d0c2100d2adc7086ccaae6cd978893c61d1e3325722426fc691faef321629301

Analysis

max time kernel
30s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
20-11-2022 07:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d0c2100d2adc7086ccaae6cd978893c61d1e3325722426fc691faef321629301.exe
Size

60KB
MD5

1b42d2e302a7a4515d1a3e6f07f83731
SHA1

1eebd3649a421f2c3a7104f6335c9878c86f37e7
SHA256

d0c2100d2adc7086ccaae6cd978893c61d1e3325722426fc691faef321629301
SHA512

899f1c221c01ad1a98071fe8f59be19dd1001e10046b9c41244a80b4ecbf2de9a240fb0adb17adc5090bf8e320f9937f8bc9844c32bf7f8134678652d3c4cdf2
SSDEEP

768:NYi/INlRKoWfh0EADKL6dxzhk7aSIUiC1ZPLG/xRi0IT8FI3CKqUxNZHs:ND/IN2h/U1AIUiC1Z6/Wx8QRqwjHs

Score

8^/10

discovery exploit

Malware Config

Signatures

Possible privilege escalation attempt 2 IoCs
exploit

Processes:

takeown.exeicacls.exe

pid process

2044 takeown.exe
1736 icacls.exe
Modifies file permissions 1 TTPs 2 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

takeown.exeicacls.exe

pid process

2044 takeown.exe
1736 icacls.exe

pid	process
2044	takeown.exe
1736	icacls.exe

pid	process
2044	takeown.exe
1736	icacls.exe

Drops file in System32 directory 2 IoCs

Processes:

d0c2100d2adc7086ccaae6cd978893c61d1e3325722426fc691faef321629301.exe

description	ioc	process
File created	\??\c:\windows\SysWOW64\cytub.exe	d0c2100d2adc7086ccaae6cd978893c61d1e3325722426fc691faef321629301.exe
File opened for modification	\??\c:\windows\SysWOW64\cytub.exe	d0c2100d2adc7086ccaae6cd978893c61d1e3325722426fc691faef321629301.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

d0c2100d2adc7086ccaae6cd978893c61d1e3325722426fc691faef321629301.exe

pid process

1064 d0c2100d2adc7086ccaae6cd978893c61d1e3325722426fc691faef321629301.exe

pid	process
1064	d0c2100d2adc7086ccaae6cd978893c61d1e3325722426fc691faef321629301.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

d0c2100d2adc7086ccaae6cd978893c61d1e3325722426fc691faef321629301.exe

description	pid	process	target process
PID 1064 wrote to memory of 2044	1064	d0c2100d2adc7086ccaae6cd978893c61d1e3325722426fc691faef321629301.exe	takeown.exe
PID 1064 wrote to memory of 2044	1064	d0c2100d2adc7086ccaae6cd978893c61d1e3325722426fc691faef321629301.exe	takeown.exe
PID 1064 wrote to memory of 2044	1064	d0c2100d2adc7086ccaae6cd978893c61d1e3325722426fc691faef321629301.exe	takeown.exe
PID 1064 wrote to memory of 2044	1064	d0c2100d2adc7086ccaae6cd978893c61d1e3325722426fc691faef321629301.exe	takeown.exe
PID 1064 wrote to memory of 1736	1064	d0c2100d2adc7086ccaae6cd978893c61d1e3325722426fc691faef321629301.exe	icacls.exe
PID 1064 wrote to memory of 1736	1064	d0c2100d2adc7086ccaae6cd978893c61d1e3325722426fc691faef321629301.exe	icacls.exe
PID 1064 wrote to memory of 1736	1064	d0c2100d2adc7086ccaae6cd978893c61d1e3325722426fc691faef321629301.exe	icacls.exe
PID 1064 wrote to memory of 1736	1064	d0c2100d2adc7086ccaae6cd978893c61d1e3325722426fc691faef321629301.exe	icacls.exe

C:\Users\Admin\AppData\Local\Temp\d0c2100d2adc7086ccaae6cd978893c61d1e3325722426fc691faef321629301.exe
"C:\Users\Admin\AppData\Local\Temp\d0c2100d2adc7086ccaae6cd978893c61d1e3325722426fc691faef321629301.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1064

C:\Windows\SysWOW64\takeown.exe
C:\Windows\system32\takeown.exe /f "c:\windows\system32\cytub.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:2044

C:\Windows\SysWOW64\icacls.exe
C:\Windows\system32\icacls.exe "c:\windows\system32\cytub.exe" /grant SYSTEM:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1736

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\??\c:\windows\SysWOW64\cytub.exe
Filesize
60KB

MD5
1b42d2e302a7a4515d1a3e6f07f83731

SHA1
1eebd3649a421f2c3a7104f6335c9878c86f37e7

SHA256
d0c2100d2adc7086ccaae6cd978893c61d1e3325722426fc691faef321629301

SHA512
899f1c221c01ad1a98071fe8f59be19dd1001e10046b9c41244a80b4ecbf2de9a240fb0adb17adc5090bf8e320f9937f8bc9844c32bf7f8134678652d3c4cdf2

Download Submit
memory/1736-57-0x0000000000000000-mapping.dmp

Download
memory/2044-56-0x0000000000000000-mapping.dmp

Download