7d72b60f4530b1e737f117ff4da196a49aceef70b1b90a5f7875c3197dcb7d5c

General

Target

7d72b60f4530b1e737f117ff4da196a49aceef70b1b90a5f7875c3197dcb7d5c.exe
Size

40KB
MD5

420e66c94fa92a84d6a6a0693aadd2f0
SHA1

76ab9090301c225949be30ad8d3050d2932686a1
SHA256

7d72b60f4530b1e737f117ff4da196a49aceef70b1b90a5f7875c3197dcb7d5c
SHA512

33b85f294f69e8a362171d79e12589f829233eccbd78d2349842f706b91b132a8e8d19a34170bbdf22d0c33d6cae801dcc396059f3732dae656950212e008717
SSDEEP

768:/2I3OmRXn+XcBKT8ubtV+roOzohbAtL3fCe/KKMv1R3hQQNX:/2I3fn1BKgueoOzohbAtL3K3hQ4X

Score

8^/10

discovery exploit

Malware Config

Signatures

Possible privilege escalation attempt 8 IoCs
exploit

Processes:

icacls.exetakeown.exeicacls.exetakeown.exeicacls.exetakeown.exeicacls.exetakeown.exe

pid process

4456 icacls.exe
2084 takeown.exe
5080 icacls.exe
632 takeown.exe
4712 icacls.exe
5004 takeown.exe
4848 icacls.exe
2592 takeown.exe
Modifies file permissions 1 TTPs 8 IoCs
discovery

File Permissions Modification
T1222

Processes:

icacls.exetakeown.exeicacls.exetakeown.exeicacls.exetakeown.exeicacls.exetakeown.exe

pid process

4456 icacls.exe
2084 takeown.exe
5080 icacls.exe
632 takeown.exe
4712 icacls.exe
5004 takeown.exe
4848 icacls.exe
2592 takeown.exe

pid	process
4456	icacls.exe
2084	takeown.exe
5080	icacls.exe
632	takeown.exe
4712	icacls.exe
5004	takeown.exe
4848	icacls.exe
2592	takeown.exe

pid	process
4456	icacls.exe
2084	takeown.exe
5080	icacls.exe
632	takeown.exe
4712	icacls.exe
5004	takeown.exe
4848	icacls.exe
2592	takeown.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

takeown.exetakeown.exetakeown.exetakeown.exe

description	pid	process
Token: SeTakeOwnershipPrivilege	2084	takeown.exe
Token: SeTakeOwnershipPrivilege	5004	takeown.exe
Token: SeTakeOwnershipPrivilege	632	takeown.exe
Token: SeTakeOwnershipPrivilege	2592	takeown.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

7d72b60f4530b1e737f117ff4da196a49aceef70b1b90a5f7875c3197dcb7d5c.exe

pid process

2872 7d72b60f4530b1e737f117ff4da196a49aceef70b1b90a5f7875c3197dcb7d5c.exe

pid	process
2872	7d72b60f4530b1e737f117ff4da196a49aceef70b1b90a5f7875c3197dcb7d5c.exe

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

7d72b60f4530b1e737f117ff4da196a49aceef70b1b90a5f7875c3197dcb7d5c.exe

description	pid	process	target process
PID 2872 wrote to memory of 2084	2872	7d72b60f4530b1e737f117ff4da196a49aceef70b1b90a5f7875c3197dcb7d5c.exe	takeown.exe
PID 2872 wrote to memory of 2084	2872	7d72b60f4530b1e737f117ff4da196a49aceef70b1b90a5f7875c3197dcb7d5c.exe	takeown.exe
PID 2872 wrote to memory of 2084	2872	7d72b60f4530b1e737f117ff4da196a49aceef70b1b90a5f7875c3197dcb7d5c.exe	takeown.exe
PID 2872 wrote to memory of 5080	2872	7d72b60f4530b1e737f117ff4da196a49aceef70b1b90a5f7875c3197dcb7d5c.exe	icacls.exe
PID 2872 wrote to memory of 5080	2872	7d72b60f4530b1e737f117ff4da196a49aceef70b1b90a5f7875c3197dcb7d5c.exe	icacls.exe
PID 2872 wrote to memory of 5080	2872	7d72b60f4530b1e737f117ff4da196a49aceef70b1b90a5f7875c3197dcb7d5c.exe	icacls.exe
PID 2872 wrote to memory of 632	2872	7d72b60f4530b1e737f117ff4da196a49aceef70b1b90a5f7875c3197dcb7d5c.exe	takeown.exe
PID 2872 wrote to memory of 632	2872	7d72b60f4530b1e737f117ff4da196a49aceef70b1b90a5f7875c3197dcb7d5c.exe	takeown.exe
PID 2872 wrote to memory of 632	2872	7d72b60f4530b1e737f117ff4da196a49aceef70b1b90a5f7875c3197dcb7d5c.exe	takeown.exe
PID 2872 wrote to memory of 4456	2872	7d72b60f4530b1e737f117ff4da196a49aceef70b1b90a5f7875c3197dcb7d5c.exe	icacls.exe
PID 2872 wrote to memory of 4456	2872	7d72b60f4530b1e737f117ff4da196a49aceef70b1b90a5f7875c3197dcb7d5c.exe	icacls.exe
PID 2872 wrote to memory of 4456	2872	7d72b60f4530b1e737f117ff4da196a49aceef70b1b90a5f7875c3197dcb7d5c.exe	icacls.exe
PID 2872 wrote to memory of 2592	2872	7d72b60f4530b1e737f117ff4da196a49aceef70b1b90a5f7875c3197dcb7d5c.exe	takeown.exe
PID 2872 wrote to memory of 2592	2872	7d72b60f4530b1e737f117ff4da196a49aceef70b1b90a5f7875c3197dcb7d5c.exe	takeown.exe
PID 2872 wrote to memory of 2592	2872	7d72b60f4530b1e737f117ff4da196a49aceef70b1b90a5f7875c3197dcb7d5c.exe	takeown.exe
PID 2872 wrote to memory of 4848	2872	7d72b60f4530b1e737f117ff4da196a49aceef70b1b90a5f7875c3197dcb7d5c.exe	icacls.exe
PID 2872 wrote to memory of 4848	2872	7d72b60f4530b1e737f117ff4da196a49aceef70b1b90a5f7875c3197dcb7d5c.exe	icacls.exe
PID 2872 wrote to memory of 4848	2872	7d72b60f4530b1e737f117ff4da196a49aceef70b1b90a5f7875c3197dcb7d5c.exe	icacls.exe
PID 2872 wrote to memory of 5004	2872	7d72b60f4530b1e737f117ff4da196a49aceef70b1b90a5f7875c3197dcb7d5c.exe	takeown.exe
PID 2872 wrote to memory of 5004	2872	7d72b60f4530b1e737f117ff4da196a49aceef70b1b90a5f7875c3197dcb7d5c.exe	takeown.exe
PID 2872 wrote to memory of 5004	2872	7d72b60f4530b1e737f117ff4da196a49aceef70b1b90a5f7875c3197dcb7d5c.exe	takeown.exe
PID 2872 wrote to memory of 4712	2872	7d72b60f4530b1e737f117ff4da196a49aceef70b1b90a5f7875c3197dcb7d5c.exe	icacls.exe
PID 2872 wrote to memory of 4712	2872	7d72b60f4530b1e737f117ff4da196a49aceef70b1b90a5f7875c3197dcb7d5c.exe	icacls.exe
PID 2872 wrote to memory of 4712	2872	7d72b60f4530b1e737f117ff4da196a49aceef70b1b90a5f7875c3197dcb7d5c.exe	icacls.exe

C:\Users\Admin\AppData\Local\Temp\7d72b60f4530b1e737f117ff4da196a49aceef70b1b90a5f7875c3197dcb7d5c.exe
"C:\Users\Admin\AppData\Local\Temp\7d72b60f4530b1e737f117ff4da196a49aceef70b1b90a5f7875c3197dcb7d5c.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2872

C:\Windows\SysWOW64\takeown.exe
C:\Windows\System32\takeown.exe /f "C:\Windows\System32\cmd.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:2084

C:\Windows\SysWOW64\icacls.exe
C:\Windows\System32\icacls.exe "C:\Windows\System32\cmd.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:5080

C:\Windows\SysWOW64\takeown.exe
C:\Windows\System32\takeown.exe /f "C:\Windows\System32\ftp.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:632

C:\Windows\SysWOW64\icacls.exe
C:\Windows\System32\icacls.exe "C:\Windows\System32\cscript.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:4712

C:\Windows\SysWOW64\takeown.exe
C:\Windows\System32\takeown.exe /f "C:\Windows\System32\cscript.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:5004

C:\Windows\SysWOW64\icacls.exe
C:\Windows\System32\icacls.exe "C:\Windows\System32\wscript.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:4848

C:\Windows\SysWOW64\takeown.exe
C:\Windows\System32\takeown.exe /f "C:\Windows\System32\wscript.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:2592

C:\Windows\SysWOW64\icacls.exe
C:\Windows\System32\icacls.exe "C:\Windows\System32\ftp.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:4456

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File Permissions Modification

1

T1222

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/632-136-0x0000000000000000-mapping.dmp

Download
memory/2084-134-0x0000000000000000-mapping.dmp

Download
memory/2592-138-0x0000000000000000-mapping.dmp

Download
memory/4456-137-0x0000000000000000-mapping.dmp

Download
memory/4712-141-0x0000000000000000-mapping.dmp

Download
memory/4848-139-0x0000000000000000-mapping.dmp

Download
memory/5004-140-0x0000000000000000-mapping.dmp

Download
memory/5080-135-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing