1aca4b27a6dd8d8a153e671b88c39af706be77a385db64c7a3836070e37ccefb

Analysis

max time kernel
143s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
23-07-2023 17:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NA_NA_1d15b474b21da2exeexe_JC.exe
Size

310KB
MD5

1d15b474b21da2353fe6d7ecb81e5e24
SHA1

0b6db2effca1c72d0e126d2c3b495a18c87c3831
SHA256

1aca4b27a6dd8d8a153e671b88c39af706be77a385db64c7a3836070e37ccefb
SHA512

26f4ff1cb0fc7931f2bec42a6106a3d3f0bbc3583ee33d1af0d0ecba34c7d63b7980292c663b2be0ed67856bc693f59cb293ac03cc08a0b14cdeef42085a2cbf
SSDEEP

6144:M2+JS2sFafI8U0obHCW/2a7XQcsPMjVWrG89gkPzDRe5v0k2+O:M2TFafJiHCWBWPMjVWrXfNk2Z

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\Control Panel\International\Geo\Nation	NA_NA_1d15b474b21da2exeexe_JC.exe

Executes dropped EXE 2 IoCs

pid	Process
2936	lsassys.exe
3488	lsassys.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 30 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\.exe\shell\runas\command\ = "\"%1\" %*"	NA_NA_1d15b474b21da2exeexe_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\halnt\DefaultIcon\ = "%1"	NA_NA_1d15b474b21da2exeexe_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\halnt\shell\runas	NA_NA_1d15b474b21da2exeexe_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\halnt\shell\runas\command\ = "\"%1\" %*"	NA_NA_1d15b474b21da2exeexe_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\halnt\shell\runas\command\IsolatedCommand = "\"%1\" %*"	NA_NA_1d15b474b21da2exeexe_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\.exe\shell\open\command	NA_NA_1d15b474b21da2exeexe_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\.exe\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Posix\\lsassys.exe\" /START \"%1\" %*"	NA_NA_1d15b474b21da2exeexe_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\.exe\shell\runas	NA_NA_1d15b474b21da2exeexe_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\.exe\DefaultIcon\ = "%1"	NA_NA_1d15b474b21da2exeexe_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\.exe\shell	NA_NA_1d15b474b21da2exeexe_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\halnt\ = "Application"	NA_NA_1d15b474b21da2exeexe_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\halnt\shell\open\command	NA_NA_1d15b474b21da2exeexe_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\halnt\shell\open\command\IsolatedCommand = "\"%1\" %*"	NA_NA_1d15b474b21da2exeexe_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\Local Settings	NA_NA_1d15b474b21da2exeexe_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\halnt	NA_NA_1d15b474b21da2exeexe_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\.exe	NA_NA_1d15b474b21da2exeexe_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\.exe\ = "halnt"	NA_NA_1d15b474b21da2exeexe_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\.exe\shell\open	NA_NA_1d15b474b21da2exeexe_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\.exe\shell\runas\command	NA_NA_1d15b474b21da2exeexe_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\.exe\shell\runas\command\IsolatedCommand = "\"%1\" %*"	NA_NA_1d15b474b21da2exeexe_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\halnt\shell	NA_NA_1d15b474b21da2exeexe_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\halnt\shell\open	NA_NA_1d15b474b21da2exeexe_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\.exe\Content-Type = "application/x-msdownload"	NA_NA_1d15b474b21da2exeexe_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\.exe\DefaultIcon	NA_NA_1d15b474b21da2exeexe_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\.exe\shell\open\command\IsolatedCommand = "\"%1\" %*"	NA_NA_1d15b474b21da2exeexe_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\halnt\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Posix\\lsassys.exe\" /START \"%1\" %*"	NA_NA_1d15b474b21da2exeexe_JC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	NA_NA_1d15b474b21da2exeexe_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\halnt\Content-Type = "application/x-msdownload"	NA_NA_1d15b474b21da2exeexe_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\halnt\DefaultIcon	NA_NA_1d15b474b21da2exeexe_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\halnt\shell\runas\command	NA_NA_1d15b474b21da2exeexe_JC.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2936	lsassys.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4108 wrote to memory of 2936	4108	NA_NA_1d15b474b21da2exeexe_JC.exe	86
PID 4108 wrote to memory of 2936	4108	NA_NA_1d15b474b21da2exeexe_JC.exe	86
PID 4108 wrote to memory of 2936	4108	NA_NA_1d15b474b21da2exeexe_JC.exe	86
PID 2936 wrote to memory of 3488	2936	lsassys.exe	87
PID 2936 wrote to memory of 3488	2936	lsassys.exe	87
PID 2936 wrote to memory of 3488	2936	lsassys.exe	87

C:\Users\Admin\AppData\Local\Temp\NA_NA_1d15b474b21da2exeexe_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NA_NA_1d15b474b21da2exeexe_JC.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4108
- C:\Users\Admin\AppData\Roaming\Microsoft\Posix\lsassys.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Posix\lsassys.exe" /START "C:\Users\Admin\AppData\Roaming\Microsoft\Posix\lsassys.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2936
- - C:\Users\Admin\AppData\Roaming\Microsoft\Posix\lsassys.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Posix\lsassys.exe"
    3⤵
    - Executes dropped EXE
    PID:3488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Posix\lsassys.exe

Filesize
310KB

MD5
ed9b53141d5bfbd95fdb679ce36dc8ef

SHA1
243106b9f1706225bd850292c5a7b3804aed33ed

SHA256
233559501021a6c433130eca671afb0630ade2c47f2979bb51452bc247cd730c

SHA512
e1724936ac59ee1461af1d16604c866a02be5c24a7e6294ab961472e09ddf0a29a0606ae92fe71c06fff9b6b405a65cbbac734d5a5752a5131185c44a8aa464e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Posix\lsassys.exe

Filesize
310KB

MD5
ed9b53141d5bfbd95fdb679ce36dc8ef

SHA1
243106b9f1706225bd850292c5a7b3804aed33ed

SHA256
233559501021a6c433130eca671afb0630ade2c47f2979bb51452bc247cd730c

SHA512
e1724936ac59ee1461af1d16604c866a02be5c24a7e6294ab961472e09ddf0a29a0606ae92fe71c06fff9b6b405a65cbbac734d5a5752a5131185c44a8aa464e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Posix\lsassys.exe

Filesize
310KB

MD5
ed9b53141d5bfbd95fdb679ce36dc8ef

SHA1
243106b9f1706225bd850292c5a7b3804aed33ed

SHA256
233559501021a6c433130eca671afb0630ade2c47f2979bb51452bc247cd730c

SHA512
e1724936ac59ee1461af1d16604c866a02be5c24a7e6294ab961472e09ddf0a29a0606ae92fe71c06fff9b6b405a65cbbac734d5a5752a5131185c44a8aa464e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Posix\lsassys.exe

Filesize
310KB

MD5
ed9b53141d5bfbd95fdb679ce36dc8ef

SHA1
243106b9f1706225bd850292c5a7b3804aed33ed

SHA256
233559501021a6c433130eca671afb0630ade2c47f2979bb51452bc247cd730c

SHA512
e1724936ac59ee1461af1d16604c866a02be5c24a7e6294ab961472e09ddf0a29a0606ae92fe71c06fff9b6b405a65cbbac734d5a5752a5131185c44a8aa464e

Download Submit