709cb4b896255c8ea0556cf0048d4cfc4b395f01b83926b0f83ff9dcb632d2a5

Analysis

user interaction
yes
max time kernel
16s
max time network
18s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/07/2026, 15:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
runner.bat
Size 609B
Sample260710-sfx8eady7x
SHA256 709cb4b896255c8ea0556cf0048d4cfc4b395f01b83926b0f83ff9dcb632d2a5
MD5 826890dca28663b78e45a3dceb8547ea
SHA1 77afe15f7234fc18a6c043442257b598896d52d3
SHA512 43564680e4eb1963c0807b9984e815d93991e073e06b93d1eb1c89e31690e002f6f8a856c65fdc4352cb7c7ceeeb4dbbf75d2ccb9ef75ff62d75ce5af3ba9ed6
TLSH
T106F097A89FE581F5C0210DA4D18F9235826AB5CE3105A07593E134E5EA4542B5E32EED
MD5 SHA1 SHA512 TLSH

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 7 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4752	takeown.exe
1536	takeown.exe
2608	takeown.exe
2328	takeown.exe
3996	takeown.exe
2296	takeown.exe
3724	takeown.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3724	takeown.exe
Token: SeTakeOwnershipPrivilege	4752	takeown.exe
Token: SeTakeOwnershipPrivilege	1536	takeown.exe
Token: SeTakeOwnershipPrivilege	2608	takeown.exe
Token: SeTakeOwnershipPrivilege	2328	takeown.exe
Token: SeTakeOwnershipPrivilege	3996	takeown.exe
Token: SeTakeOwnershipPrivilege	2296	takeown.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1572 wrote to memory of 3724	1572	cmd.exe	87
PID 1572 wrote to memory of 4752	1572	cmd.exe	88
PID 1572 wrote to memory of 1536	1572	cmd.exe	89
PID 1572 wrote to memory of 2608	1572	cmd.exe	90
PID 1572 wrote to memory of 2328	1572	cmd.exe	91
PID 1572 wrote to memory of 3996	1572	cmd.exe	92
PID 1572 wrote to memory of 2296	1572	cmd.exe	93

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\runner.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1572
- C:\Windows\system32\takeown.exe
  takeown /f C:\Windows\System32\winlogon.exe
  2⤵
  - Modifies file permissions
  - Suspicious use of AdjustPrivilegeToken
  PID:3724
- C:\Windows\system32\takeown.exe
  takeown /f C:\Windows\System32\svchost.exe
  2⤵
  - Modifies file permissions
  - Suspicious use of AdjustPrivilegeToken
  PID:4752
- C:\Windows\system32\takeown.exe
  takeown /f C:\Windows\System32\LogonUI.exe
  2⤵
  - Modifies file permissions
  - Suspicious use of AdjustPrivilegeToken
  PID:1536
- C:\Windows\system32\takeown.exe
  takeown /f C:\Windows\System32\hal.dll
  2⤵
  - Modifies file permissions
  - Suspicious use of AdjustPrivilegeToken
  PID:2608
- C:\Windows\system32\takeown.exe
  takeown /f C:\Windows\System32\csrss.exe
  2⤵
  - Modifies file permissions
  - Suspicious use of AdjustPrivilegeToken
  PID:2328
- C:\Windows\system32\takeown.exe
  takeown /f C:\Windows\System32\ntoskrnl.exe
  2⤵
  - Modifies file permissions
  - Suspicious use of AdjustPrivilegeToken
  PID:3996
- C:\Windows\system32\takeown.exe
  takeown /f C:\Windows\System32\winload.exe
  2⤵
  - Modifies file permissions
  - Suspicious use of AdjustPrivilegeToken
  PID:2296

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads