908461a89668ee1838d2d40d36e2649518d84a6b76d2ba29b61802f27f692787

General

Target

908461a89668ee1838d2d40d36e2649518d84a6b76d2ba29b61802f27f692787.exe
Size

40KB
MD5

31f1feab526b3258842d6a982b221790
SHA1

584cf13809b5cead1d1fc9c4c13cecef87536a36
SHA256

908461a89668ee1838d2d40d36e2649518d84a6b76d2ba29b61802f27f692787
SHA512

05c846d0be516d6e9eab7032e7604f49ee1e33e457cbd87be3ffc0e9e7878e1ca0fdd6db11ffda273b9de22269e9a68971aacbe5fc2674fd6681e2260385eee8
SSDEEP

768:/cv4Vf6cVVNLM/3XWYn1kXBvexvVONK0MoYnKNV:/ce7W/39ehgbnmV

Score

8^/10

discovery exploit

Malware Config

Signatures

Possible privilege escalation attempt 8 IoCs
exploit

Processes:

icacls.exetakeown.exeicacls.exetakeown.exeicacls.exetakeown.exeicacls.exetakeown.exe

pid process

1180 icacls.exe
1924 takeown.exe
1744 icacls.exe
1824 takeown.exe
1216 icacls.exe
944 takeown.exe
620 icacls.exe
464 takeown.exe
Modifies file permissions 1 TTPs 8 IoCs
discovery

File Permissions Modification
T1222

Processes:

icacls.exetakeown.exeicacls.exetakeown.exeicacls.exetakeown.exeicacls.exetakeown.exe

pid process

1216 icacls.exe
944 takeown.exe
620 icacls.exe
464 takeown.exe
1180 icacls.exe
1924 takeown.exe
1744 icacls.exe
1824 takeown.exe

pid	process
1180	icacls.exe
1924	takeown.exe
1744	icacls.exe
1824	takeown.exe
1216	icacls.exe
944	takeown.exe
620	icacls.exe
464	takeown.exe

pid	process
1216	icacls.exe
944	takeown.exe
620	icacls.exe
464	takeown.exe
1180	icacls.exe
1924	takeown.exe
1744	icacls.exe
1824	takeown.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

takeown.exetakeown.exetakeown.exetakeown.exe

description	pid	process
Token: SeTakeOwnershipPrivilege	1824	takeown.exe
Token: SeTakeOwnershipPrivilege	944	takeown.exe
Token: SeTakeOwnershipPrivilege	464	takeown.exe
Token: SeTakeOwnershipPrivilege	1924	takeown.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

908461a89668ee1838d2d40d36e2649518d84a6b76d2ba29b61802f27f692787.exe

pid process

1380 908461a89668ee1838d2d40d36e2649518d84a6b76d2ba29b61802f27f692787.exe

pid	process
1380	908461a89668ee1838d2d40d36e2649518d84a6b76d2ba29b61802f27f692787.exe

Suspicious use of WriteProcessMemory 32 IoCs

Processes:

908461a89668ee1838d2d40d36e2649518d84a6b76d2ba29b61802f27f692787.exe

description	pid	process	target process
PID 1380 wrote to memory of 1824	1380	908461a89668ee1838d2d40d36e2649518d84a6b76d2ba29b61802f27f692787.exe	takeown.exe
PID 1380 wrote to memory of 1824	1380	908461a89668ee1838d2d40d36e2649518d84a6b76d2ba29b61802f27f692787.exe	takeown.exe
PID 1380 wrote to memory of 1824	1380	908461a89668ee1838d2d40d36e2649518d84a6b76d2ba29b61802f27f692787.exe	takeown.exe
PID 1380 wrote to memory of 1824	1380	908461a89668ee1838d2d40d36e2649518d84a6b76d2ba29b61802f27f692787.exe	takeown.exe
PID 1380 wrote to memory of 1216	1380	908461a89668ee1838d2d40d36e2649518d84a6b76d2ba29b61802f27f692787.exe	icacls.exe
PID 1380 wrote to memory of 1216	1380	908461a89668ee1838d2d40d36e2649518d84a6b76d2ba29b61802f27f692787.exe	icacls.exe
PID 1380 wrote to memory of 1216	1380	908461a89668ee1838d2d40d36e2649518d84a6b76d2ba29b61802f27f692787.exe	icacls.exe
PID 1380 wrote to memory of 1216	1380	908461a89668ee1838d2d40d36e2649518d84a6b76d2ba29b61802f27f692787.exe	icacls.exe
PID 1380 wrote to memory of 944	1380	908461a89668ee1838d2d40d36e2649518d84a6b76d2ba29b61802f27f692787.exe	takeown.exe
PID 1380 wrote to memory of 944	1380	908461a89668ee1838d2d40d36e2649518d84a6b76d2ba29b61802f27f692787.exe	takeown.exe
PID 1380 wrote to memory of 944	1380	908461a89668ee1838d2d40d36e2649518d84a6b76d2ba29b61802f27f692787.exe	takeown.exe
PID 1380 wrote to memory of 944	1380	908461a89668ee1838d2d40d36e2649518d84a6b76d2ba29b61802f27f692787.exe	takeown.exe
PID 1380 wrote to memory of 620	1380	908461a89668ee1838d2d40d36e2649518d84a6b76d2ba29b61802f27f692787.exe	icacls.exe
PID 1380 wrote to memory of 620	1380	908461a89668ee1838d2d40d36e2649518d84a6b76d2ba29b61802f27f692787.exe	icacls.exe
PID 1380 wrote to memory of 620	1380	908461a89668ee1838d2d40d36e2649518d84a6b76d2ba29b61802f27f692787.exe	icacls.exe
PID 1380 wrote to memory of 620	1380	908461a89668ee1838d2d40d36e2649518d84a6b76d2ba29b61802f27f692787.exe	icacls.exe
PID 1380 wrote to memory of 464	1380	908461a89668ee1838d2d40d36e2649518d84a6b76d2ba29b61802f27f692787.exe	takeown.exe
PID 1380 wrote to memory of 464	1380	908461a89668ee1838d2d40d36e2649518d84a6b76d2ba29b61802f27f692787.exe	takeown.exe
PID 1380 wrote to memory of 464	1380	908461a89668ee1838d2d40d36e2649518d84a6b76d2ba29b61802f27f692787.exe	takeown.exe
PID 1380 wrote to memory of 464	1380	908461a89668ee1838d2d40d36e2649518d84a6b76d2ba29b61802f27f692787.exe	takeown.exe
PID 1380 wrote to memory of 1180	1380	908461a89668ee1838d2d40d36e2649518d84a6b76d2ba29b61802f27f692787.exe	icacls.exe
PID 1380 wrote to memory of 1180	1380	908461a89668ee1838d2d40d36e2649518d84a6b76d2ba29b61802f27f692787.exe	icacls.exe
PID 1380 wrote to memory of 1180	1380	908461a89668ee1838d2d40d36e2649518d84a6b76d2ba29b61802f27f692787.exe	icacls.exe
PID 1380 wrote to memory of 1180	1380	908461a89668ee1838d2d40d36e2649518d84a6b76d2ba29b61802f27f692787.exe	icacls.exe
PID 1380 wrote to memory of 1924	1380	908461a89668ee1838d2d40d36e2649518d84a6b76d2ba29b61802f27f692787.exe	takeown.exe
PID 1380 wrote to memory of 1924	1380	908461a89668ee1838d2d40d36e2649518d84a6b76d2ba29b61802f27f692787.exe	takeown.exe
PID 1380 wrote to memory of 1924	1380	908461a89668ee1838d2d40d36e2649518d84a6b76d2ba29b61802f27f692787.exe	takeown.exe
PID 1380 wrote to memory of 1924	1380	908461a89668ee1838d2d40d36e2649518d84a6b76d2ba29b61802f27f692787.exe	takeown.exe
PID 1380 wrote to memory of 1744	1380	908461a89668ee1838d2d40d36e2649518d84a6b76d2ba29b61802f27f692787.exe	icacls.exe
PID 1380 wrote to memory of 1744	1380	908461a89668ee1838d2d40d36e2649518d84a6b76d2ba29b61802f27f692787.exe	icacls.exe
PID 1380 wrote to memory of 1744	1380	908461a89668ee1838d2d40d36e2649518d84a6b76d2ba29b61802f27f692787.exe	icacls.exe
PID 1380 wrote to memory of 1744	1380	908461a89668ee1838d2d40d36e2649518d84a6b76d2ba29b61802f27f692787.exe	icacls.exe

C:\Users\Admin\AppData\Local\Temp\908461a89668ee1838d2d40d36e2649518d84a6b76d2ba29b61802f27f692787.exe
"C:\Users\Admin\AppData\Local\Temp\908461a89668ee1838d2d40d36e2649518d84a6b76d2ba29b61802f27f692787.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1380

C:\Windows\SysWOW64\takeown.exe
C:\Windows\System32\takeown.exe /f "C:\Windows\System32\cmd.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:1824

C:\Windows\SysWOW64\icacls.exe
C:\Windows\System32\icacls.exe "C:\Windows\System32\cmd.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1216

C:\Windows\SysWOW64\takeown.exe
C:\Windows\System32\takeown.exe /f "C:\Windows\System32\ftp.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:944

C:\Windows\SysWOW64\icacls.exe
C:\Windows\System32\icacls.exe "C:\Windows\System32\ftp.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:620

C:\Windows\SysWOW64\takeown.exe
C:\Windows\System32\takeown.exe /f "C:\Windows\System32\wscript.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:464

C:\Windows\SysWOW64\icacls.exe
C:\Windows\System32\icacls.exe "C:\Windows\System32\wscript.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1180

C:\Windows\SysWOW64\takeown.exe
C:\Windows\System32\takeown.exe /f "C:\Windows\System32\cscript.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:1924

C:\Windows\SysWOW64\icacls.exe
C:\Windows\System32\icacls.exe "C:\Windows\System32\cscript.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1744

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File Permissions Modification

1

T1222

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/464-60-0x0000000000000000-mapping.dmp

Download
memory/620-59-0x0000000000000000-mapping.dmp

Download
memory/944-58-0x0000000000000000-mapping.dmp

Download
memory/1180-61-0x0000000000000000-mapping.dmp

Download
memory/1216-57-0x0000000000000000-mapping.dmp

Download
memory/1744-63-0x0000000000000000-mapping.dmp

Download
memory/1824-56-0x0000000000000000-mapping.dmp

Download
memory/1924-62-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing