f014ff7e29cde690d19f6c89d59b711457c0b5261c6cc5c438935fb0828456a7

Analysis

max time kernel
145s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
18/07/2023, 12:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b215dd689af448_JC.exe
Size

274KB
MD5

b215dd689af448523f6ce2c4499eb1fb
SHA1

2fcfcfa4b7e0343d71b634c680fd6f548a6225d8
SHA256

f014ff7e29cde690d19f6c89d59b711457c0b5261c6cc5c438935fb0828456a7
SHA512

30005a533f728613787d6bea4b825f0c63b73f25201b166a4c5a8db788cd028bf4a84a1857af5655ae82b0450818d2b69e862d90fa03a8d38acdd90bdf881971
SSDEEP

6144:2YvZ6brUj+bvqHXSpWr2Kqz83Oad3Jg4PlPDIQ+KLzDDg:2YvEbrUjp3SpWggd3JBPlPDIQ3g

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\Control Panel\International\Geo\Nation	b215dd689af448_JC.exe

Executes dropped EXE 2 IoCs

pid	Process
488	winit32.exe
4196	winit32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 30 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\.exe\shell\runas\command\IsolatedCommand = "\"%1\" %*"	b215dd689af448_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\ntdriver\DefaultIcon\ = "%1"	b215dd689af448_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\ntdriver\shell\open\command	b215dd689af448_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\ntdriver\shell\runas\command\IsolatedCommand = "\"%1\" %*"	b215dd689af448_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\.exe\shell	b215dd689af448_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\.exe\shell\runas	b215dd689af448_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\ntdriver\shell\open\command\IsolatedCommand = "\"%1\" %*"	b215dd689af448_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\ntdriver\shell\runas\command\ = "\"%1\" %*"	b215dd689af448_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\.exe\ = "ntdriver"	b215dd689af448_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\.exe\shell\open\command	b215dd689af448_JC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	b215dd689af448_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\ntdriver	b215dd689af448_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\ntdriver\ = "Application"	b215dd689af448_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\ntdriver\shell\runas\command	b215dd689af448_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\ntdriver\shell\runas	b215dd689af448_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\.exe\DefaultIcon\ = "%1"	b215dd689af448_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\.exe\Content-Type = "application/x-msdownload"	b215dd689af448_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\.exe\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Posix\\winit32.exe\" /START \"%1\" %*"	b215dd689af448_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\.exe\shell\open\command\IsolatedCommand = "\"%1\" %*"	b215dd689af448_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\.exe\shell\runas\command	b215dd689af448_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\ntdriver\shell	b215dd689af448_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\.exe	b215dd689af448_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\.exe\DefaultIcon	b215dd689af448_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\.exe\shell\open	b215dd689af448_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\.exe\shell\runas\command\ = "\"%1\" %*"	b215dd689af448_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings	b215dd689af448_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\ntdriver\Content-Type = "application/x-msdownload"	b215dd689af448_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\ntdriver\DefaultIcon	b215dd689af448_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\ntdriver\shell\open	b215dd689af448_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\ntdriver\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Posix\\winit32.exe\" /START \"%1\" %*"	b215dd689af448_JC.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	488	winit32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1068 wrote to memory of 488	1068	b215dd689af448_JC.exe	86
PID 1068 wrote to memory of 488	1068	b215dd689af448_JC.exe	86
PID 1068 wrote to memory of 488	1068	b215dd689af448_JC.exe	86
PID 488 wrote to memory of 4196	488	winit32.exe	87
PID 488 wrote to memory of 4196	488	winit32.exe	87
PID 488 wrote to memory of 4196	488	winit32.exe	87

C:\Users\Admin\AppData\Local\Temp\b215dd689af448_JC.exe
"C:\Users\Admin\AppData\Local\Temp\b215dd689af448_JC.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1068
- C:\Users\Admin\AppData\Roaming\Microsoft\Posix\winit32.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Posix\winit32.exe" /START "C:\Users\Admin\AppData\Roaming\Microsoft\Posix\winit32.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:488
- - C:\Users\Admin\AppData\Roaming\Microsoft\Posix\winit32.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Posix\winit32.exe"
    3⤵
    - Executes dropped EXE
    PID:4196

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Posix\winit32.exe

Filesize
274KB

MD5
a05b1013f45953e83556de98f567858d

SHA1
bf5f1e5cd770c44d682b2fdf0cf60b71149c4a31

SHA256
f2ffa4056889c7b6e070d33ed26fee8aa3d29a75a915f137c85f58ae29978728

SHA512
4fbfb26bdad619c9eeda057294235b839348f1989acd1370117c9b2bbef145aaa895d9485825d54feb7139b8221ee64dfdac91f98680ea577aada497d344e79b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Posix\winit32.exe

Filesize
274KB

MD5
a05b1013f45953e83556de98f567858d

SHA1
bf5f1e5cd770c44d682b2fdf0cf60b71149c4a31

SHA256
f2ffa4056889c7b6e070d33ed26fee8aa3d29a75a915f137c85f58ae29978728

SHA512
4fbfb26bdad619c9eeda057294235b839348f1989acd1370117c9b2bbef145aaa895d9485825d54feb7139b8221ee64dfdac91f98680ea577aada497d344e79b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Posix\winit32.exe

Filesize
274KB

MD5
a05b1013f45953e83556de98f567858d

SHA1
bf5f1e5cd770c44d682b2fdf0cf60b71149c4a31

SHA256
f2ffa4056889c7b6e070d33ed26fee8aa3d29a75a915f137c85f58ae29978728

SHA512
4fbfb26bdad619c9eeda057294235b839348f1989acd1370117c9b2bbef145aaa895d9485825d54feb7139b8221ee64dfdac91f98680ea577aada497d344e79b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Posix\winit32.exe

Filesize
274KB

MD5
a05b1013f45953e83556de98f567858d

SHA1
bf5f1e5cd770c44d682b2fdf0cf60b71149c4a31

SHA256
f2ffa4056889c7b6e070d33ed26fee8aa3d29a75a915f137c85f58ae29978728

SHA512
4fbfb26bdad619c9eeda057294235b839348f1989acd1370117c9b2bbef145aaa895d9485825d54feb7139b8221ee64dfdac91f98680ea577aada497d344e79b

Download Submit