833fb3216b17a6e83fa3301cbfbecc840fb69ee2a413530a99873c9aad10e03c

General

Target

833fb3216b17a6e83fa3301cbfbecc840fb69ee2a413530a99873c9aad10e03c.exe
Size

40KB
MD5

10bbe3d8b7aea71d2212850447aae030
SHA1

4fa8b8cebd6da78cf73edc23194c5628a8551b16
SHA256

833fb3216b17a6e83fa3301cbfbecc840fb69ee2a413530a99873c9aad10e03c
SHA512

5231507dafd72378b8a9289bd5e9c397ca6c1e7e83bdf1cda5b75cc30fa2282de4bd2b2514f6034c9f69c04f08c7aa859b1ef8e6c274cbb4fa4e72985dbddb72
SSDEEP

768://i8bZCbg0eM1p3KQs1EvnPWuyfX4+bXNg9yZv2cgMqFeShP5lTjomqPDNM:/a8DM1pZzWuyfX4WXNg9yZv2cgMqFeSj

Score

8^/10

discovery exploit

Malware Config

Signatures

Possible privilege escalation attempt 8 IoCs
exploit

Processes:

icacls.exetakeown.exeicacls.exetakeown.exeicacls.exetakeown.exeicacls.exetakeown.exe

pid process

1408 icacls.exe
1996 takeown.exe
1788 icacls.exe
668 takeown.exe
1836 icacls.exe
940 takeown.exe
1076 icacls.exe
2032 takeown.exe
Modifies file permissions 1 TTPs 8 IoCs
discovery

File Permissions Modification
T1222

Processes:

icacls.exetakeown.exeicacls.exetakeown.exeicacls.exetakeown.exeicacls.exetakeown.exe

pid process

1408 icacls.exe
1996 takeown.exe
1788 icacls.exe
668 takeown.exe
1836 icacls.exe
940 takeown.exe
1076 icacls.exe
2032 takeown.exe

pid	process
1408	icacls.exe
1996	takeown.exe
1788	icacls.exe
668	takeown.exe
1836	icacls.exe
940	takeown.exe
1076	icacls.exe
2032	takeown.exe

pid	process
1408	icacls.exe
1996	takeown.exe
1788	icacls.exe
668	takeown.exe
1836	icacls.exe
940	takeown.exe
1076	icacls.exe
2032	takeown.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

takeown.exetakeown.exetakeown.exetakeown.exe

description	pid	process
Token: SeTakeOwnershipPrivilege	668	takeown.exe
Token: SeTakeOwnershipPrivilege	940	takeown.exe
Token: SeTakeOwnershipPrivilege	1996	takeown.exe
Token: SeTakeOwnershipPrivilege	2032	takeown.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

833fb3216b17a6e83fa3301cbfbecc840fb69ee2a413530a99873c9aad10e03c.exe

pid process

1980 833fb3216b17a6e83fa3301cbfbecc840fb69ee2a413530a99873c9aad10e03c.exe

pid	process
1980	833fb3216b17a6e83fa3301cbfbecc840fb69ee2a413530a99873c9aad10e03c.exe

Suspicious use of WriteProcessMemory 32 IoCs

Processes:

833fb3216b17a6e83fa3301cbfbecc840fb69ee2a413530a99873c9aad10e03c.exe

description	pid	process	target process
PID 1980 wrote to memory of 668	1980	833fb3216b17a6e83fa3301cbfbecc840fb69ee2a413530a99873c9aad10e03c.exe	takeown.exe
PID 1980 wrote to memory of 668	1980	833fb3216b17a6e83fa3301cbfbecc840fb69ee2a413530a99873c9aad10e03c.exe	takeown.exe
PID 1980 wrote to memory of 668	1980	833fb3216b17a6e83fa3301cbfbecc840fb69ee2a413530a99873c9aad10e03c.exe	takeown.exe
PID 1980 wrote to memory of 668	1980	833fb3216b17a6e83fa3301cbfbecc840fb69ee2a413530a99873c9aad10e03c.exe	takeown.exe
PID 1980 wrote to memory of 1836	1980	833fb3216b17a6e83fa3301cbfbecc840fb69ee2a413530a99873c9aad10e03c.exe	icacls.exe
PID 1980 wrote to memory of 1836	1980	833fb3216b17a6e83fa3301cbfbecc840fb69ee2a413530a99873c9aad10e03c.exe	icacls.exe
PID 1980 wrote to memory of 1836	1980	833fb3216b17a6e83fa3301cbfbecc840fb69ee2a413530a99873c9aad10e03c.exe	icacls.exe
PID 1980 wrote to memory of 1836	1980	833fb3216b17a6e83fa3301cbfbecc840fb69ee2a413530a99873c9aad10e03c.exe	icacls.exe
PID 1980 wrote to memory of 940	1980	833fb3216b17a6e83fa3301cbfbecc840fb69ee2a413530a99873c9aad10e03c.exe	takeown.exe
PID 1980 wrote to memory of 940	1980	833fb3216b17a6e83fa3301cbfbecc840fb69ee2a413530a99873c9aad10e03c.exe	takeown.exe
PID 1980 wrote to memory of 940	1980	833fb3216b17a6e83fa3301cbfbecc840fb69ee2a413530a99873c9aad10e03c.exe	takeown.exe
PID 1980 wrote to memory of 940	1980	833fb3216b17a6e83fa3301cbfbecc840fb69ee2a413530a99873c9aad10e03c.exe	takeown.exe
PID 1980 wrote to memory of 1076	1980	833fb3216b17a6e83fa3301cbfbecc840fb69ee2a413530a99873c9aad10e03c.exe	icacls.exe
PID 1980 wrote to memory of 1076	1980	833fb3216b17a6e83fa3301cbfbecc840fb69ee2a413530a99873c9aad10e03c.exe	icacls.exe
PID 1980 wrote to memory of 1076	1980	833fb3216b17a6e83fa3301cbfbecc840fb69ee2a413530a99873c9aad10e03c.exe	icacls.exe
PID 1980 wrote to memory of 1076	1980	833fb3216b17a6e83fa3301cbfbecc840fb69ee2a413530a99873c9aad10e03c.exe	icacls.exe
PID 1980 wrote to memory of 2032	1980	833fb3216b17a6e83fa3301cbfbecc840fb69ee2a413530a99873c9aad10e03c.exe	takeown.exe
PID 1980 wrote to memory of 2032	1980	833fb3216b17a6e83fa3301cbfbecc840fb69ee2a413530a99873c9aad10e03c.exe	takeown.exe
PID 1980 wrote to memory of 2032	1980	833fb3216b17a6e83fa3301cbfbecc840fb69ee2a413530a99873c9aad10e03c.exe	takeown.exe
PID 1980 wrote to memory of 2032	1980	833fb3216b17a6e83fa3301cbfbecc840fb69ee2a413530a99873c9aad10e03c.exe	takeown.exe
PID 1980 wrote to memory of 1408	1980	833fb3216b17a6e83fa3301cbfbecc840fb69ee2a413530a99873c9aad10e03c.exe	icacls.exe
PID 1980 wrote to memory of 1408	1980	833fb3216b17a6e83fa3301cbfbecc840fb69ee2a413530a99873c9aad10e03c.exe	icacls.exe
PID 1980 wrote to memory of 1408	1980	833fb3216b17a6e83fa3301cbfbecc840fb69ee2a413530a99873c9aad10e03c.exe	icacls.exe
PID 1980 wrote to memory of 1408	1980	833fb3216b17a6e83fa3301cbfbecc840fb69ee2a413530a99873c9aad10e03c.exe	icacls.exe
PID 1980 wrote to memory of 1996	1980	833fb3216b17a6e83fa3301cbfbecc840fb69ee2a413530a99873c9aad10e03c.exe	takeown.exe
PID 1980 wrote to memory of 1996	1980	833fb3216b17a6e83fa3301cbfbecc840fb69ee2a413530a99873c9aad10e03c.exe	takeown.exe
PID 1980 wrote to memory of 1996	1980	833fb3216b17a6e83fa3301cbfbecc840fb69ee2a413530a99873c9aad10e03c.exe	takeown.exe
PID 1980 wrote to memory of 1996	1980	833fb3216b17a6e83fa3301cbfbecc840fb69ee2a413530a99873c9aad10e03c.exe	takeown.exe
PID 1980 wrote to memory of 1788	1980	833fb3216b17a6e83fa3301cbfbecc840fb69ee2a413530a99873c9aad10e03c.exe	icacls.exe
PID 1980 wrote to memory of 1788	1980	833fb3216b17a6e83fa3301cbfbecc840fb69ee2a413530a99873c9aad10e03c.exe	icacls.exe
PID 1980 wrote to memory of 1788	1980	833fb3216b17a6e83fa3301cbfbecc840fb69ee2a413530a99873c9aad10e03c.exe	icacls.exe
PID 1980 wrote to memory of 1788	1980	833fb3216b17a6e83fa3301cbfbecc840fb69ee2a413530a99873c9aad10e03c.exe	icacls.exe

C:\Users\Admin\AppData\Local\Temp\833fb3216b17a6e83fa3301cbfbecc840fb69ee2a413530a99873c9aad10e03c.exe
"C:\Users\Admin\AppData\Local\Temp\833fb3216b17a6e83fa3301cbfbecc840fb69ee2a413530a99873c9aad10e03c.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1980

C:\Windows\SysWOW64\takeown.exe
C:\Windows\System32\takeown.exe /f "C:\Windows\System32\cmd.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:668

C:\Windows\SysWOW64\icacls.exe
C:\Windows\System32\icacls.exe "C:\Windows\System32\cmd.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1836

C:\Windows\SysWOW64\takeown.exe
C:\Windows\System32\takeown.exe /f "C:\Windows\System32\ftp.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:940

C:\Windows\SysWOW64\icacls.exe
C:\Windows\System32\icacls.exe "C:\Windows\System32\ftp.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1076

C:\Windows\SysWOW64\takeown.exe
C:\Windows\System32\takeown.exe /f "C:\Windows\System32\wscript.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:2032

C:\Windows\SysWOW64\icacls.exe
C:\Windows\System32\icacls.exe "C:\Windows\System32\wscript.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1408

C:\Windows\SysWOW64\takeown.exe
C:\Windows\System32\takeown.exe /f "C:\Windows\System32\cscript.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:1996

C:\Windows\SysWOW64\icacls.exe
C:\Windows\System32\icacls.exe "C:\Windows\System32\cscript.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1788

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File Permissions Modification

1

T1222

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/668-56-0x0000000000000000-mapping.dmp

Download
memory/940-58-0x0000000000000000-mapping.dmp

Download
memory/1076-59-0x0000000000000000-mapping.dmp

Download
memory/1408-61-0x0000000000000000-mapping.dmp

Download
memory/1788-63-0x0000000000000000-mapping.dmp

Download
memory/1836-57-0x0000000000000000-mapping.dmp

Download
memory/1996-62-0x0000000000000000-mapping.dmp

Download
memory/2032-60-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing