d3a84b1b8e86d01b50c96cf99d52b23d730aa6d92edf3aa6df51e514006fd0e9

General

Target

90657d2a56361a635b0b1567a1aca060N.exe
Size

236KB
MD5

90657d2a56361a635b0b1567a1aca060
SHA1

6a860c0ffedf0b8592b2cffebeefdd72c03178e5
SHA256

d3a84b1b8e86d01b50c96cf99d52b23d730aa6d92edf3aa6df51e514006fd0e9
SHA512

d603bb89cf15657b3b2c3a3d6060a541f37662f29273a45f712f5d6017e7de086c74475ccbd7d107f8765489a345f0c37243ea0c6c6f44834a06e680a5772a8f
SSDEEP

6144:dgHX5BGeyzxxWf26TUQ9NwWlIaL/j4CWzDS:dgHX58NxWPX9NwWqaDjZ

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2636	lsassys.exe
1628	lsassys.exe

Loads dropped DLL 4 IoCs

pid	Process
2596	90657d2a56361a635b0b1567a1aca060N.exe
2596	90657d2a56361a635b0b1567a1aca060N.exe
2596	90657d2a56361a635b0b1567a1aca060N.exe
2636	lsassys.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	90657d2a56361a635b0b1567a1aca060N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsassys.exe

Modifies registry class 28 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\halnt\shell\open\command	90657d2a56361a635b0b1567a1aca060N.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\.exe\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\XMMC\\lsassys.exe\" /START \"%1\" %*"	90657d2a56361a635b0b1567a1aca060N.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\halnt	90657d2a56361a635b0b1567a1aca060N.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\halnt\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\XMMC\\lsassys.exe\" /START \"%1\" %*"	90657d2a56361a635b0b1567a1aca060N.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\halnt\shell\runas	90657d2a56361a635b0b1567a1aca060N.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\halnt\shell\runas\command\IsolatedCommand = "\"%1\" %*"	90657d2a56361a635b0b1567a1aca060N.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\.exe\shell\runas\command	90657d2a56361a635b0b1567a1aca060N.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\halnt\shell\open\command\IsolatedCommand = "\"%1\" %*"	90657d2a56361a635b0b1567a1aca060N.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\.exe\shell\open\command\IsolatedCommand = "\"%1\" %*"	90657d2a56361a635b0b1567a1aca060N.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\halnt\ = "Application"	90657d2a56361a635b0b1567a1aca060N.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\.exe	90657d2a56361a635b0b1567a1aca060N.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\.exe\Content-Type = "application/x-msdownload"	90657d2a56361a635b0b1567a1aca060N.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\.exe\DefaultIcon	90657d2a56361a635b0b1567a1aca060N.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\.exe\shell	90657d2a56361a635b0b1567a1aca060N.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\.exe\shell\runas	90657d2a56361a635b0b1567a1aca060N.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\halnt\shell\runas\command\ = "\"%1\" %*"	90657d2a56361a635b0b1567a1aca060N.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\halnt\Content-Type = "application/x-msdownload"	90657d2a56361a635b0b1567a1aca060N.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\halnt\DefaultIcon	90657d2a56361a635b0b1567a1aca060N.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\halnt\DefaultIcon\ = "%1"	90657d2a56361a635b0b1567a1aca060N.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\halnt\shell	90657d2a56361a635b0b1567a1aca060N.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\.exe\ = "halnt"	90657d2a56361a635b0b1567a1aca060N.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\.exe\shell\open\command	90657d2a56361a635b0b1567a1aca060N.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\.exe\shell\open	90657d2a56361a635b0b1567a1aca060N.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\.exe\shell\runas\command\IsolatedCommand = "\"%1\" %*"	90657d2a56361a635b0b1567a1aca060N.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\halnt\shell\open	90657d2a56361a635b0b1567a1aca060N.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\halnt\shell\runas\command	90657d2a56361a635b0b1567a1aca060N.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\.exe\DefaultIcon\ = "%1"	90657d2a56361a635b0b1567a1aca060N.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\.exe\shell\runas\command\ = "\"%1\" %*"	90657d2a56361a635b0b1567a1aca060N.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2636	lsassys.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2596 wrote to memory of 2636	2596	90657d2a56361a635b0b1567a1aca060N.exe	30
PID 2596 wrote to memory of 2636	2596	90657d2a56361a635b0b1567a1aca060N.exe	30
PID 2596 wrote to memory of 2636	2596	90657d2a56361a635b0b1567a1aca060N.exe	30
PID 2596 wrote to memory of 2636	2596	90657d2a56361a635b0b1567a1aca060N.exe	30
PID 2636 wrote to memory of 1628	2636	lsassys.exe	31
PID 2636 wrote to memory of 1628	2636	lsassys.exe	31
PID 2636 wrote to memory of 1628	2636	lsassys.exe	31
PID 2636 wrote to memory of 1628	2636	lsassys.exe	31

C:\Users\Admin\AppData\Local\Temp\90657d2a56361a635b0b1567a1aca060N.exe
"C:\Users\Admin\AppData\Local\Temp\90657d2a56361a635b0b1567a1aca060N.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2596
- C:\Users\Admin\AppData\Roaming\Microsoft\XMMC\lsassys.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\XMMC\lsassys.exe" /START "C:\Users\Admin\AppData\Roaming\Microsoft\XMMC\lsassys.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2636
- - C:\Users\Admin\AppData\Roaming\Microsoft\XMMC\lsassys.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\XMMC\lsassys.exe"
    3⤵
    - Executes dropped EXE
    PID:1628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\Microsoft\XMMC\lsassys.exe

Filesize
236KB

MD5
b5b433a18aad96f046db29a9ac5866c5

SHA1
539a1838c6cc93f8f2ae51867e65b1a6b8b353f1

SHA256
4c3a893432ddc503765881e9941d7541b12912563156985a5864b0d525021664

SHA512
6e085ff5da79c1f45f82e62c88382a1f3f4cbb3430e83fcf8198353fbee6320638bd27475e1dba5c21942fddc3c54042ced05e1cc8ea055f7e6c0e433be67304

Download Submit

Analysis

Sharing