1fed3f4d333c580158610bed05a1921acf5e573daed5b6dcc690699dd8811d70

General

Target

e6a0d119d7e76cexe_JC.exe
Size

329KB
MD5

e6a0d119d7e76c2d0774d6e36e168462
SHA1

5e31af49a219b5d3c5c6864035115fdb44833d0f
SHA256

1fed3f4d333c580158610bed05a1921acf5e573daed5b6dcc690699dd8811d70
SHA512

9c803d4ee33233246fb383225a66c9ee8922ab52b9eacf14690a9e77eb448df7622645b79d2b41c1484bfe6fcfc637625ef9ad6a7176b529fcc5cfde9d86fa40
SSDEEP

6144:P2+JS2sFafI8U0obHCW/2a7XQcsPMjVWrG89gkPzDh1v:P2TFafJiHCWBWPMjVWrXf1v

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2304	taskhostsys.exe
3008	taskhostsys.exe

Loads dropped DLL 3 IoCs

pid	Process
2052	e6a0d119d7e76cexe_JC.exe
2052	e6a0d119d7e76cexe_JC.exe
2052	e6a0d119d7e76cexe_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 28 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000_CLASSES\.exe	e6a0d119d7e76cexe_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000_CLASSES\jitc\DefaultIcon\ = "%1"	e6a0d119d7e76cexe_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000_CLASSES\jitc\shell\open\command\IsolatedCommand = "\"%1\" %*"	e6a0d119d7e76cexe_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000_CLASSES\jitc\shell\runas\command	e6a0d119d7e76cexe_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000_CLASSES\jitc\shell\open\command	e6a0d119d7e76cexe_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000_CLASSES\.exe\DefaultIcon\ = "%1"	e6a0d119d7e76cexe_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000_CLASSES\.exe\shell\open\command\IsolatedCommand = "\"%1\" %*"	e6a0d119d7e76cexe_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000_CLASSES\.exe\shell\open\command	e6a0d119d7e76cexe_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000_CLASSES\.exe\shell\runas\command	e6a0d119d7e76cexe_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000_CLASSES\jitc\DefaultIcon	e6a0d119d7e76cexe_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000_CLASSES\jitc\shell\open	e6a0d119d7e76cexe_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000_CLASSES\.exe\DefaultIcon	e6a0d119d7e76cexe_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000_CLASSES\.exe\shell\runas\command\ = "\"%1\" %*"	e6a0d119d7e76cexe_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000_CLASSES\.exe\shell\runas\command\IsolatedCommand = "\"%1\" %*"	e6a0d119d7e76cexe_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000_CLASSES\jitc\shell	e6a0d119d7e76cexe_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000_CLASSES\jitc\shell\runas\command\ = "\"%1\" %*"	e6a0d119d7e76cexe_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000_CLASSES\.exe\shell\open	e6a0d119d7e76cexe_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000_CLASSES\.exe\Content-Type = "application/x-msdownload"	e6a0d119d7e76cexe_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000_CLASSES\.exe\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\SysWOW_x86_64\\taskhostsys.exe\" /START \"%1\" %*"	e6a0d119d7e76cexe_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000_CLASSES\jitc\ = "Application"	e6a0d119d7e76cexe_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000_CLASSES\.exe\ = "jitc"	e6a0d119d7e76cexe_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000_CLASSES\.exe\shell	e6a0d119d7e76cexe_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000_CLASSES\jitc\Content-Type = "application/x-msdownload"	e6a0d119d7e76cexe_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000_CLASSES\jitc\shell\runas\command\IsolatedCommand = "\"%1\" %*"	e6a0d119d7e76cexe_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000_CLASSES\.exe\shell\runas	e6a0d119d7e76cexe_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000_CLASSES\jitc	e6a0d119d7e76cexe_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000_CLASSES\jitc\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\SysWOW_x86_64\\taskhostsys.exe\" /START \"%1\" %*"	e6a0d119d7e76cexe_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000_CLASSES\jitc\shell\runas	e6a0d119d7e76cexe_JC.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2304	taskhostsys.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2052 wrote to memory of 2304	2052	e6a0d119d7e76cexe_JC.exe	28
PID 2052 wrote to memory of 2304	2052	e6a0d119d7e76cexe_JC.exe	28
PID 2052 wrote to memory of 2304	2052	e6a0d119d7e76cexe_JC.exe	28
PID 2052 wrote to memory of 2304	2052	e6a0d119d7e76cexe_JC.exe	28
PID 2304 wrote to memory of 3008	2304	taskhostsys.exe	29
PID 2304 wrote to memory of 3008	2304	taskhostsys.exe	29
PID 2304 wrote to memory of 3008	2304	taskhostsys.exe	29
PID 2304 wrote to memory of 3008	2304	taskhostsys.exe	29

C:\Users\Admin\AppData\Local\Temp\e6a0d119d7e76cexe_JC.exe
"C:\Users\Admin\AppData\Local\Temp\e6a0d119d7e76cexe_JC.exe"
1⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2052
- C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_x86_64\taskhostsys.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_x86_64\taskhostsys.exe" /START "C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_x86_64\taskhostsys.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2304
- - C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_x86_64\taskhostsys.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_x86_64\taskhostsys.exe"
    3⤵
    - Executes dropped EXE
    PID:3008

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_x86_64\taskhostsys.exe

Filesize
329KB

MD5
55ce1e5df6092a53a278cd2e430e2150

SHA1
d3080e1b96b3ca6efa16915ba8e0a33355e445d2

SHA256
01aeb8bd2d97783a4bfe479df60d8ce97107827a990f86bcc003bcc4894ae273

SHA512
0ef5ba637f8121db45a129c326a7d400f97aea5435d42bacecab3538d4db622bc15f5c2ea26458cdf2b4dc6c716efdb6f436c08b55d296b41a448314c894526f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_x86_64\taskhostsys.exe

Filesize
329KB

MD5
55ce1e5df6092a53a278cd2e430e2150

SHA1
d3080e1b96b3ca6efa16915ba8e0a33355e445d2

SHA256
01aeb8bd2d97783a4bfe479df60d8ce97107827a990f86bcc003bcc4894ae273

SHA512
0ef5ba637f8121db45a129c326a7d400f97aea5435d42bacecab3538d4db622bc15f5c2ea26458cdf2b4dc6c716efdb6f436c08b55d296b41a448314c894526f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_x86_64\taskhostsys.exe

Filesize
329KB

MD5
55ce1e5df6092a53a278cd2e430e2150

SHA1
d3080e1b96b3ca6efa16915ba8e0a33355e445d2

SHA256
01aeb8bd2d97783a4bfe479df60d8ce97107827a990f86bcc003bcc4894ae273

SHA512
0ef5ba637f8121db45a129c326a7d400f97aea5435d42bacecab3538d4db622bc15f5c2ea26458cdf2b4dc6c716efdb6f436c08b55d296b41a448314c894526f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_x86_64\taskhostsys.exe

Filesize
329KB

MD5
55ce1e5df6092a53a278cd2e430e2150

SHA1
d3080e1b96b3ca6efa16915ba8e0a33355e445d2

SHA256
01aeb8bd2d97783a4bfe479df60d8ce97107827a990f86bcc003bcc4894ae273

SHA512
0ef5ba637f8121db45a129c326a7d400f97aea5435d42bacecab3538d4db622bc15f5c2ea26458cdf2b4dc6c716efdb6f436c08b55d296b41a448314c894526f

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\SysWOW_x86_64\taskhostsys.exe

Filesize
329KB

MD5
55ce1e5df6092a53a278cd2e430e2150

SHA1
d3080e1b96b3ca6efa16915ba8e0a33355e445d2

SHA256
01aeb8bd2d97783a4bfe479df60d8ce97107827a990f86bcc003bcc4894ae273

SHA512
0ef5ba637f8121db45a129c326a7d400f97aea5435d42bacecab3538d4db622bc15f5c2ea26458cdf2b4dc6c716efdb6f436c08b55d296b41a448314c894526f

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\SysWOW_x86_64\taskhostsys.exe

Filesize
329KB

MD5
55ce1e5df6092a53a278cd2e430e2150

SHA1
d3080e1b96b3ca6efa16915ba8e0a33355e445d2

SHA256
01aeb8bd2d97783a4bfe479df60d8ce97107827a990f86bcc003bcc4894ae273

SHA512
0ef5ba637f8121db45a129c326a7d400f97aea5435d42bacecab3538d4db622bc15f5c2ea26458cdf2b4dc6c716efdb6f436c08b55d296b41a448314c894526f

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\SysWOW_x86_64\taskhostsys.exe

Filesize
329KB

MD5
55ce1e5df6092a53a278cd2e430e2150

SHA1
d3080e1b96b3ca6efa16915ba8e0a33355e445d2

SHA256
01aeb8bd2d97783a4bfe479df60d8ce97107827a990f86bcc003bcc4894ae273

SHA512
0ef5ba637f8121db45a129c326a7d400f97aea5435d42bacecab3538d4db622bc15f5c2ea26458cdf2b4dc6c716efdb6f436c08b55d296b41a448314c894526f

Download Submit

Analysis

Sharing