efbbf54bc486cff0a0ee6208376ed807fa3e6e0a63d38c17848b712ba6dff7eb

General

Target

05cae3ea153097exeexeexeex.exe
Size

288KB
MD5

05cae3ea15309734841f462b03d146f1
SHA1

4e086d09d143380b7d4d41e104bba8ca4a7b795e
SHA256

efbbf54bc486cff0a0ee6208376ed807fa3e6e0a63d38c17848b712ba6dff7eb
SHA512

6c43886a6a460538890f11799b7b1d3be0326b5f8a582eb1c80cff89dbfa2e605e9721582ed5694e422ab482d0d30c6bb97a22b1364154506cc343629724c2ad
SSDEEP

6144:HQ+Tyfx4NF67Sbq2nW82X45gc3BaLZVS0mOoC8zbzDie:HQMyfmNFHfnWfhLZVHmOog

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2968	taskhostsys.exe
2220	taskhostsys.exe

Loads dropped DLL 3 IoCs

pid	Process
3020	05cae3ea153097exeexeexeex.exe
3020	05cae3ea153097exeexeexeex.exe
3020	05cae3ea153097exeexeexeex.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 28 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000_CLASSES\jitc\Content-Type = "application/x-msdownload"	05cae3ea153097exeexeexeex.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000_CLASSES\jitc\DefaultIcon\ = "%1"	05cae3ea153097exeexeexeex.exe
Key created	\REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000_CLASSES\.exe\shell\open\command	05cae3ea153097exeexeexeex.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000_CLASSES\.exe\shell\open\command\IsolatedCommand = "\"%1\" %*"	05cae3ea153097exeexeexeex.exe
Key created	\REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000_CLASSES\.exe\shell\runas	05cae3ea153097exeexeexeex.exe
Key created	\REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000_CLASSES\jitc\shell	05cae3ea153097exeexeexeex.exe
Key created	\REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000_CLASSES\jitc\shell\open	05cae3ea153097exeexeexeex.exe
Key created	\REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000_CLASSES\jitc\shell\runas	05cae3ea153097exeexeexeex.exe
Key created	\REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000_CLASSES\.exe\shell\open	05cae3ea153097exeexeexeex.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000_CLASSES\jitc\ = "Application"	05cae3ea153097exeexeexeex.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000_CLASSES\.exe\shell\runas\command\ = "\"%1\" %*"	05cae3ea153097exeexeexeex.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000_CLASSES\jitc\shell\open\command\IsolatedCommand = "\"%1\" %*"	05cae3ea153097exeexeexeex.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000_CLASSES\.exe\Content-Type = "application/x-msdownload"	05cae3ea153097exeexeexeex.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000_CLASSES\.exe\DefaultIcon\ = "%1"	05cae3ea153097exeexeexeex.exe
Key created	\REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000_CLASSES\.exe\shell	05cae3ea153097exeexeexeex.exe
Key created	\REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000_CLASSES\.exe\shell\runas\command	05cae3ea153097exeexeexeex.exe
Key created	\REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000_CLASSES\jitc	05cae3ea153097exeexeexeex.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000_CLASSES\jitc\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Posix\\taskhostsys.exe\" /START \"%1\" %*"	05cae3ea153097exeexeexeex.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000_CLASSES\jitc\shell\runas\command\ = "\"%1\" %*"	05cae3ea153097exeexeexeex.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000_CLASSES\jitc\shell\runas\command\IsolatedCommand = "\"%1\" %*"	05cae3ea153097exeexeexeex.exe
Key created	\REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000_CLASSES\.exe	05cae3ea153097exeexeexeex.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000_CLASSES\.exe\shell\runas\command\IsolatedCommand = "\"%1\" %*"	05cae3ea153097exeexeexeex.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000_CLASSES\.exe\ = "jitc"	05cae3ea153097exeexeexeex.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000_CLASSES\.exe\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Posix\\taskhostsys.exe\" /START \"%1\" %*"	05cae3ea153097exeexeexeex.exe
Key created	\REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000_CLASSES\jitc\DefaultIcon	05cae3ea153097exeexeexeex.exe
Key created	\REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000_CLASSES\jitc\shell\open\command	05cae3ea153097exeexeexeex.exe
Key created	\REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000_CLASSES\jitc\shell\runas\command	05cae3ea153097exeexeexeex.exe
Key created	\REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000_CLASSES\.exe\DefaultIcon	05cae3ea153097exeexeexeex.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2968	taskhostsys.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3020 wrote to memory of 2968	3020	05cae3ea153097exeexeexeex.exe	27
PID 3020 wrote to memory of 2968	3020	05cae3ea153097exeexeexeex.exe	27
PID 3020 wrote to memory of 2968	3020	05cae3ea153097exeexeexeex.exe	27
PID 3020 wrote to memory of 2968	3020	05cae3ea153097exeexeexeex.exe	27
PID 2968 wrote to memory of 2220	2968	taskhostsys.exe	28
PID 2968 wrote to memory of 2220	2968	taskhostsys.exe	28
PID 2968 wrote to memory of 2220	2968	taskhostsys.exe	28
PID 2968 wrote to memory of 2220	2968	taskhostsys.exe	28

C:\Users\Admin\AppData\Local\Temp\05cae3ea153097exeexeexeex.exe
"C:\Users\Admin\AppData\Local\Temp\05cae3ea153097exeexeexeex.exe"
1⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Users\Admin\AppData\Roaming\Microsoft\Posix\taskhostsys.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Posix\taskhostsys.exe" /START "C:\Users\Admin\AppData\Roaming\Microsoft\Posix\taskhostsys.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2968
- - C:\Users\Admin\AppData\Roaming\Microsoft\Posix\taskhostsys.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Posix\taskhostsys.exe"
    3⤵
    - Executes dropped EXE
    PID:2220

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Posix\taskhostsys.exe

Filesize
288KB

MD5
824ff4c82f78d63d491b8f0c78eaa0f8

SHA1
e77b158a7a1ce337231de0344e5565c12f85038b

SHA256
c3fe9234e8010e6207110bef6bb72dd85cb3c0a6adc2b061b151a0d4101f2c10

SHA512
c35ce16b3dd41d92e72fc1de06b56292d20ff65059459901f953d5dfb1f524500177db73838111d1a9f0b2fc390b6433201d17b18cfa14bd5776e90947f9e1be

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Posix\taskhostsys.exe

Filesize
288KB

MD5
824ff4c82f78d63d491b8f0c78eaa0f8

SHA1
e77b158a7a1ce337231de0344e5565c12f85038b

SHA256
c3fe9234e8010e6207110bef6bb72dd85cb3c0a6adc2b061b151a0d4101f2c10

SHA512
c35ce16b3dd41d92e72fc1de06b56292d20ff65059459901f953d5dfb1f524500177db73838111d1a9f0b2fc390b6433201d17b18cfa14bd5776e90947f9e1be

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Posix\taskhostsys.exe

Filesize
288KB

MD5
824ff4c82f78d63d491b8f0c78eaa0f8

SHA1
e77b158a7a1ce337231de0344e5565c12f85038b

SHA256
c3fe9234e8010e6207110bef6bb72dd85cb3c0a6adc2b061b151a0d4101f2c10

SHA512
c35ce16b3dd41d92e72fc1de06b56292d20ff65059459901f953d5dfb1f524500177db73838111d1a9f0b2fc390b6433201d17b18cfa14bd5776e90947f9e1be

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Posix\taskhostsys.exe

Filesize
288KB

MD5
824ff4c82f78d63d491b8f0c78eaa0f8

SHA1
e77b158a7a1ce337231de0344e5565c12f85038b

SHA256
c3fe9234e8010e6207110bef6bb72dd85cb3c0a6adc2b061b151a0d4101f2c10

SHA512
c35ce16b3dd41d92e72fc1de06b56292d20ff65059459901f953d5dfb1f524500177db73838111d1a9f0b2fc390b6433201d17b18cfa14bd5776e90947f9e1be

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Posix\taskhostsys.exe

Filesize
288KB

MD5
824ff4c82f78d63d491b8f0c78eaa0f8

SHA1
e77b158a7a1ce337231de0344e5565c12f85038b

SHA256
c3fe9234e8010e6207110bef6bb72dd85cb3c0a6adc2b061b151a0d4101f2c10

SHA512
c35ce16b3dd41d92e72fc1de06b56292d20ff65059459901f953d5dfb1f524500177db73838111d1a9f0b2fc390b6433201d17b18cfa14bd5776e90947f9e1be

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Posix\taskhostsys.exe

Filesize
288KB

MD5
824ff4c82f78d63d491b8f0c78eaa0f8

SHA1
e77b158a7a1ce337231de0344e5565c12f85038b

SHA256
c3fe9234e8010e6207110bef6bb72dd85cb3c0a6adc2b061b151a0d4101f2c10

SHA512
c35ce16b3dd41d92e72fc1de06b56292d20ff65059459901f953d5dfb1f524500177db73838111d1a9f0b2fc390b6433201d17b18cfa14bd5776e90947f9e1be

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Posix\taskhostsys.exe

Filesize
288KB

MD5
824ff4c82f78d63d491b8f0c78eaa0f8

SHA1
e77b158a7a1ce337231de0344e5565c12f85038b

SHA256
c3fe9234e8010e6207110bef6bb72dd85cb3c0a6adc2b061b151a0d4101f2c10

SHA512
c35ce16b3dd41d92e72fc1de06b56292d20ff65059459901f953d5dfb1f524500177db73838111d1a9f0b2fc390b6433201d17b18cfa14bd5776e90947f9e1be

Download Submit

Analysis

Sharing