e1bd8014416249633ac7d3474adc18599e42ec6f443d100d299cb817634775a5

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04/03/2024, 22:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b34206561c1c956fb55bf38933f192e5.exe
Size 113KB
Sample240304-2eet4sfd6x
SHA256 e1bd8014416249633ac7d3474adc18599e42ec6f443d100d299cb817634775a5
MD5 b34206561c1c956fb55bf38933f192e5
SHA1 556f60cf351deba07dbf8e0b4e91b4acb4c224d0
SHA512 9e864ce77711c53bfa081aa2e6745a3529177fe6b8dcd72ebe607f16ea97b239ffc4492347277542a29856af21d132d4d042600cc1a9c704b2071df8793b0006
SSDEEP 3072:xnQ0xMDU5V2cCZ+Jkv/0AXj5iNyPpT4bG2:xnccxCbcAXjiU4bz
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

discovery exploit

Malware Config

Signatures

Possible privilege escalation attempt 4 IoCs

exploit

pid	Process
2588	takeown.exe
2596	takeown.exe
2740	icacls.exe
2544	icacls.exe

Executes dropped EXE 1 IoCs

pid	Process
2648	splash.exe

Loads dropped DLL 1 IoCs

pid	Process
2484	cmd.exe

Modifies file permissions 1 TTPs 4 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2588	takeown.exe
2596	takeown.exe
2740	icacls.exe
2544	icacls.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 2 IoCs

evasion

pid	Process
2896	timeout.exe
2380	timeout.exe

Kills process with taskkill 2 IoCs

evasion

pid	Process
2696	taskkill.exe
2432	taskkill.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2588	takeown.exe
Token: SeTakeOwnershipPrivilege	2596	takeown.exe
Token: SeDebugPrivilege	2432	taskkill.exe
Token: SeDebugPrivilege	2696	taskkill.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 2484	2020	b34206561c1c956fb55bf38933f192e5.exe	28
PID 2020 wrote to memory of 2484	2020	b34206561c1c956fb55bf38933f192e5.exe	28
PID 2020 wrote to memory of 2484	2020	b34206561c1c956fb55bf38933f192e5.exe	28
PID 2020 wrote to memory of 2484	2020	b34206561c1c956fb55bf38933f192e5.exe	28
PID 2484 wrote to memory of 2648	2484	cmd.exe	30
PID 2484 wrote to memory of 2648	2484	cmd.exe	30
PID 2484 wrote to memory of 2648	2484	cmd.exe	30
PID 2484 wrote to memory of 2648	2484	cmd.exe	30
PID 2484 wrote to memory of 2588	2484	cmd.exe	31
PID 2484 wrote to memory of 2588	2484	cmd.exe	31
PID 2484 wrote to memory of 2588	2484	cmd.exe	31
PID 2484 wrote to memory of 2588	2484	cmd.exe	31
PID 2484 wrote to memory of 2596	2484	cmd.exe	32
PID 2484 wrote to memory of 2596	2484	cmd.exe	32
PID 2484 wrote to memory of 2596	2484	cmd.exe	32
PID 2484 wrote to memory of 2596	2484	cmd.exe	32
PID 2484 wrote to memory of 2740	2484	cmd.exe	33
PID 2484 wrote to memory of 2740	2484	cmd.exe	33
PID 2484 wrote to memory of 2740	2484	cmd.exe	33
PID 2484 wrote to memory of 2740	2484	cmd.exe	33
PID 2484 wrote to memory of 2544	2484	cmd.exe	34
PID 2484 wrote to memory of 2544	2484	cmd.exe	34
PID 2484 wrote to memory of 2544	2484	cmd.exe	34
PID 2484 wrote to memory of 2544	2484	cmd.exe	34
PID 2484 wrote to memory of 2380	2484	cmd.exe	35
PID 2484 wrote to memory of 2380	2484	cmd.exe	35
PID 2484 wrote to memory of 2380	2484	cmd.exe	35
PID 2484 wrote to memory of 2380	2484	cmd.exe	35
PID 2484 wrote to memory of 2896	2484	cmd.exe	36
PID 2484 wrote to memory of 2896	2484	cmd.exe	36
PID 2484 wrote to memory of 2896	2484	cmd.exe	36
PID 2484 wrote to memory of 2896	2484	cmd.exe	36
PID 2484 wrote to memory of 2432	2484	cmd.exe	37
PID 2484 wrote to memory of 2432	2484	cmd.exe	37
PID 2484 wrote to memory of 2432	2484	cmd.exe	37
PID 2484 wrote to memory of 2432	2484	cmd.exe	37
PID 2484 wrote to memory of 2696	2484	cmd.exe	39
PID 2484 wrote to memory of 2696	2484	cmd.exe	39
PID 2484 wrote to memory of 2696	2484	cmd.exe	39
PID 2484 wrote to memory of 2696	2484	cmd.exe	39

C:\Users\Admin\AppData\Local\Temp\b34206561c1c956fb55bf38933f192e5.exe
"C:\Users\Admin\AppData\Local\Temp\b34206561c1c956fb55bf38933f192e5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\472E.tmp\METRO.cmd" "
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2484
- - C:\Users\Admin\AppData\Local\Temp\472E.tmp\splash.exe
    splash.exe
    3⤵
    - Executes dropped EXE
    PID:2648
- - C:\Windows\SysWOW64\takeown.exe
    takeown /a /f C:\Windows\System32\shsxs.dll
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:2588
- - C:\Windows\SysWOW64\takeown.exe
    takeown /a /f C:\Windows\SysWOW64\shsxs.dll
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:2596
- - C:\Windows\SysWOW64\icacls.exe
    ICACLS C:\Windows\System32\shsxs.dll /Grant Administrators:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2740
- - C:\Windows\SysWOW64\icacls.exe
    ICACLS C:\Windows\SysWOW64\shsxs.dll /Grant Administrators:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2544
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:2380
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:2896
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im TM.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2432
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im splash.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

METRO.cmd

Path C:\Users\Admin\AppData\Local\Temp\472E.tmp\METRO.cmd
Size 658B
SHA256 b5a16ed052749af003a8127dcd240d69d56df4f430152ea4b40d45c2ac60fea7
MD5 03e8fa1d35711b7d7addacebeea35d62
SHA1 4656d99a9dd13a92e3649b25407817b3e6294156
SHA512 41eb2ac1a480b9b455516ec4b64090649ec7286ea156c876a0bb7a3c336554682d65f0ee15715ed30e9252d92b64e8cfb81f743e490aa7ea6792ad0627664041
MD5 SHA1 SHA512

Submit Download

splash.exe

Path C:\Users\Admin\AppData\Local\Temp\472E.tmp\splash.exe
Size 32KB
SHA256 5e03f20b55f186ab0e22a7c3378399e90a89919fd12dc1410f90f83fbd002781
MD5 da9657d72dd80a58aa108a3dbe381642
SHA1 ca350bd54782601b4faa32a3a8c0b93ad5abb6ee
SHA512 e3185605eca861240577b85d5fbaa3e0e31b4495f43a858877d94c1118784f4b1fe49bcf3e4555ba64313153ef413cde62527f71986a869a1be283f63020991e
SSDEEP 768:R/O9gdPHfcdVyvinR/O9QETVl06692bNnWKW:R/dWyanRu30BsRWx
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2020-0-0x0000000000400000-0x000000000043A000-memory.dmp

Download

memory/2020-39-0x0000000000400000-0x000000000043A000-memory.dmp

Download

memory/2020-47-0x0000000000400000-0x000000000043A000-memory.dmp

Download

memory/2484-34-0x0000000002270000-0x0000000002271000-memory.dmp

Download

memory/2484-42-0x0000000002270000-0x0000000002271000-memory.dmp

Download

memory/2648-21-0x0000000000260000-0x0000000000270000-memory.dmp

Download

memory/2648-22-0x0000000072720000-0x0000000072E0E000-memory.dmp

Download

memory/2648-23-0x0000000001EF0000-0x0000000001F30000-memory.dmp

Download

memory/2648-40-0x0000000072720000-0x0000000072E0E000-memory.dmp

Download

memory/2648-41-0x0000000001EF0000-0x0000000001F30000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads