of 1176	760	7d72b60f4530b1e737f117ff4da196a49aceef70b1b90a5f7875c3197dcb7d5c.exe	takeown.exe
PID 760 wrote to memory of 1176	760	7d72b60f4530b1e737f117ff4da196a49aceef70b1b90a5f7875c3197dcb7d5c.exe	takeown.exe
PID 760 wrote to memory of 1176	760	7d72b60f4530b1e737f117ff4da196a49aceef70b1b90a5f7875c3197dcb7d5c.exe	takeown.exe
PID 760 wrote to memory of 572	760	7d72b60f4530b1e737f117ff4da196a49aceef70b1b90a5f7875c3197dcb7d5c.exe	icacls.exe
PID 760 wrote to memory of 572	760	7d72b60f4530b1e737f117ff4da196a49aceef70b1b90a5f7875c3197dcb7d5c.exe	icacls.exe
PID 760 wrote to memory of 572	760	7d72b60f4530b1e737f117ff4da196a49aceef70b1b90a5f7875c3197dcb7d5c.exe	icacls.exe
PID 760 wrote to memory of 572	760	7d72b60f4530b1e737f117ff4da196a49aceef70b1b90a5f7875c3197dcb7d5c.exe	icacls.exe
PID 760 wrote to memory of 292	760	7d72b60f4530b1e737f117ff4da196a49aceef70b1b90a5f7875c3197dcb7d5c.exe	takeown.exe
PID 760 wrote to memory of 292	760	7d72b60f4530b1e737f117ff4da196a49aceef70b1b90a5f7875c3197dcb7d5c.exe	takeown.exe
PID 760 wrote to memory of 292	760	7d72b60f4530b1e737f117ff4da196a49aceef70b1b90a5f7875c3197dcb7d5c.exe	takeown.exe
PID 760 wrote to memory of 292	760	7d72b60f4530b1e737f117ff4da196a49aceef70b1b90a5f7875c3197dcb7d5c.exe	takeown.exe
PID 760 wrote to memory of 1584	760	7d72b60f4530b1e737f117ff4da196a49aceef70b1b90a5f7875c3197dcb7d5c.exe	icacls.exe
PID 760 wrote to memory of 1584	760	7d72b60f4530b1e737f117ff4da196a49aceef70b1b90a5f7875c3197dcb7d5c.exe	icacls.exe
PID 760 wrote to memory of 1584	760	7d72b60f4530b1e737f117ff4da196a49aceef70b1b90a5f7875c3197dcb7d5c.exe	icacls.exe
PID 760 wrote to memory of 1584	760	7d72b60f4530b1e737f117ff4da196a49aceef70b1b90a5f7875c3197dcb7d5c.exe	icacls.exe

C:\Users\Admin\AppData\Local\Temp\7d72b60f4530b1e737f117ff4da196a49aceef70b1b90a5f7875c3197dcb7d5c.exe
"C:\Users\Admin\AppData\Local\Temp\7d72b60f4530b1e737f117ff4da196a49aceef70b1b90a5f7875c3197dcb7d5c.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:760

C:\Windows\SysWOW64\takeown.exe
C:\Windows\System32\takeown.exe /f "C:\Windows\System32\cmd.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:428

C:\Windows\SysWOW64\icacls.exe
C:\Windows\System32\icacls.exe "C:\Windows\System32\cmd.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1772

C:\Windows\SysWOW64\takeown.exe
C:\Windows\System32\takeown.exe /f "C:\Windows\System32\ftp.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:520

C:\Windows\SysWOW64\icacls.exe
C:\Windows\System32\icacls.exe "C:\Windows\System32\ftp.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1800

C:\Windows\SysWOW64\takeown.exe
C:\Windows\System32\takeown.exe /f "C:\Windows\System32\wscript.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:1176

C:\Windows\SysWOW64\icacls.exe
C:\Windows\System32\icacls.exe "C:\Windows\System32\wscript.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:572

C:\Windows\SysWOW64\takeown.exe
C:\Windows\System32\takeown.exe /f "C:\Windows\System32\cscript.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:292

C:\Windows\SysWOW64\icacls.exe
C:\Windows\System32\icacls.exe "C:\Windows\System32\cscript.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1584

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

1

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/292-62-0x0000000000000000-mapping.dmp

Download
memory/428-56-0x0000000000000000-mapping.dmp

Download
memory/520-58-0x0000000000000000-mapping.dmp

Download
memory/572-61-0x0000000000000000-mapping.dmp

Download
memory/1176-60-0x0000000000000000-mapping.dmp

Download
memory/1584-63-0x0000000000000000-mapping.dmp

Download
memory/1772-57-0x0000000000000000-mapping.dmp

Download
memory/1800-59-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing