3b50fe74f6b83d53efab2ee7e197026977dac17fdd3302c7df454fac19abb12d

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
21-05-2024 01:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3b50fe74f6b83d53efab2ee7e197026977dac17fdd3302c7df454fac19abb12d.exe
Size

326KB
MD5

a59664f37c25edaa69c39a65490ed3a9
SHA1

01bb46541bc678fe9d97cea31cb61f3db861ba68
SHA256

3b50fe74f6b83d53efab2ee7e197026977dac17fdd3302c7df454fac19abb12d
SHA512

76ba5fea9e63bf091ac2f2234447ad48c93b1b21594fd2c737d24073efc2871265c83622364764c886769d579c727784c045d3d4b2fc0a6e778dc30e64f1f393
SSDEEP

6144:Rj8KWXflIwycVYUcBrcisb765kohreOCSYA/U:+Kkfl3x0BrcdEkoWCc

Score

8^/10

discovery exploit

Malware Config

Signatures

Possible privilege escalation attempt 2 IoCs

exploit

pid	Process
2504	takeown.exe
2496	icacls.exe

Executes dropped EXE 1 IoCs

pid	Process
2524	wmpnetwk.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2504	takeown.exe
2496	icacls.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Media Player\wmixedwk.exe	3b50fe74f6b83d53efab2ee7e197026977dac17fdd3302c7df454fac19abb12d.exe
File opened for modification	C:\Program Files\Windows Media Player\wmixedwk.exe	3b50fe74f6b83d53efab2ee7e197026977dac17fdd3302c7df454fac19abb12d.exe
File created	C:\Program Files\Windows Media Player\background.jpg	3b50fe74f6b83d53efab2ee7e197026977dac17fdd3302c7df454fac19abb12d.exe
File created	C:\Program Files\Windows Media Player\mpsvc.dll	3b50fe74f6b83d53efab2ee7e197026977dac17fdd3302c7df454fac19abb12d.exe
File created	C:\Program Files\Windows Media Player\wmpnetwk.exe	3b50fe74f6b83d53efab2ee7e197026977dac17fdd3302c7df454fac19abb12d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2504	takeown.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1848 wrote to memory of 2160	1848	3b50fe74f6b83d53efab2ee7e197026977dac17fdd3302c7df454fac19abb12d.exe	29
PID 1848 wrote to memory of 2160	1848	3b50fe74f6b83d53efab2ee7e197026977dac17fdd3302c7df454fac19abb12d.exe	29
PID 1848 wrote to memory of 2160	1848	3b50fe74f6b83d53efab2ee7e197026977dac17fdd3302c7df454fac19abb12d.exe	29
PID 2160 wrote to memory of 2504	2160	cmd.exe	31
PID 2160 wrote to memory of 2504	2160	cmd.exe	31
PID 2160 wrote to memory of 2504	2160	cmd.exe	31
PID 2160 wrote to memory of 2496	2160	cmd.exe	32
PID 2160 wrote to memory of 2496	2160	cmd.exe	32
PID 2160 wrote to memory of 2496	2160	cmd.exe	32

C:\Users\Admin\AppData\Local\Temp\3b50fe74f6b83d53efab2ee7e197026977dac17fdd3302c7df454fac19abb12d.exe
"C:\Users\Admin\AppData\Local\Temp\3b50fe74f6b83d53efab2ee7e197026977dac17fdd3302c7df454fac19abb12d.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1848
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd /c takeown /f "C:\Program Files\Windows Media Player\wmpnetwk.exe" && icacls "C:\Program Files\Windows Media Player\wmpnetwk.exe" /grant administrators:F
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2160
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Program Files\Windows Media Player\wmpnetwk.exe"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:2504
- - C:\Windows\system32\icacls.exe
    icacls "C:\Program Files\Windows Media Player\wmpnetwk.exe" /grant administrators:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2496

C:\Program Files\Windows Media Player\wmpnetwk.exe
"C:\Program Files\Windows Media Player\wmpnetwk.exe"
1⤵
- Executes dropped EXE
PID:2524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Windows Media Player\wmpnetwk.exe

Filesize
23KB

MD5
90b85ffbdeead1be861d59134ea985b0

SHA1
55e9859aa7dba87678e7c529b571fdf6b7181339

SHA256
ed0dc979eed9ab9933c49204d362de575c7112a792633fda75bb5d1dab50a5c2

SHA512
8a1c10bbfe5651ab25bf36f4e8f2f65424c8e1004696c8141498b99ea2fbd7b3e5fae4d2cfee6835f7ff46bd2333602f4d8ac4a0f5b8e9757adb176332a3afce

Download Submit
memory/1848-0-0x000000013F2EA000-0x000000013F2EB000-memory.dmp

Filesize
4KB

Download
memory/1848-5-0x000000013F2D0000-0x000000013F326000-memory.dmp

Filesize
344KB

Download
memory/1848-3-0x0000000002240000-0x0000000002269000-memory.dmp

Filesize
164KB

Download
memory/1848-19-0x0000000002240000-0x0000000002269000-memory.dmp

Filesize
164KB

Download