e1bd8014416249633ac7d3474adc18599e42ec6f443d100d299cb817634775a5

Analysis

max time kernel
150s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04/03/2024, 22:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b34206561c1c956fb55bf38933f192e5.exe
Size 113KB
Sample240304-2eet4sfd6x
SHA256 e1bd8014416249633ac7d3474adc18599e42ec6f443d100d299cb817634775a5
MD5 b34206561c1c956fb55bf38933f192e5
SHA1 556f60cf351deba07dbf8e0b4e91b4acb4c224d0
SHA512 9e864ce77711c53bfa081aa2e6745a3529177fe6b8dcd72ebe607f16ea97b239ffc4492347277542a29856af21d132d4d042600cc1a9c704b2071df8793b0006
SSDEEP 3072:xnQ0xMDU5V2cCZ+Jkv/0AXj5iNyPpT4bG2:xnccxCbcAXjiU4bz
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

discovery exploit

Malware Config

Signatures

Possible privilege escalation attempt 4 IoCs

exploit

pid	Process
1588	takeown.exe
868	takeown.exe
3540	icacls.exe
5052	icacls.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation	b34206561c1c956fb55bf38933f192e5.exe

Executes dropped EXE 1 IoCs

pid	Process
3096	splash.exe

Modifies file permissions 1 TTPs 4 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1588	takeown.exe
868	takeown.exe
3540	icacls.exe
5052	icacls.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 2 IoCs

evasion

pid	Process
3584	timeout.exe
4580	timeout.exe

Kills process with taskkill 2 IoCs

evasion

pid	Process
5028	taskkill.exe
4920	taskkill.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1588	takeown.exe
Token: SeTakeOwnershipPrivilege	868	takeown.exe
Token: SeDebugPrivilege	5028	taskkill.exe
Token: SeDebugPrivilege	4920	taskkill.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2760 wrote to memory of 3352	2760	b34206561c1c956fb55bf38933f192e5.exe	89
PID 2760 wrote to memory of 3352	2760	b34206561c1c956fb55bf38933f192e5.exe	89
PID 2760 wrote to memory of 3352	2760	b34206561c1c956fb55bf38933f192e5.exe	89
PID 3352 wrote to memory of 3096	3352	cmd.exe	93
PID 3352 wrote to memory of 3096	3352	cmd.exe	93
PID 3352 wrote to memory of 3096	3352	cmd.exe	93
PID 3352 wrote to memory of 1588	3352	cmd.exe	94
PID 3352 wrote to memory of 1588	3352	cmd.exe	94
PID 3352 wrote to memory of 1588	3352	cmd.exe	94
PID 3352 wrote to memory of 868	3352	cmd.exe	95
PID 3352 wrote to memory of 868	3352	cmd.exe	95
PID 3352 wrote to memory of 868	3352	cmd.exe	95
PID 3352 wrote to memory of 3540	3352	cmd.exe	96
PID 3352 wrote to memory of 3540	3352	cmd.exe	96
PID 3352 wrote to memory of 3540	3352	cmd.exe	96
PID 3352 wrote to memory of 5052	3352	cmd.exe	97
PID 3352 wrote to memory of 5052	3352	cmd.exe	97
PID 3352 wrote to memory of 5052	3352	cmd.exe	97
PID 3352 wrote to memory of 4580	3352	cmd.exe	99
PID 3352 wrote to memory of 4580	3352	cmd.exe	99
PID 3352 wrote to memory of 4580	3352	cmd.exe	99
PID 3352 wrote to memory of 3584	3352	cmd.exe	102
PID 3352 wrote to memory of 3584	3352	cmd.exe	102
PID 3352 wrote to memory of 3584	3352	cmd.exe	102
PID 3352 wrote to memory of 5028	3352	cmd.exe	105
PID 3352 wrote to memory of 5028	3352	cmd.exe	105
PID 3352 wrote to memory of 5028	3352	cmd.exe	105
PID 3352 wrote to memory of 4920	3352	cmd.exe	107
PID 3352 wrote to memory of 4920	3352	cmd.exe	107
PID 3352 wrote to memory of 4920	3352	cmd.exe	107

C:\Users\Admin\AppData\Local\Temp\b34206561c1c956fb55bf38933f192e5.exe
"C:\Users\Admin\AppData\Local\Temp\b34206561c1c956fb55bf38933f192e5.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2760
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\8BD5.tmp\METRO.cmd" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3352
- - C:\Users\Admin\AppData\Local\Temp\8BD5.tmp\splash.exe
    splash.exe
    3⤵
    - Executes dropped EXE
    PID:3096
- - C:\Windows\SysWOW64\takeown.exe
    takeown /a /f C:\Windows\System32\shsxs.dll
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:1588
- - C:\Windows\SysWOW64\takeown.exe
    takeown /a /f C:\Windows\SysWOW64\shsxs.dll
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:868
- - C:\Windows\SysWOW64\icacls.exe
    ICACLS C:\Windows\System32\shsxs.dll /Grant Administrators:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:3540
- - C:\Windows\SysWOW64\icacls.exe
    ICACLS C:\Windows\SysWOW64\shsxs.dll /Grant Administrators:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:5052
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:4580
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:3584
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im TM.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5028
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im splash.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

METRO.cmd

Path C:\Users\Admin\AppData\Local\Temp\8BD5.tmp\METRO.cmd
Size 658B
SHA256 b5a16ed052749af003a8127dcd240d69d56df4f430152ea4b40d45c2ac60fea7
MD5 03e8fa1d35711b7d7addacebeea35d62
SHA1 4656d99a9dd13a92e3649b25407817b3e6294156
SHA512 41eb2ac1a480b9b455516ec4b64090649ec7286ea156c876a0bb7a3c336554682d65f0ee15715ed30e9252d92b64e8cfb81f743e490aa7ea6792ad0627664041
MD5 SHA1 SHA512

Submit Download

splash.exe

Path C:\Users\Admin\AppData\Local\Temp\8BD5.tmp\splash.exe
Size 32KB
SHA256 5e03f20b55f186ab0e22a7c3378399e90a89919fd12dc1410f90f83fbd002781
MD5 da9657d72dd80a58aa108a3dbe381642
SHA1 ca350bd54782601b4faa32a3a8c0b93ad5abb6ee
SHA512 e3185605eca861240577b85d5fbaa3e0e31b4495f43a858877d94c1118784f4b1fe49bcf3e4555ba64313153ef413cde62527f71986a869a1be283f63020991e
SSDEEP 768:R/O9gdPHfcdVyvinR/O9QETVl06692bNnWKW:R/dWyanRu30BsRWx
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2760-0-0x0000000000400000-0x000000000043A000-memory.dmp

Download

memory/2760-1-0x0000000000400000-0x000000000043A000-memory.dmp

Download

memory/2760-21-0x0000000000400000-0x000000000043A000-memory.dmp

Download

memory/2760-19-0x0000000000400000-0x000000000043A000-memory.dmp

Download

memory/3096-12-0x0000000005740000-0x00000000057DC000-memory.dmp

Download

memory/3096-14-0x0000000005D90000-0x0000000006334000-memory.dmp

Download

memory/3096-15-0x0000000005880000-0x0000000005912000-memory.dmp

Download

memory/3096-16-0x0000000005A00000-0x0000000005A10000-memory.dmp

Download

memory/3096-17-0x00000000057E0000-0x00000000057EA000-memory.dmp

Download

memory/3096-18-0x0000000005920000-0x0000000005976000-memory.dmp

Download

memory/3096-13-0x0000000073980000-0x0000000074130000-memory.dmp

Download

memory/3096-20-0x0000000073980000-0x0000000074130000-memory.dmp

Download

memory/3096-11-0x0000000000D40000-0x0000000000D50000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads