2f09f7c4c3c38765e47c10b1df54221ed214c6cbde2d92372e3e703a2c2ab891

Analysis

max time kernel
30s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
20-11-2022 14:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2f09f7c4c3c38765e47c10b1df54221ed214c6cbde2d92372e3e703a2c2ab891.exe
Size

36KB
MD5

52d948b20a602eca105bda63a289cf31
SHA1

93c7275ef8e8c5587bfa3b008b88155469b050f4
SHA256

2f09f7c4c3c38765e47c10b1df54221ed214c6cbde2d92372e3e703a2c2ab891
SHA512

72a9c9f567d2c3d90212e36493ac44579c2f5ec5cf8022de64a07a21baaf6be20487facb5ffa3ef1576505ccba9759928526bd450d6374fb1839681598f42bc5
SSDEEP

384:/TdS2ttzduKTfwDz8Bef3hC6/KqnijyupEtL9mun7jDrlX1DZIiu9thSpEvZT0hz:/wYtzdu8cz8Uvs2Nit+DrllDKiXTRD

Score

8^/10

discovery exploit persistence

Malware Config

Signatures

Possible privilege escalation attempt 2 IoCs
exploit

Processes:

takeown.exeicacls.exe

pid process

1300 takeown.exe
2044 icacls.exe
Modifies file permissions 1 TTPs 2 IoCs
discovery

File Permissions Modification
T1222

Processes:

takeown.exeicacls.exe

pid process

1300 takeown.exe
2044 icacls.exe

pid	process
1300	takeown.exe
2044	icacls.exe

pid	process
1300	takeown.exe
2044	icacls.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

2f09f7c4c3c38765e47c10b1df54221ed214c6cbde2d92372e3e703a2c2ab891.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	2f09f7c4c3c38765e47c10b1df54221ed214c6cbde2d92372e3e703a2c2ab891.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SPSKe = "C:\\Windows\\system32\\dgfi.exe"	2f09f7c4c3c38765e47c10b1df54221ed214c6cbde2d92372e3e703a2c2ab891.exe

Drops file in System32 directory 2 IoCs

Processes:

2f09f7c4c3c38765e47c10b1df54221ed214c6cbde2d92372e3e703a2c2ab891.exe

description	ioc	process
File created	C:\Windows\SysWOW64\dgfi.exe	2f09f7c4c3c38765e47c10b1df54221ed214c6cbde2d92372e3e703a2c2ab891.exe
File opened for modification	C:\Windows\SysWOW64\dgfi.exe	2f09f7c4c3c38765e47c10b1df54221ed214c6cbde2d92372e3e703a2c2ab891.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

2f09f7c4c3c38765e47c10b1df54221ed214c6cbde2d92372e3e703a2c2ab891.exe

pid process

1044 2f09f7c4c3c38765e47c10b1df54221ed214c6cbde2d92372e3e703a2c2ab891.exe

pid	process
1044	2f09f7c4c3c38765e47c10b1df54221ed214c6cbde2d92372e3e703a2c2ab891.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

2f09f7c4c3c38765e47c10b1df54221ed214c6cbde2d92372e3e703a2c2ab891.exe

description	pid	process	target process
PID 1044 wrote to memory of 1300	1044	2f09f7c4c3c38765e47c10b1df54221ed214c6cbde2d92372e3e703a2c2ab891.exe	takeown.exe
PID 1044 wrote to memory of 1300	1044	2f09f7c4c3c38765e47c10b1df54221ed214c6cbde2d92372e3e703a2c2ab891.exe	takeown.exe
PID 1044 wrote to memory of 1300	1044	2f09f7c4c3c38765e47c10b1df54221ed214c6cbde2d92372e3e703a2c2ab891.exe	takeown.exe
PID 1044 wrote to memory of 1300	1044	2f09f7c4c3c38765e47c10b1df54221ed214c6cbde2d92372e3e703a2c2ab891.exe	takeown.exe
PID 1044 wrote to memory of 2044	1044	2f09f7c4c3c38765e47c10b1df54221ed214c6cbde2d92372e3e703a2c2ab891.exe	icacls.exe
PID 1044 wrote to memory of 2044	1044	2f09f7c4c3c38765e47c10b1df54221ed214c6cbde2d92372e3e703a2c2ab891.exe	icacls.exe
PID 1044 wrote to memory of 2044	1044	2f09f7c4c3c38765e47c10b1df54221ed214c6cbde2d92372e3e703a2c2ab891.exe	icacls.exe
PID 1044 wrote to memory of 2044	1044	2f09f7c4c3c38765e47c10b1df54221ed214c6cbde2d92372e3e703a2c2ab891.exe	icacls.exe

C:\Users\Admin\AppData\Local\Temp\2f09f7c4c3c38765e47c10b1df54221ed214c6cbde2d92372e3e703a2c2ab891.exe
"C:\Users\Admin\AppData\Local\Temp\2f09f7c4c3c38765e47c10b1df54221ed214c6cbde2d92372e3e703a2c2ab891.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1044

C:\Windows\SysWOW64\takeown.exe
C:\Windows\system32\takeown.exe /f "C:\Windows\system32\dgfi.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1300

C:\Windows\SysWOW64\icacls.exe
C:\Windows\system32\icacls.exe "C:\Windows\system32\dgfi.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:2044

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

File Permissions Modification

T1222

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\dgfi.exe
Filesize
36KB

MD5
52d948b20a602eca105bda63a289cf31

SHA1
93c7275ef8e8c5587bfa3b008b88155469b050f4

SHA256
2f09f7c4c3c38765e47c10b1df54221ed214c6cbde2d92372e3e703a2c2ab891

SHA512
72a9c9f567d2c3d90212e36493ac44579c2f5ec5cf8022de64a07a21baaf6be20487facb5ffa3ef1576505ccba9759928526bd450d6374fb1839681598f42bc5

Download Submit
memory/1300-56-0x0000000000000000-mapping.dmp

Download
memory/2044-57-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads