709cb4b896255c8ea0556cf0048d4cfc4b395f01b83926b0f83ff9dcb632d2a5

Analysis

user interaction
yes
max time kernel
12s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/07/2026, 15:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
runner.bat
Size 609B
Sample260710-sfx8eady7x
SHA256 709cb4b896255c8ea0556cf0048d4cfc4b395f01b83926b0f83ff9dcb632d2a5
MD5 826890dca28663b78e45a3dceb8547ea
SHA1 77afe15f7234fc18a6c043442257b598896d52d3
SHA512 43564680e4eb1963c0807b9984e815d93991e073e06b93d1eb1c89e31690e002f6f8a856c65fdc4352cb7c7ceeeb4dbbf75d2ccb9ef75ff62d75ce5af3ba9ed6
TLSH
T106F097A89FE581F5C0210DA4D18F9235826AB5CE3105A07593E134E5EA4542B5E32EED
MD5 SHA1 SHA512 TLSH

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 7 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
5108	takeown.exe
5152	takeown.exe
4740	takeown.exe
5840	takeown.exe
3440	takeown.exe
2572	takeown.exe
3548	takeown.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3440	takeown.exe
Token: SeTakeOwnershipPrivilege	2572	takeown.exe
Token: SeTakeOwnershipPrivilege	3548	takeown.exe
Token: SeTakeOwnershipPrivilege	5108	takeown.exe
Token: SeTakeOwnershipPrivilege	5152	takeown.exe
Token: SeTakeOwnershipPrivilege	4740	takeown.exe
Token: SeTakeOwnershipPrivilege	5840	takeown.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3536 wrote to memory of 3440	3536	cmd.exe	88
PID 3536 wrote to memory of 2572	3536	cmd.exe	89
PID 3536 wrote to memory of 3548	3536	cmd.exe	90
PID 3536 wrote to memory of 5108	3536	cmd.exe	91
PID 3536 wrote to memory of 5152	3536	cmd.exe	92
PID 3536 wrote to memory of 4740	3536	cmd.exe	93
PID 3536 wrote to memory of 5840	3536	cmd.exe	94

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\runner.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3536
- C:\Windows\system32\takeown.exe
  takeown /f C:\Windows\System32\winlogon.exe
  2⤵
  - Modifies file permissions
  - Suspicious use of AdjustPrivilegeToken
  PID:3440
- C:\Windows\system32\takeown.exe
  takeown /f C:\Windows\System32\svchost.exe
  2⤵
  - Modifies file permissions
  - Suspicious use of AdjustPrivilegeToken
  PID:2572
- C:\Windows\system32\takeown.exe
  takeown /f C:\Windows\System32\LogonUI.exe
  2⤵
  - Modifies file permissions
  - Suspicious use of AdjustPrivilegeToken
  PID:3548
- C:\Windows\system32\takeown.exe
  takeown /f C:\Windows\System32\hal.dll
  2⤵
  - Modifies file permissions
  - Suspicious use of AdjustPrivilegeToken
  PID:5108
- C:\Windows\system32\takeown.exe
  takeown /f C:\Windows\System32\csrss.exe
  2⤵
  - Modifies file permissions
  - Suspicious use of AdjustPrivilegeToken
  PID:5152
- C:\Windows\system32\takeown.exe
  takeown /f C:\Windows\System32\ntoskrnl.exe
  2⤵
  - Modifies file permissions
  - Suspicious use of AdjustPrivilegeToken
  PID:4740
- C:\Windows\system32\takeown.exe
  takeown /f C:\Windows\System32\winload.exe
  2⤵
  - Modifies file permissions
  - Suspicious use of AdjustPrivilegeToken
  PID:5840

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads