1fed3f4d333c580158610bed05a1921acf5e573daed5b6dcc690699dd8811d70

Analysis

max time kernel
143s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
19/07/2023, 13:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e6a0d119d7e76cexe_JC.exe
Size

329KB
MD5

e6a0d119d7e76c2d0774d6e36e168462
SHA1

5e31af49a219b5d3c5c6864035115fdb44833d0f
SHA256

1fed3f4d333c580158610bed05a1921acf5e573daed5b6dcc690699dd8811d70
SHA512

9c803d4ee33233246fb383225a66c9ee8922ab52b9eacf14690a9e77eb448df7622645b79d2b41c1484bfe6fcfc637625ef9ad6a7176b529fcc5cfde9d86fa40
SSDEEP

6144:P2+JS2sFafI8U0obHCW/2a7XQcsPMjVWrG89gkPzDh1v:P2TFafJiHCWBWPMjVWrXf1v

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\Control Panel\International\Geo\Nation	e6a0d119d7e76cexe_JC.exe

Executes dropped EXE 2 IoCs

pid	Process
4988	taskhostsys.exe
2680	taskhostsys.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 30 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\jitc\shell\open\command	e6a0d119d7e76cexe_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\jitc\shell	e6a0d119d7e76cexe_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\.exe\DefaultIcon\ = "%1"	e6a0d119d7e76cexe_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\Local Settings	e6a0d119d7e76cexe_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\jitc\shell\open\command\IsolatedCommand = "\"%1\" %*"	e6a0d119d7e76cexe_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\.exe\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\SysWOW_x86_64\\taskhostsys.exe\" /START \"%1\" %*"	e6a0d119d7e76cexe_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\.exe\shell\open\command\IsolatedCommand = "\"%1\" %*"	e6a0d119d7e76cexe_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\jitc\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\SysWOW_x86_64\\taskhostsys.exe\" /START \"%1\" %*"	e6a0d119d7e76cexe_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\.exe\shell\open\command	e6a0d119d7e76cexe_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\jitc\shell\runas\command\IsolatedCommand = "\"%1\" %*"	e6a0d119d7e76cexe_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\.exe	e6a0d119d7e76cexe_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\.exe\Content-Type = "application/x-msdownload"	e6a0d119d7e76cexe_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\.exe\DefaultIcon	e6a0d119d7e76cexe_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\.exe\shell\runas\command\ = "\"%1\" %*"	e6a0d119d7e76cexe_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\jitc	e6a0d119d7e76cexe_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\jitc\ = "Application"	e6a0d119d7e76cexe_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\jitc\Content-Type = "application/x-msdownload"	e6a0d119d7e76cexe_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\jitc\shell\runas	e6a0d119d7e76cexe_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\.exe\shell\runas\command\IsolatedCommand = "\"%1\" %*"	e6a0d119d7e76cexe_JC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	e6a0d119d7e76cexe_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\jitc\DefaultIcon	e6a0d119d7e76cexe_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\jitc\DefaultIcon\ = "%1"	e6a0d119d7e76cexe_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\jitc\shell\open	e6a0d119d7e76cexe_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\jitc\shell\runas\command	e6a0d119d7e76cexe_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\.exe\shell	e6a0d119d7e76cexe_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\.exe\shell\runas	e6a0d119d7e76cexe_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\jitc\shell\runas\command\ = "\"%1\" %*"	e6a0d119d7e76cexe_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\.exe\ = "jitc"	e6a0d119d7e76cexe_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\.exe\shell\open	e6a0d119d7e76cexe_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\.exe\shell\runas\command	e6a0d119d7e76cexe_JC.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4988	taskhostsys.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4396 wrote to memory of 4988	4396	e6a0d119d7e76cexe_JC.exe	86
PID 4396 wrote to memory of 4988	4396	e6a0d119d7e76cexe_JC.exe	86
PID 4396 wrote to memory of 4988	4396	e6a0d119d7e76cexe_JC.exe	86
PID 4988 wrote to memory of 2680	4988	taskhostsys.exe	87
PID 4988 wrote to memory of 2680	4988	taskhostsys.exe	87
PID 4988 wrote to memory of 2680	4988	taskhostsys.exe	87

C:\Users\Admin\AppData\Local\Temp\e6a0d119d7e76cexe_JC.exe
"C:\Users\Admin\AppData\Local\Temp\e6a0d119d7e76cexe_JC.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4396
- C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_x86_64\taskhostsys.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_x86_64\taskhostsys.exe" /START "C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_x86_64\taskhostsys.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4988
- - C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_x86_64\taskhostsys.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_x86_64\taskhostsys.exe"
    3⤵
    - Executes dropped EXE
    PID:2680

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_x86_64\taskhostsys.exe

Filesize
329KB

MD5
55ce1e5df6092a53a278cd2e430e2150

SHA1
d3080e1b96b3ca6efa16915ba8e0a33355e445d2

SHA256
01aeb8bd2d97783a4bfe479df60d8ce97107827a990f86bcc003bcc4894ae273

SHA512
0ef5ba637f8121db45a129c326a7d400f97aea5435d42bacecab3538d4db622bc15f5c2ea26458cdf2b4dc6c716efdb6f436c08b55d296b41a448314c894526f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_x86_64\taskhostsys.exe

Filesize
329KB

MD5
55ce1e5df6092a53a278cd2e430e2150

SHA1
d3080e1b96b3ca6efa16915ba8e0a33355e445d2

SHA256
01aeb8bd2d97783a4bfe479df60d8ce97107827a990f86bcc003bcc4894ae273

SHA512
0ef5ba637f8121db45a129c326a7d400f97aea5435d42bacecab3538d4db622bc15f5c2ea26458cdf2b4dc6c716efdb6f436c08b55d296b41a448314c894526f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_x86_64\taskhostsys.exe

Filesize
329KB

MD5
55ce1e5df6092a53a278cd2e430e2150

SHA1
d3080e1b96b3ca6efa16915ba8e0a33355e445d2

SHA256
01aeb8bd2d97783a4bfe479df60d8ce97107827a990f86bcc003bcc4894ae273

SHA512
0ef5ba637f8121db45a129c326a7d400f97aea5435d42bacecab3538d4db622bc15f5c2ea26458cdf2b4dc6c716efdb6f436c08b55d296b41a448314c894526f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_x86_64\taskhostsys.exe

Filesize
329KB

MD5
55ce1e5df6092a53a278cd2e430e2150

SHA1
d3080e1b96b3ca6efa16915ba8e0a33355e445d2

SHA256
01aeb8bd2d97783a4bfe479df60d8ce97107827a990f86bcc003bcc4894ae273

SHA512
0ef5ba637f8121db45a129c326a7d400f97aea5435d42bacecab3538d4db622bc15f5c2ea26458cdf2b4dc6c716efdb6f436c08b55d296b41a448314c894526f

Download Submit