03b92902efac8a740409310acc082b61534c02a9a604ef1e3b6b3a02ef4e6602

Analysis

max time kernel
22s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
20-11-2022 09:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

03b92902efac8a740409310acc082b61534c02a9a604ef1e3b6b3a02ef4e6602.exe
Size

56KB
MD5

232c612b145c1bce0199d83106deff36
SHA1

95218e487c297036263c9334c1fb2c07535e4d99
SHA256

03b92902efac8a740409310acc082b61534c02a9a604ef1e3b6b3a02ef4e6602
SHA512

0367c9c898e11673ffa8773f1e200d5a8088831f2ff709b2751bc5cc7e02942797b7cb3b8539059317ca6d1acada88f72b48e36eea798a08cd1d54203f61047f
SSDEEP

768:xue+uUAUytBbfCqOVzME3wQg04kop33pBSu5iMHa5XVUozKqC18ukwJE2hKwYrpr:x3+uUANB9SVflXj9GflqWM0Xq

Score

8^/10

discovery exploit

Malware Config

Signatures

Possible privilege escalation attempt 2 IoCs
exploit

Processes:

takeown.exeicacls.exe

pid process

1968 takeown.exe
912 icacls.exe
Modifies file permissions 1 TTPs 2 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

takeown.exeicacls.exe

pid process

1968 takeown.exe
912 icacls.exe

pid	process
1968	takeown.exe
912	icacls.exe

pid	process
1968	takeown.exe
912	icacls.exe

Drops file in System32 directory 2 IoCs

Processes:

03b92902efac8a740409310acc082b61534c02a9a604ef1e3b6b3a02ef4e6602.exe

description	ioc	process
File created	\??\c:\windows\SysWOW64\zwbz.exe	03b92902efac8a740409310acc082b61534c02a9a604ef1e3b6b3a02ef4e6602.exe
File opened for modification	\??\c:\windows\SysWOW64\zwbz.exe	03b92902efac8a740409310acc082b61534c02a9a604ef1e3b6b3a02ef4e6602.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

03b92902efac8a740409310acc082b61534c02a9a604ef1e3b6b3a02ef4e6602.exe

pid process

1360 03b92902efac8a740409310acc082b61534c02a9a604ef1e3b6b3a02ef4e6602.exe

pid	process
1360	03b92902efac8a740409310acc082b61534c02a9a604ef1e3b6b3a02ef4e6602.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

03b92902efac8a740409310acc082b61534c02a9a604ef1e3b6b3a02ef4e6602.exe

description	pid	process	target process
PID 1360 wrote to memory of 1968	1360	03b92902efac8a740409310acc082b61534c02a9a604ef1e3b6b3a02ef4e6602.exe	takeown.exe
PID 1360 wrote to memory of 1968	1360	03b92902efac8a740409310acc082b61534c02a9a604ef1e3b6b3a02ef4e6602.exe	takeown.exe
PID 1360 wrote to memory of 1968	1360	03b92902efac8a740409310acc082b61534c02a9a604ef1e3b6b3a02ef4e6602.exe	takeown.exe
PID 1360 wrote to memory of 1968	1360	03b92902efac8a740409310acc082b61534c02a9a604ef1e3b6b3a02ef4e6602.exe	takeown.exe
PID 1360 wrote to memory of 912	1360	03b92902efac8a740409310acc082b61534c02a9a604ef1e3b6b3a02ef4e6602.exe	icacls.exe
PID 1360 wrote to memory of 912	1360	03b92902efac8a740409310acc082b61534c02a9a604ef1e3b6b3a02ef4e6602.exe	icacls.exe
PID 1360 wrote to memory of 912	1360	03b92902efac8a740409310acc082b61534c02a9a604ef1e3b6b3a02ef4e6602.exe	icacls.exe
PID 1360 wrote to memory of 912	1360	03b92902efac8a740409310acc082b61534c02a9a604ef1e3b6b3a02ef4e6602.exe	icacls.exe

C:\Users\Admin\AppData\Local\Temp\03b92902efac8a740409310acc082b61534c02a9a604ef1e3b6b3a02ef4e6602.exe
"C:\Users\Admin\AppData\Local\Temp\03b92902efac8a740409310acc082b61534c02a9a604ef1e3b6b3a02ef4e6602.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1360

C:\Windows\SysWOW64\takeown.exe
C:\Windows\system32\takeown.exe /f "c:\windows\system32\zwbz.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1968

C:\Windows\SysWOW64\icacls.exe
C:\Windows\system32\icacls.exe "c:\windows\system32\zwbz.exe" /grant SYSTEM:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:912

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\??\c:\windows\SysWOW64\zwbz.exe
Filesize
56KB

MD5
232c612b145c1bce0199d83106deff36

SHA1
95218e487c297036263c9334c1fb2c07535e4d99

SHA256
03b92902efac8a740409310acc082b61534c02a9a604ef1e3b6b3a02ef4e6602

SHA512
0367c9c898e11673ffa8773f1e200d5a8088831f2ff709b2751bc5cc7e02942797b7cb3b8539059317ca6d1acada88f72b48e36eea798a08cd1d54203f61047f

Download Submit
memory/912-57-0x0000000000000000-mapping.dmp

Download
memory/1968-56-0x0000000000000000-mapping.dmp

Download