5acda4af394ecb06428a9c0aa0aa714029f7f49b828a2c850d402f9c1c76fc18

General

Target

5acda4af394ecb06428a9c0aa0aa714029f7f49b828a2c850d402f9c1c76fc18.exe
Size

36KB
MD5

3109c9c3cb533401bdce4ac0cc4f2010
SHA1

fcf7e2235ad44e7ba1a84ace75fce1e773893478
SHA256

5acda4af394ecb06428a9c0aa0aa714029f7f49b828a2c850d402f9c1c76fc18
SHA512

ee85fc9b9d824b3fee2ce0f88a3b694483f999c0eb00262086e93fc5e98d6d6fe6ac0c5b839b7c65d7200f3fca7e82310d2e964e084c87a3d7d4e4f649921f9d
SSDEEP

768:/9zDbGz34BFww2T2xDgzPb2RiL/3X4jdHsL3kze14GNt:/Fg4sWAP6R2/n4jNsL2e14qt

Score

8^/10

discovery exploit

Malware Config

Signatures

Possible privilege escalation attempt 8 IoCs
exploit

Processes:

icacls.exetakeown.exeicacls.exetakeown.exeicacls.exetakeown.exeicacls.exetakeown.exe

pid process

1192 icacls.exe
344 takeown.exe
588 icacls.exe
1692 takeown.exe
988 icacls.exe
1888 takeown.exe
1300 icacls.exe
1624 takeown.exe
Modifies file permissions 1 TTPs 8 IoCs
discovery

File Permissions Modification
T1222

Processes:

takeown.exeicacls.exetakeown.exeicacls.exetakeown.exeicacls.exetakeown.exeicacls.exe

pid process

344 takeown.exe
588 icacls.exe
1692 takeown.exe
988 icacls.exe
1888 takeown.exe
1300 icacls.exe
1624 takeown.exe
1192 icacls.exe

pid	process
1192	icacls.exe
344	takeown.exe
588	icacls.exe
1692	takeown.exe
988	icacls.exe
1888	takeown.exe
1300	icacls.exe
1624	takeown.exe

pid	process
344	takeown.exe
588	icacls.exe
1692	takeown.exe
988	icacls.exe
1888	takeown.exe
1300	icacls.exe
1624	takeown.exe
1192	icacls.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

takeown.exetakeown.exetakeown.exetakeown.exe

description	pid	process
Token: SeTakeOwnershipPrivilege	1888	takeown.exe
Token: SeTakeOwnershipPrivilege	1624	takeown.exe
Token: SeTakeOwnershipPrivilege	344	takeown.exe
Token: SeTakeOwnershipPrivilege	1692	takeown.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

5acda4af394ecb06428a9c0aa0aa714029f7f49b828a2c850d402f9c1c76fc18.exe

pid process

1000 5acda4af394ecb06428a9c0aa0aa714029f7f49b828a2c850d402f9c1c76fc18.exe

pid	process
1000	5acda4af394ecb06428a9c0aa0aa714029f7f49b828a2c850d402f9c1c76fc18.exe

Suspicious use of WriteProcessMemory 32 IoCs

Processes:

5acda4af394ecb06428a9c0aa0aa714029f7f49b828a2c850d402f9c1c76fc18.exe

description	pid	process	target process
PID 1000 wrote to memory of 1888	1000	5acda4af394ecb06428a9c0aa0aa714029f7f49b828a2c850d402f9c1c76fc18.exe	takeown.exe
PID 1000 wrote to memory of 1888	1000	5acda4af394ecb06428a9c0aa0aa714029f7f49b828a2c850d402f9c1c76fc18.exe	takeown.exe
PID 1000 wrote to memory of 1888	1000	5acda4af394ecb06428a9c0aa0aa714029f7f49b828a2c850d402f9c1c76fc18.exe	takeown.exe
PID 1000 wrote to memory of 1888	1000	5acda4af394ecb06428a9c0aa0aa714029f7f49b828a2c850d402f9c1c76fc18.exe	takeown.exe
PID 1000 wrote to memory of 1300	1000	5acda4af394ecb06428a9c0aa0aa714029f7f49b828a2c850d402f9c1c76fc18.exe	icacls.exe
PID 1000 wrote to memory of 1300	1000	5acda4af394ecb06428a9c0aa0aa714029f7f49b828a2c850d402f9c1c76fc18.exe	icacls.exe
PID 1000 wrote to memory of 1300	1000	5acda4af394ecb06428a9c0aa0aa714029f7f49b828a2c850d402f9c1c76fc18.exe	icacls.exe
PID 1000 wrote to memory of 1300	1000	5acda4af394ecb06428a9c0aa0aa714029f7f49b828a2c850d402f9c1c76fc18.exe	icacls.exe
PID 1000 wrote to memory of 1624	1000	5acda4af394ecb06428a9c0aa0aa714029f7f49b828a2c850d402f9c1c76fc18.exe	takeown.exe
PID 1000 wrote to memory of 1624	1000	5acda4af394ecb06428a9c0aa0aa714029f7f49b828a2c850d402f9c1c76fc18.exe	takeown.exe
PID 1000 wrote to memory of 1624	1000	5acda4af394ecb06428a9c0aa0aa714029f7f49b828a2c850d402f9c1c76fc18.exe	takeown.exe
PID 1000 wrote to memory of 1624	1000	5acda4af394ecb06428a9c0aa0aa714029f7f49b828a2c850d402f9c1c76fc18.exe	takeown.exe
PID 1000 wrote to memory of 1192	1000	5acda4af394ecb06428a9c0aa0aa714029f7f49b828a2c850d402f9c1c76fc18.exe	icacls.exe
PID 1000 wrote to memory of 1192	1000	5acda4af394ecb06428a9c0aa0aa714029f7f49b828a2c850d402f9c1c76fc18.exe	icacls.exe
PID 1000 wrote to memory of 1192	1000	5acda4af394ecb06428a9c0aa0aa714029f7f49b828a2c850d402f9c1c76fc18.exe	icacls.exe
PID 1000 wrote to memory of 1192	1000	5acda4af394ecb06428a9c0aa0aa714029f7f49b828a2c850d402f9c1c76fc18.exe	icacls.exe
PID 1000 wrote to memory of 344	1000	5acda4af394ecb06428a9c0aa0aa714029f7f49b828a2c850d402f9c1c76fc18.exe	takeown.exe
PID 1000 wrote to memory of 344	1000	5acda4af394ecb06428a9c0aa0aa714029f7f49b828a2c850d402f9c1c76fc18.exe	takeown.exe
PID 1000 wrote to memory of 344	1000	5acda4af394ecb06428a9c0aa0aa714029f7f49b828a2c850d402f9c1c76fc18.exe	takeown.exe
PID 1000 wrote to memory of 344	1000	5acda4af394ecb06428a9c0aa0aa714029f7f49b828a2c850d402f9c1c76fc18.exe	takeown.exe
PID 1000 wrote to memory of 588	1000	5acda4af394ecb06428a9c0aa0aa714029f7f49b828a2c850d402f9c1c76fc18.exe	icacls.exe
PID 1000 wrote to memory of 588	1000	5acda4af394ecb06428a9c0aa0aa714029f7f49b828a2c850d402f9c1c76fc18.exe	icacls.exe
PID 1000 wrote to memory of 588	1000	5acda4af394ecb06428a9c0aa0aa714029f7f49b828a2c850d402f9c1c76fc18.exe	icacls.exe
PID 1000 wrote to memory of 588	1000	5acda4af394ecb06428a9c0aa0aa714029f7f49b828a2c850d402f9c1c76fc18.exe	icacls.exe
PID 1000 wrote to memory of 1692	1000	5acda4af394ecb06428a9c0aa0aa714029f7f49b828a2c850d402f9c1c76fc18.exe	takeown.exe
PID 1000 wrote to memory of 1692	1000	5acda4af394ecb06428a9c0aa0aa714029f7f49b828a2c850d402f9c1c76fc18.exe	takeown.exe
PID 1000 wrote to memory of 1692	1000	5acda4af394ecb06428a9c0aa0aa714029f7f49b828a2c850d402f9c1c76fc18.exe	takeown.exe
PID 1000 wrote to memory of 1692	1000	5acda4af394ecb06428a9c0aa0aa714029f7f49b828a2c850d402f9c1c76fc18.exe	takeown.exe
PID 1000 wrote to memory of 988	1000	5acda4af394ecb06428a9c0aa0aa714029f7f49b828a2c850d402f9c1c76fc18.exe	icacls.exe
PID 1000 wrote to memory of 988	1000	5acda4af394ecb06428a9c0aa0aa714029f7f49b828a2c850d402f9c1c76fc18.exe	icacls.exe
PID 1000 wrote to memory of 988	1000	5acda4af394ecb06428a9c0aa0aa714029f7f49b828a2c850d402f9c1c76fc18.exe	icacls.exe
PID 1000 wrote to memory of 988	1000	5acda4af394ecb06428a9c0aa0aa714029f7f49b828a2c850d402f9c1c76fc18.exe	icacls.exe

C:\Users\Admin\AppData\Local\Temp\5acda4af394ecb06428a9c0aa0aa714029f7f49b828a2c850d402f9c1c76fc18.exe
"C:\Users\Admin\AppData\Local\Temp\5acda4af394ecb06428a9c0aa0aa714029f7f49b828a2c850d402f9c1c76fc18.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1000

C:\Windows\SysWOW64\takeown.exe
C:\Windows\System32\takeown.exe /f "C:\Windows\System32\cmd.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:1888

C:\Windows\SysWOW64\icacls.exe
C:\Windows\System32\icacls.exe "C:\Windows\System32\cmd.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1300

C:\Windows\SysWOW64\takeown.exe
C:\Windows\System32\takeown.exe /f "C:\Windows\System32\ftp.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:1624

C:\Windows\SysWOW64\icacls.exe
C:\Windows\System32\icacls.exe "C:\Windows\System32\ftp.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1192

C:\Windows\SysWOW64\takeown.exe
C:\Windows\System32\takeown.exe /f "C:\Windows\System32\wscript.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:344

C:\Windows\SysWOW64\icacls.exe
C:\Windows\System32\icacls.exe "C:\Windows\System32\wscript.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:588

C:\Windows\SysWOW64\takeown.exe
C:\Windows\System32\takeown.exe /f "C:\Windows\System32\cscript.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:1692

C:\Windows\SysWOW64\icacls.exe
C:\Windows\System32\icacls.exe "C:\Windows\System32\cscript.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:988

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File Permissions Modification

1

T1222

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/344-60-0x0000000000000000-mapping.dmp

Download
memory/588-61-0x0000000000000000-mapping.dmp

Download
memory/988-63-0x0000000000000000-mapping.dmp

Download
memory/1192-59-0x0000000000000000-mapping.dmp

Download
memory/1300-57-0x0000000000000000-mapping.dmp

Download
memory/1624-58-0x0000000000000000-mapping.dmp

Download
memory/1692-62-0x0000000000000000-mapping.dmp

Download
memory/1888-56-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing