5acda4af394ecb06428a9c0aa0aa714029f7f49b828a2c850d402f9c1c76fc18

General

Target

5acda4af394ecb06428a9c0aa0aa714029f7f49b828a2c850d402f9c1c76fc18.exe
Size

36KB
MD5

3109c9c3cb533401bdce4ac0cc4f2010
SHA1

fcf7e2235ad44e7ba1a84ace75fce1e773893478
SHA256

5acda4af394ecb06428a9c0aa0aa714029f7f49b828a2c850d402f9c1c76fc18
SHA512

ee85fc9b9d824b3fee2ce0f88a3b694483f999c0eb00262086e93fc5e98d6d6fe6ac0c5b839b7c65d7200f3fca7e82310d2e964e084c87a3d7d4e4f649921f9d
SSDEEP

768:/9zDbGz34BFww2T2xDgzPb2RiL/3X4jdHsL3kze14GNt:/Fg4sWAP6R2/n4jNsL2e14qt

Score

8^/10

discovery exploit

Malware Config

Signatures

Possible privilege escalation attempt 8 IoCs
exploit

Processes:

takeown.exetakeown.exeicacls.exetakeown.exeicacls.exetakeown.exeicacls.exeicacls.exe

pid process

2336 takeown.exe
4960 takeown.exe
4552 icacls.exe
4268 takeown.exe
4512 icacls.exe
4584 takeown.exe
2200 icacls.exe
2744 icacls.exe
Modifies file permissions 1 TTPs 8 IoCs
discovery

File Permissions Modification
T1222

Processes:

takeown.exetakeown.exeicacls.exetakeown.exeicacls.exetakeown.exeicacls.exeicacls.exe

pid process

2336 takeown.exe
4960 takeown.exe
4552 icacls.exe
4268 takeown.exe
4512 icacls.exe
4584 takeown.exe
2200 icacls.exe
2744 icacls.exe

pid	process
2336	takeown.exe
4960	takeown.exe
4552	icacls.exe
4268	takeown.exe
4512	icacls.exe
4584	takeown.exe
2200	icacls.exe
2744	icacls.exe

pid	process
2336	takeown.exe
4960	takeown.exe
4552	icacls.exe
4268	takeown.exe
4512	icacls.exe
4584	takeown.exe
2200	icacls.exe
2744	icacls.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

takeown.exetakeown.exetakeown.exetakeown.exe

description	pid	process
Token: SeTakeOwnershipPrivilege	4960	takeown.exe
Token: SeTakeOwnershipPrivilege	4268	takeown.exe
Token: SeTakeOwnershipPrivilege	4584	takeown.exe
Token: SeTakeOwnershipPrivilege	2336	takeown.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

5acda4af394ecb06428a9c0aa0aa714029f7f49b828a2c850d402f9c1c76fc18.exe

pid process

308 5acda4af394ecb06428a9c0aa0aa714029f7f49b828a2c850d402f9c1c76fc18.exe

pid	process
308	5acda4af394ecb06428a9c0aa0aa714029f7f49b828a2c850d402f9c1c76fc18.exe

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

5acda4af394ecb06428a9c0aa0aa714029f7f49b828a2c850d402f9c1c76fc18.exe

description	pid	process	target process
PID 308 wrote to memory of 4960	308	5acda4af394ecb06428a9c0aa0aa714029f7f49b828a2c850d402f9c1c76fc18.exe	takeown.exe
PID 308 wrote to memory of 4960	308	5acda4af394ecb06428a9c0aa0aa714029f7f49b828a2c850d402f9c1c76fc18.exe	takeown.exe
PID 308 wrote to memory of 4960	308	5acda4af394ecb06428a9c0aa0aa714029f7f49b828a2c850d402f9c1c76fc18.exe	takeown.exe
PID 308 wrote to memory of 4552	308	5acda4af394ecb06428a9c0aa0aa714029f7f49b828a2c850d402f9c1c76fc18.exe	icacls.exe
PID 308 wrote to memory of 4552	308	5acda4af394ecb06428a9c0aa0aa714029f7f49b828a2c850d402f9c1c76fc18.exe	icacls.exe
PID 308 wrote to memory of 4552	308	5acda4af394ecb06428a9c0aa0aa714029f7f49b828a2c850d402f9c1c76fc18.exe	icacls.exe
PID 308 wrote to memory of 4268	308	5acda4af394ecb06428a9c0aa0aa714029f7f49b828a2c850d402f9c1c76fc18.exe	takeown.exe
PID 308 wrote to memory of 4268	308	5acda4af394ecb06428a9c0aa0aa714029f7f49b828a2c850d402f9c1c76fc18.exe	takeown.exe
PID 308 wrote to memory of 4268	308	5acda4af394ecb06428a9c0aa0aa714029f7f49b828a2c850d402f9c1c76fc18.exe	takeown.exe
PID 308 wrote to memory of 4512	308	5acda4af394ecb06428a9c0aa0aa714029f7f49b828a2c850d402f9c1c76fc18.exe	icacls.exe
PID 308 wrote to memory of 4512	308	5acda4af394ecb06428a9c0aa0aa714029f7f49b828a2c850d402f9c1c76fc18.exe	icacls.exe
PID 308 wrote to memory of 4512	308	5acda4af394ecb06428a9c0aa0aa714029f7f49b828a2c850d402f9c1c76fc18.exe	icacls.exe
PID 308 wrote to memory of 4584	308	5acda4af394ecb06428a9c0aa0aa714029f7f49b828a2c850d402f9c1c76fc18.exe	takeown.exe
PID 308 wrote to memory of 4584	308	5acda4af394ecb06428a9c0aa0aa714029f7f49b828a2c850d402f9c1c76fc18.exe	takeown.exe
PID 308 wrote to memory of 4584	308	5acda4af394ecb06428a9c0aa0aa714029f7f49b828a2c850d402f9c1c76fc18.exe	takeown.exe
PID 308 wrote to memory of 2200	308	5acda4af394ecb06428a9c0aa0aa714029f7f49b828a2c850d402f9c1c76fc18.exe	icacls.exe
PID 308 wrote to memory of 2200	308	5acda4af394ecb06428a9c0aa0aa714029f7f49b828a2c850d402f9c1c76fc18.exe	icacls.exe
PID 308 wrote to memory of 2200	308	5acda4af394ecb06428a9c0aa0aa714029f7f49b828a2c850d402f9c1c76fc18.exe	icacls.exe
PID 308 wrote to memory of 2336	308	5acda4af394ecb06428a9c0aa0aa714029f7f49b828a2c850d402f9c1c76fc18.exe	takeown.exe
PID 308 wrote to memory of 2336	308	5acda4af394ecb06428a9c0aa0aa714029f7f49b828a2c850d402f9c1c76fc18.exe	takeown.exe
PID 308 wrote to memory of 2336	308	5acda4af394ecb06428a9c0aa0aa714029f7f49b828a2c850d402f9c1c76fc18.exe	takeown.exe
PID 308 wrote to memory of 2744	308	5acda4af394ecb06428a9c0aa0aa714029f7f49b828a2c850d402f9c1c76fc18.exe	icacls.exe
PID 308 wrote to memory of 2744	308	5acda4af394ecb06428a9c0aa0aa714029f7f49b828a2c850d402f9c1c76fc18.exe	icacls.exe
PID 308 wrote to memory of 2744	308	5acda4af394ecb06428a9c0aa0aa714029f7f49b828a2c850d402f9c1c76fc18.exe	icacls.exe

C:\Users\Admin\AppData\Local\Temp\5acda4af394ecb06428a9c0aa0aa714029f7f49b828a2c850d402f9c1c76fc18.exe
"C:\Users\Admin\AppData\Local\Temp\5acda4af394ecb06428a9c0aa0aa714029f7f49b828a2c850d402f9c1c76fc18.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:308

C:\Windows\SysWOW64\takeown.exe
C:\Windows\System32\takeown.exe /f "C:\Windows\System32\cmd.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:4960

C:\Windows\SysWOW64\icacls.exe
C:\Windows\System32\icacls.exe "C:\Windows\System32\cmd.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:4552

C:\Windows\SysWOW64\takeown.exe
C:\Windows\System32\takeown.exe /f "C:\Windows\System32\ftp.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:4268

C:\Windows\SysWOW64\icacls.exe
C:\Windows\System32\icacls.exe "C:\Windows\System32\ftp.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:4512

C:\Windows\SysWOW64\takeown.exe
C:\Windows\System32\takeown.exe /f "C:\Windows\System32\wscript.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:4584

C:\Windows\SysWOW64\icacls.exe
C:\Windows\System32\icacls.exe "C:\Windows\System32\wscript.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:2200

C:\Windows\SysWOW64\icacls.exe
C:\Windows\System32\icacls.exe "C:\Windows\System32\cscript.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:2744

C:\Windows\SysWOW64\takeown.exe
C:\Windows\System32\takeown.exe /f "C:\Windows\System32\cscript.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:2336

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File Permissions Modification

1

T1222

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2200-139-0x0000000000000000-mapping.dmp

Download
memory/2336-140-0x0000000000000000-mapping.dmp

Download
memory/2744-141-0x0000000000000000-mapping.dmp

Download
memory/4268-136-0x0000000000000000-mapping.dmp

Download
memory/4512-137-0x0000000000000000-mapping.dmp

Download
memory/4552-135-0x0000000000000000-mapping.dmp

Download
memory/4584-138-0x0000000000000000-mapping.dmp

Download
memory/4960-134-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing