Analysis
- max time kernel
149s - max time network
120s - platform
windows7_x64 - resource
win7 - submitted
10/07/2020, 08:58
Static task
static1
Behavioral task
behavioral1
Sample
jBLDo.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
jBLDo.exe
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
- Target jBLDo.exe
- Size 452KB
- Sample200710-31pmq9bedj
- SHA256 8afd97ec2b6815e45a6016caf6b63456c5f9c18288a146d01d3829f40fa57e44
- MD5 7e00a1a895ef9cc2f36a125fe65d06fc
- SHA1 83b6e97d378c41cc3b0024d613c61ffbe76f6343
- SHA512 fe353c4f9406de60328af75836a6d32212b6d6a417f7db803d7dbe7d3de0c52dda2829a979c4f086b8ada952ac3acfee1595a40bf7c332853d580b6b34c247ab
- MD5 SHA1 SHA512
Malware Config
Signatures
- Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 608 set thread context of 1000 608 jBLDo.exe 24 PID 1000 set thread context of 1208 1000 jBLDo.exe 20 PID 296 set thread context of 1208 296 wininit.exe 20 - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 1000 jBLDo.exe 1000 jBLDo.exe 296 wininit.exe 296 wininit.exe 296 wininit.exe 296 wininit.exe 296 wininit.exe 296 wininit.exe 296 wininit.exe 296 wininit.exe 296 wininit.exe 296 wininit.exe 296 wininit.exe 296 wininit.exe 296 wininit.exe 296 wininit.exe 296 wininit.exe 296 wininit.exe 296 wininit.exe 296 wininit.exe 296 wininit.exe 296 wininit.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1000 jBLDo.exe Token: SeDebugPrivilege 296 wininit.exe Token: SeShutdownPrivilege 1208 Explorer.EXE - Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 1000 jBLDo.exe 1000 jBLDo.exe 1000 jBLDo.exe 296 wininit.exe 296 wininit.exe - Suspicious use of SendNotifyMessage 4 IoCs
pid Process 1208 Explorer.EXE 1208 Explorer.EXE 1208 Explorer.EXE 1208 Explorer.EXE -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Explorer.EXE - Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 608 wrote to memory of 1000 608 jBLDo.exe 24 PID 608 wrote to memory of 1000 608 jBLDo.exe 24 PID 608 wrote to memory of 1000 608 jBLDo.exe 24 PID 608 wrote to memory of 1000 608 jBLDo.exe 24 PID 608 wrote to memory of 1000 608 jBLDo.exe 24 PID 608 wrote to memory of 1000 608 jBLDo.exe 24 PID 608 wrote to memory of 1000 608 jBLDo.exe 24 PID 1208 wrote to memory of 296 1208 Explorer.EXE 25 PID 1208 wrote to memory of 296 1208 Explorer.EXE 25 PID 1208 wrote to memory of 296 1208 Explorer.EXE 25 PID 1208 wrote to memory of 296 1208 Explorer.EXE 25 PID 296 wrote to memory of 1160 296 wininit.exe 26 PID 296 wrote to memory of 1160 296 wininit.exe 26 PID 296 wrote to memory of 1160 296 wininit.exe 26 PID 296 wrote to memory of 1160 296 wininit.exe 26 - Deletes itself 1 IoCs
pid Process 1160 cmd.exe - Suspicious use of FindShellTrayWindow 5 IoCs
pid Process 1208 Explorer.EXE 1208 Explorer.EXE 1208 Explorer.EXE 1208 Explorer.EXE 1208 Explorer.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
- Suspicious use of FindShellTrayWindow
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\jBLDo.exe"C:\Users\Admin\AppData\Local\Temp\jBLDo.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:608 -
C:\Users\Admin\AppData\Local\Temp\jBLDo.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: MapViewOfSection
PID:1000
-
-
-
C:\Windows\SysWOW64\wininit.exe"C:\Windows\SysWOW64\wininit.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:296 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\jBLDo.exe"3⤵
- Deletes itself
PID:1160
-
-