c76812ca6cd82d3f2938e97fbdcc39dccbd8cc2120c24314033276fd5fcab9c0

General

Target

c76812ca6cd82d3f2938e97fbdcc39dccbd8cc2120c24314033276fd5fcab9c0.exe
Size

40KB
MD5

099085aa2fd68174770bf06575e6a200
SHA1

31c7f33b4f8a6917fb383562bf69e25a111bd933
SHA256

c76812ca6cd82d3f2938e97fbdcc39dccbd8cc2120c24314033276fd5fcab9c0
SHA512

55405c5d075761635d0b92f378b4fbbea7f544715bda8a07241d13e847fd9b78ce30aa03cae7dbc0ef492487de83c33164e0459b31c46d1a8a5408ce5077b04b
SSDEEP

768:/ysyaCVm6vfDUlK2jWCzNoqSTjuYyAuiZsRPnJ3WVqEVJ6tWxDiTcmsdb7:/ysj8QK2jzNoqSTjuYyAuiZsRPnJ3WVL

Score

8^/10

discovery exploit

Malware Config

Signatures

Possible privilege escalation attempt 8 IoCs
exploit

Processes:

takeown.exeicacls.exetakeown.exeicacls.exetakeown.exeicacls.exetakeown.exeicacls.exe

pid process

1964 takeown.exe
552 icacls.exe
688 takeown.exe
584 icacls.exe
836 takeown.exe
1224 icacls.exe
1768 takeown.exe
1088 icacls.exe
Modifies file permissions 1 TTPs 8 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

takeown.exeicacls.exetakeown.exeicacls.exetakeown.exeicacls.exetakeown.exeicacls.exe

pid process

1768 takeown.exe
1088 icacls.exe
1964 takeown.exe
552 icacls.exe
688 takeown.exe
584 icacls.exe
836 takeown.exe
1224 icacls.exe

pid	process
1964	takeown.exe
552	icacls.exe
688	takeown.exe
584	icacls.exe
836	takeown.exe
1224	icacls.exe
1768	takeown.exe
1088	icacls.exe

pid	process
1768	takeown.exe
1088	icacls.exe
1964	takeown.exe
552	icacls.exe
688	takeown.exe
584	icacls.exe
836	takeown.exe
1224	icacls.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

takeown.exetakeown.exetakeown.exetakeown.exe

description	pid	process
Token: SeTakeOwnershipPrivilege	1768	takeown.exe
Token: SeTakeOwnershipPrivilege	1964	takeown.exe
Token: SeTakeOwnershipPrivilege	688	takeown.exe
Token: SeTakeOwnershipPrivilege	836	takeown.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

c76812ca6cd82d3f2938e97fbdcc39dccbd8cc2120c24314033276fd5fcab9c0.exe

pid process

1204 c76812ca6cd82d3f2938e97fbdcc39dccbd8cc2120c24314033276fd5fcab9c0.exe

pid	process
1204	c76812ca6cd82d3f2938e97fbdcc39dccbd8cc2120c24314033276fd5fcab9c0.exe

Suspicious use of WriteProcessMemory 32 IoCs

Processes:

c76812ca6cd82d3f2938e97fbdcc39dccbd8cc2120c24314033276fd5fcab9c0.exe

description	pid	process	target process
PID 1204 wrote to memory of 1768	1204	c76812ca6cd82d3f2938e97fbdcc39dccbd8cc2120c24314033276fd5fcab9c0.exe	takeown.exe
PID 1204 wrote to memory of 1768	1204	c76812ca6cd82d3f2938e97fbdcc39dccbd8cc2120c24314033276fd5fcab9c0.exe	takeown.exe
PID 1204 wrote to memory of 1768	1204	c76812ca6cd82d3f2938e97fbdcc39dccbd8cc2120c24314033276fd5fcab9c0.exe	takeown.exe
PID 1204 wrote to memory of 1768	1204	c76812ca6cd82d3f2938e97fbdcc39dccbd8cc2120c24314033276fd5fcab9c0.exe	takeown.exe
PID 1204 wrote to memory of 1088	1204	c76812ca6cd82d3f2938e97fbdcc39dccbd8cc2120c24314033276fd5fcab9c0.exe	icacls.exe
PID 1204 wrote to memory of 1088	1204	c76812ca6cd82d3f2938e97fbdcc39dccbd8cc2120c24314033276fd5fcab9c0.exe	icacls.exe
PID 1204 wrote to memory of 1088	1204	c76812ca6cd82d3f2938e97fbdcc39dccbd8cc2120c24314033276fd5fcab9c0.exe	icacls.exe
PID 1204 wrote to memory of 1088	1204	c76812ca6cd82d3f2938e97fbdcc39dccbd8cc2120c24314033276fd5fcab9c0.exe	icacls.exe
PID 1204 wrote to memory of 1964	1204	c76812ca6cd82d3f2938e97fbdcc39dccbd8cc2120c24314033276fd5fcab9c0.exe	takeown.exe
PID 1204 wrote to memory of 1964	1204	c76812ca6cd82d3f2938e97fbdcc39dccbd8cc2120c24314033276fd5fcab9c0.exe	takeown.exe
PID 1204 wrote to memory of 1964	1204	c76812ca6cd82d3f2938e97fbdcc39dccbd8cc2120c24314033276fd5fcab9c0.exe	takeown.exe
PID 1204 wrote to memory of 1964	1204	c76812ca6cd82d3f2938e97fbdcc39dccbd8cc2120c24314033276fd5fcab9c0.exe	takeown.exe
PID 1204 wrote to memory of 552	1204	c76812ca6cd82d3f2938e97fbdcc39dccbd8cc2120c24314033276fd5fcab9c0.exe	icacls.exe
PID 1204 wrote to memory of 552	1204	c76812ca6cd82d3f2938e97fbdcc39dccbd8cc2120c24314033276fd5fcab9c0.exe	icacls.exe
PID 1204 wrote to memory of 552	1204	c76812ca6cd82d3f2938e97fbdcc39dccbd8cc2120c24314033276fd5fcab9c0.exe	icacls.exe
PID 1204 wrote to memory of 552	1204	c76812ca6cd82d3f2938e97fbdcc39dccbd8cc2120c24314033276fd5fcab9c0.exe	icacls.exe
PID 1204 wrote to memory of 688	1204	c76812ca6cd82d3f2938e97fbdcc39dccbd8cc2120c24314033276fd5fcab9c0.exe	takeown.exe
PID 1204 wrote to memory of 688	1204	c76812ca6cd82d3f2938e97fbdcc39dccbd8cc2120c24314033276fd5fcab9c0.exe	takeown.exe
PID 1204 wrote to memory of 688	1204	c76812ca6cd82d3f2938e97fbdcc39dccbd8cc2120c24314033276fd5fcab9c0.exe	takeown.exe
PID 1204 wrote to memory of 688	1204	c76812ca6cd82d3f2938e97fbdcc39dccbd8cc2120c24314033276fd5fcab9c0.exe	takeown.exe
PID 1204 wrote to memory of 584	1204	c76812ca6cd82d3f2938e97fbdcc39dccbd8cc2120c24314033276fd5fcab9c0.exe	icacls.exe
PID 1204 wrote to memory of 584	1204	c76812ca6cd82d3f2938e97fbdcc39dccbd8cc2120c24314033276fd5fcab9c0.exe	icacls.exe
PID 1204 wrote to memory of 584	1204	c76812ca6cd82d3f2938e97fbdcc39dccbd8cc2120c24314033276fd5fcab9c0.exe	icacls.exe
PID 1204 wrote to memory of 584	1204	c76812ca6cd82d3f2938e97fbdcc39dccbd8cc2120c24314033276fd5fcab9c0.exe	icacls.exe
PID 1204 wrote to memory of 836	1204	c76812ca6cd82d3f2938e97fbdcc39dccbd8cc2120c24314033276fd5fcab9c0.exe	takeown.exe
PID 1204 wrote to memory of 836	1204	c76812ca6cd82d3f2938e97fbdcc39dccbd8cc2120c24314033276fd5fcab9c0.exe	takeown.exe
PID 1204 wrote to memory of 836	1204	c76812ca6cd82d3f2938e97fbdcc39dccbd8cc2120c24314033276fd5fcab9c0.exe	takeown.exe
PID 1204 wrote to memory of 836	1204	c76812ca6cd82d3f2938e97fbdcc39dccbd8cc2120c24314033276fd5fcab9c0.exe	takeown.exe
PID 1204 wrote to memory of 1224	1204	c76812ca6cd82d3f2938e97fbdcc39dccbd8cc2120c24314033276fd5fcab9c0.exe	icacls.exe
PID 1204 wrote to memory of 1224	1204	c76812ca6cd82d3f2938e97fbdcc39dccbd8cc2120c24314033276fd5fcab9c0.exe	icacls.exe
PID 1204 wrote to memory of 1224	1204	c76812ca6cd82d3f2938e97fbdcc39dccbd8cc2120c24314033276fd5fcab9c0.exe	icacls.exe
PID 1204 wrote to memory of 1224	1204	c76812ca6cd82d3f2938e97fbdcc39dccbd8cc2120c24314033276fd5fcab9c0.exe	icacls.exe

C:\Users\Admin\AppData\Local\Temp\c76812ca6cd82d3f2938e97fbdcc39dccbd8cc2120c24314033276fd5fcab9c0.exe
"C:\Users\Admin\AppData\Local\Temp\c76812ca6cd82d3f2938e97fbdcc39dccbd8cc2120c24314033276fd5fcab9c0.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1204

C:\Windows\SysWOW64\takeown.exe
C:\Windows\System32\takeown.exe /f "C:\Windows\System32\cmd.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:1768

C:\Windows\SysWOW64\icacls.exe
C:\Windows\System32\icacls.exe "C:\Windows\System32\cmd.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1088

C:\Windows\SysWOW64\takeown.exe
C:\Windows\System32\takeown.exe /f "C:\Windows\System32\ftp.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:1964

C:\Windows\SysWOW64\icacls.exe
C:\Windows\System32\icacls.exe "C:\Windows\System32\ftp.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:552

C:\Windows\SysWOW64\takeown.exe
C:\Windows\System32\takeown.exe /f "C:\Windows\System32\wscript.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:688

C:\Windows\SysWOW64\icacls.exe
C:\Windows\System32\icacls.exe "C:\Windows\System32\wscript.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:584

C:\Windows\SysWOW64\takeown.exe
C:\Windows\System32\takeown.exe /f "C:\Windows\System32\cscript.exe"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:836

C:\Windows\SysWOW64\icacls.exe
C:\Windows\System32\icacls.exe "C:\Windows\System32\cscript.exe" /grant Users:F
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1224

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

1

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/552-59-0x0000000000000000-mapping.dmp

Download
memory/584-61-0x0000000000000000-mapping.dmp

Download
memory/688-60-0x0000000000000000-mapping.dmp

Download
memory/836-62-0x0000000000000000-mapping.dmp

Download
memory/1088-57-0x0000000000000000-mapping.dmp

Download
memory/1224-63-0x0000000000000000-mapping.dmp

Download
memory/1768-56-0x0000000000000000-mapping.dmp

Download
memory/1964-58-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing