43fcdb73275eb4922c51f78b6c0a55e36b4e460d0bfcb2a9d83a764d7f526f8c

Analysis

max time kernel
150s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
24-02-2024 15:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a23154ec6c70e15f8352c7b170e3a7b4.exe
Size

18KB
MD5

a23154ec6c70e15f8352c7b170e3a7b4
SHA1

1f270a5b3c689e76aadf912cb8d4122ca7435a1a
SHA256

43fcdb73275eb4922c51f78b6c0a55e36b4e460d0bfcb2a9d83a764d7f526f8c
SHA512

8e61cafef28fcf009c1f0da0d770494929c6d8a8161e02c092f9650a18674a04233a6eecd15b680305105649692749628e679e3f0e9261948dea4a36989c5c5b
SSDEEP

384:k+YUthRZYLbRTr2P0d9UI4FrJCO97GIKp+YeaTvQMJOmkRNw/:YUBS0PUUDFrJCO96IpYegvTt5/

Score

8^/10

persistence

Malware Config

Signatures

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\explorer\run	ishost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\ishost.exe = "ishost.exe"	ishost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3316742141-2240921845-2885234760-1000\Control Panel\International\Geo\Nation	a23154ec6c70e15f8352c7b170e3a7b4.exe

Executes dropped EXE 2 IoCs

pid	Process
3208	ishost.exe
3192	ismini.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\ishost.exe	a23154ec6c70e15f8352c7b170e3a7b4.exe
File opened for modification	C:\Windows\SysWOW64\ishost.exe	a23154ec6c70e15f8352c7b170e3a7b4.exe
File created	C:\Windows\SysWOW64\ismini.exe	ishost.exe
File created	C:\Windows\SysWOW64\components\flx0.dll	ishost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
616	a23154ec6c70e15f8352c7b170e3a7b4.exe
616	a23154ec6c70e15f8352c7b170e3a7b4.exe
3208	ishost.exe
3208	ishost.exe
3208	ishost.exe
3208	ishost.exe
3192	ismini.exe
3192	ismini.exe
3208	ishost.exe
3208	ishost.exe
3192	ismini.exe
3192	ismini.exe
3208	ishost.exe
3208	ishost.exe
3192	ismini.exe
3192	ismini.exe
3208	ishost.exe
3208	ishost.exe
3192	ismini.exe
3192	ismini.exe
3208	ishost.exe
3208	ishost.exe
3208	ishost.exe
3208	ishost.exe
3192	ismini.exe
3192	ismini.exe
3208	ishost.exe
3208	ishost.exe
3192	ismini.exe
3192	ismini.exe
3208	ishost.exe
3208	ishost.exe
3192	ismini.exe
3192	ismini.exe
3208	ishost.exe
3208	ishost.exe
3208	ishost.exe
3192	ismini.exe
3192	ismini.exe
3208	ishost.exe
3208	ishost.exe
3208	ishost.exe
3192	ismini.exe
3192	ismini.exe
3208	ishost.exe
3208	ishost.exe
3192	ismini.exe
3192	ismini.exe
3208	ishost.exe
3208	ishost.exe
3192	ismini.exe
3192	ismini.exe
3208	ishost.exe
3208	ishost.exe
3208	ishost.exe
3208	ishost.exe
3192	ismini.exe
3192	ismini.exe
3208	ishost.exe
3208	ishost.exe
3192	ismini.exe
3192	ismini.exe
3208	ishost.exe
3208	ishost.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	616	a23154ec6c70e15f8352c7b170e3a7b4.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 616 wrote to memory of 3208	616	a23154ec6c70e15f8352c7b170e3a7b4.exe	90
PID 616 wrote to memory of 3208	616	a23154ec6c70e15f8352c7b170e3a7b4.exe	90
PID 616 wrote to memory of 3208	616	a23154ec6c70e15f8352c7b170e3a7b4.exe	90
PID 3208 wrote to memory of 3192	3208	ishost.exe	91
PID 3208 wrote to memory of 3192	3208	ishost.exe	91
PID 3208 wrote to memory of 3192	3208	ishost.exe	91
PID 616 wrote to memory of 3588	616	a23154ec6c70e15f8352c7b170e3a7b4.exe	92
PID 616 wrote to memory of 3588	616	a23154ec6c70e15f8352c7b170e3a7b4.exe	92
PID 616 wrote to memory of 3588	616	a23154ec6c70e15f8352c7b170e3a7b4.exe	92

C:\Users\Admin\AppData\Local\Temp\a23154ec6c70e15f8352c7b170e3a7b4.exe
"C:\Users\Admin\AppData\Local\Temp\a23154ec6c70e15f8352c7b170e3a7b4.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:616
- C:\Windows\SysWOW64\ishost.exe
  C:\Windows\system32\ishost.exe
  2⤵
  - Adds policy Run key to start application
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3208
- - C:\Windows\SysWOW64\ismini.exe
    C:\Windows\system32\ismini.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:3192
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\A23154~1.EXE > nul
  2⤵
  PID:3588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\ishost.exe

Filesize
35KB

MD5
4ffb3e402a8b86a84b014a929d92a389

SHA1
79a5e113d2594228832fa669509fe370507b1d34

SHA256
728ba8e00efc37791f388b051518da8aafbaa17302c9eb68178765a1833b817f

SHA512
439764d2f8365ecea22adb107210be7b64a5cb526c13c923eb7f4d742f2631c8b490b1a18b7d22ad319945ab260aff757b1aff99c301872ebb4f863f817d40d8

Download Submit
C:\Windows\SysWOW64\ismini.exe

Filesize
5KB

MD5
f8a526f12d2f57d8cfc14faa20ddec12

SHA1
5f24123bf1d6f3925076d25675a064fc68bec790

SHA256
5d4f365147413d8f20e977c5dcbf1b76ab3eb4e10a4feac88e8bf373258dfa4b

SHA512
cf08754668f35397b39109e9e6b4efb46d8d6ec2e44bb9a2714ada4789d3991544cb7bec750b88126a8e3ac42761d64a6ef3de9678cc29e86e97067e11c47f8a

Download Submit