Analysis
-
max time kernel
149s -
max time network
120s -
platform
windows7_x64 -
resource
win7 -
submitted
10-07-2020 08:58
Static task
static1
Behavioral task
behavioral1
Sample
jBLDo.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
jBLDo.exe
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
-
Target
jBLDo.exe
-
Size
452KB
-
MD5
7e00a1a895ef9cc2f36a125fe65d06fc
-
SHA1
83b6e97d378c41cc3b0024d613c61ffbe76f6343
-
SHA256
8afd97ec2b6815e45a6016caf6b63456c5f9c18288a146d01d3829f40fa57e44
-
SHA512
fe353c4f9406de60328af75836a6d32212b6d6a417f7db803d7dbe7d3de0c52dda2829a979c4f086b8ada952ac3acfee1595a40bf7c332853d580b6b34c247ab
Malware Config
Signatures
-
Suspicious use of SetThreadContext 3 IoCs
Processes:
jBLDo.exejBLDo.exewininit.exedescription pid process target process PID 608 set thread context of 1000 608 jBLDo.exe jBLDo.exe PID 1000 set thread context of 1208 1000 jBLDo.exe Explorer.EXE PID 296 set thread context of 1208 296 wininit.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 22 IoCs
Processes:
jBLDo.exewininit.exepid process 1000 jBLDo.exe 1000 jBLDo.exe 296 wininit.exe 296 wininit.exe 296 wininit.exe 296 wininit.exe 296 wininit.exe 296 wininit.exe 296 wininit.exe 296 wininit.exe 296 wininit.exe 296 wininit.exe 296 wininit.exe 296 wininit.exe 296 wininit.exe 296 wininit.exe 296 wininit.exe 296 wininit.exe 296 wininit.exe 296 wininit.exe 296 wininit.exe 296 wininit.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
jBLDo.exewininit.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 1000 jBLDo.exe Token: SeDebugPrivilege 296 wininit.exe Token: SeShutdownPrivilege 1208 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
jBLDo.exewininit.exepid process 1000 jBLDo.exe 1000 jBLDo.exe 1000 jBLDo.exe 296 wininit.exe 296 wininit.exe -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1208 Explorer.EXE 1208 Explorer.EXE 1208 Explorer.EXE 1208 Explorer.EXE -
Processes:
Explorer.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
jBLDo.exeExplorer.EXEwininit.exedescription pid process target process PID 608 wrote to memory of 1000 608 jBLDo.exe jBLDo.exe PID 608 wrote to memory of 1000 608 jBLDo.exe jBLDo.exe PID 608 wrote to memory of 1000 608 jBLDo.exe jBLDo.exe PID 608 wrote to memory of 1000 608 jBLDo.exe jBLDo.exe PID 608 wrote to memory of 1000 608 jBLDo.exe jBLDo.exe PID 608 wrote to memory of 1000 608 jBLDo.exe jBLDo.exe PID 608 wrote to memory of 1000 608 jBLDo.exe jBLDo.exe PID 1208 wrote to memory of 296 1208 Explorer.EXE wininit.exe PID 1208 wrote to memory of 296 1208 Explorer.EXE wininit.exe PID 1208 wrote to memory of 296 1208 Explorer.EXE wininit.exe PID 1208 wrote to memory of 296 1208 Explorer.EXE wininit.exe PID 296 wrote to memory of 1160 296 wininit.exe cmd.exe PID 296 wrote to memory of 1160 296 wininit.exe cmd.exe PID 296 wrote to memory of 1160 296 wininit.exe cmd.exe PID 296 wrote to memory of 1160 296 wininit.exe cmd.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1160 cmd.exe -
Suspicious use of FindShellTrayWindow 5 IoCs
Processes:
Explorer.EXEpid process 1208 Explorer.EXE 1208 Explorer.EXE 1208 Explorer.EXE 1208 Explorer.EXE 1208 Explorer.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
- Suspicious use of FindShellTrayWindow
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\jBLDo.exe"C:\Users\Admin\AppData\Local\Temp\jBLDo.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:608 -
C:\Users\Admin\AppData\Local\Temp\jBLDo.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: MapViewOfSection
PID:1000 -
C:\Windows\SysWOW64\wininit.exe"C:\Windows\SysWOW64\wininit.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:296 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\jBLDo.exe"3⤵
- Deletes itself
PID:1160