7cfc1df9f42d9f34655444ec06986197047013c3c2e85099ec28ea5f35c73f3c

Analysis

max time kernel
92s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
20-11-2022 14:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7cfc1df9f42d9f34655444ec06986197047013c3c2e85099ec28ea5f35c73f3c.exe
Size

48KB
MD5

40279abbda48be88c19c7cd63aa06c41
SHA1

82d398254862e3feead36fbe017e98eb120869be
SHA256

7cfc1df9f42d9f34655444ec06986197047013c3c2e85099ec28ea5f35c73f3c
SHA512

5a4c26a7fa6223f10cc7be9909f92578cb86226169239f7b2140c8ed9c6da79155e50c805ba9401471644e316a90eed1a798232529d6ca7eac66f9b2fbdd9a2d
SSDEEP

768:DaCYNQEne0AMxpCttjRsnry4Q3sOVxPKAtISJsEkQ:+CeQNRwr68OVxP8SJpkQ

Score

8^/10

discovery exploit persistence

Malware Config

Signatures

Possible privilege escalation attempt 2 IoCs
exploit

Processes:

takeown.exeicacls.exe

pid process

5056 takeown.exe
4960 icacls.exe
Modifies file permissions 1 TTPs 2 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

takeown.exeicacls.exe

pid process

5056 takeown.exe
4960 icacls.exe

pid	process
5056	takeown.exe
4960	icacls.exe

pid	process
5056	takeown.exe
4960	icacls.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

7cfc1df9f42d9f34655444ec06986197047013c3c2e85099ec28ea5f35c73f3c.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\hXZZEja = "c:\\windows\\system32\\wlsmg.exe"	7cfc1df9f42d9f34655444ec06986197047013c3c2e85099ec28ea5f35c73f3c.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	7cfc1df9f42d9f34655444ec06986197047013c3c2e85099ec28ea5f35c73f3c.exe

Drops file in System32 directory 2 IoCs

Processes:

7cfc1df9f42d9f34655444ec06986197047013c3c2e85099ec28ea5f35c73f3c.exe

description	ioc	process
File created	\??\c:\windows\SysWOW64\wlsmg.exe	7cfc1df9f42d9f34655444ec06986197047013c3c2e85099ec28ea5f35c73f3c.exe
File opened for modification	\??\c:\windows\SysWOW64\wlsmg.exe	7cfc1df9f42d9f34655444ec06986197047013c3c2e85099ec28ea5f35c73f3c.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

7cfc1df9f42d9f34655444ec06986197047013c3c2e85099ec28ea5f35c73f3c.exe

pid process

4284 7cfc1df9f42d9f34655444ec06986197047013c3c2e85099ec28ea5f35c73f3c.exe

pid	process
4284	7cfc1df9f42d9f34655444ec06986197047013c3c2e85099ec28ea5f35c73f3c.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

7cfc1df9f42d9f34655444ec06986197047013c3c2e85099ec28ea5f35c73f3c.exe

description	pid	process	target process
PID 4284 wrote to memory of 5056	4284	7cfc1df9f42d9f34655444ec06986197047013c3c2e85099ec28ea5f35c73f3c.exe	takeown.exe
PID 4284 wrote to memory of 5056	4284	7cfc1df9f42d9f34655444ec06986197047013c3c2e85099ec28ea5f35c73f3c.exe	takeown.exe
PID 4284 wrote to memory of 5056	4284	7cfc1df9f42d9f34655444ec06986197047013c3c2e85099ec28ea5f35c73f3c.exe	takeown.exe
PID 4284 wrote to memory of 4960	4284	7cfc1df9f42d9f34655444ec06986197047013c3c2e85099ec28ea5f35c73f3c.exe	icacls.exe
PID 4284 wrote to memory of 4960	4284	7cfc1df9f42d9f34655444ec06986197047013c3c2e85099ec28ea5f35c73f3c.exe	icacls.exe
PID 4284 wrote to memory of 4960	4284	7cfc1df9f42d9f34655444ec06986197047013c3c2e85099ec28ea5f35c73f3c.exe	icacls.exe

C:\Users\Admin\AppData\Local\Temp\7cfc1df9f42d9f34655444ec06986197047013c3c2e85099ec28ea5f35c73f3c.exe
"C:\Users\Admin\AppData\Local\Temp\7cfc1df9f42d9f34655444ec06986197047013c3c2e85099ec28ea5f35c73f3c.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4284

C:\Windows\SysWOW64\takeown.exe
C:\Windows\system32\takeown.exe /f "c:\windows\system32\wlsmg.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:5056

C:\Windows\SysWOW64\icacls.exe
C:\Windows\system32\icacls.exe "c:\windows\system32\wlsmg.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:4960

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\??\c:\windows\SysWOW64\wlsmg.exe
Filesize
48KB

MD5
40279abbda48be88c19c7cd63aa06c41

SHA1
82d398254862e3feead36fbe017e98eb120869be

SHA256
7cfc1df9f42d9f34655444ec06986197047013c3c2e85099ec28ea5f35c73f3c

SHA512
5a4c26a7fa6223f10cc7be9909f92578cb86226169239f7b2140c8ed9c6da79155e50c805ba9401471644e316a90eed1a798232529d6ca7eac66f9b2fbdd9a2d

Download Submit
memory/4960-135-0x0000000000000000-mapping.dmp

Download
memory/5056-134-0x0000000000000000-mapping.dmp

Download