Analysis
-
max time kernel
142s -
max time network
124s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
14-12-2020 12:50
Static task
static1
Behavioral task
behavioral1
Sample
aff9ab5bd7309235fdfc643d535f89da.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
aff9ab5bd7309235fdfc643d535f89da.exe
Resource
win10v20201028
General
-
Target
aff9ab5bd7309235fdfc643d535f89da.exe
-
Size
15.0MB
-
MD5
aff9ab5bd7309235fdfc643d535f89da
-
SHA1
7cbf21edc211abbf977f2ed01e317166e00c84ab
-
SHA256
83f46bbf5414ef3e3eba95cbabf5b48802e01a426e14d4ebe51e6a6b6c67a574
-
SHA512
0839288097ed86580fae041b59ac51aceac24e22ba5aef9bd50865de2dc2d897608dde150c4a6cc240bb9cab16a49b1c36d84bde9d07b761b3251878d7ca4cd2
Malware Config
Signatures
-
Creates new service(s) 1 TTPs
-
Executes dropped EXE 1 IoCs
Processes:
jiwymjkc.exepid process 1092 jiwymjkc.exe -
Modifies Windows Firewall 1 TTPs
-
Sets service image path in registry 2 TTPs
-
Deletes itself 1 IoCs
Processes:
svchost.exepid process 1588 svchost.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
jiwymjkc.exedescription pid process target process PID 1092 set thread context of 1588 1092 jiwymjkc.exe svchost.exe -
Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
-
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
aff9ab5bd7309235fdfc643d535f89da.exejiwymjkc.exedescription pid process target process PID 1036 wrote to memory of 1768 1036 aff9ab5bd7309235fdfc643d535f89da.exe cmd.exe PID 1036 wrote to memory of 1768 1036 aff9ab5bd7309235fdfc643d535f89da.exe cmd.exe PID 1036 wrote to memory of 1768 1036 aff9ab5bd7309235fdfc643d535f89da.exe cmd.exe PID 1036 wrote to memory of 1768 1036 aff9ab5bd7309235fdfc643d535f89da.exe cmd.exe PID 1036 wrote to memory of 1668 1036 aff9ab5bd7309235fdfc643d535f89da.exe cmd.exe PID 1036 wrote to memory of 1668 1036 aff9ab5bd7309235fdfc643d535f89da.exe cmd.exe PID 1036 wrote to memory of 1668 1036 aff9ab5bd7309235fdfc643d535f89da.exe cmd.exe PID 1036 wrote to memory of 1668 1036 aff9ab5bd7309235fdfc643d535f89da.exe cmd.exe PID 1036 wrote to memory of 1516 1036 aff9ab5bd7309235fdfc643d535f89da.exe sc.exe PID 1036 wrote to memory of 1516 1036 aff9ab5bd7309235fdfc643d535f89da.exe sc.exe PID 1036 wrote to memory of 1516 1036 aff9ab5bd7309235fdfc643d535f89da.exe sc.exe PID 1036 wrote to memory of 1516 1036 aff9ab5bd7309235fdfc643d535f89da.exe sc.exe PID 1036 wrote to memory of 748 1036 aff9ab5bd7309235fdfc643d535f89da.exe sc.exe PID 1036 wrote to memory of 748 1036 aff9ab5bd7309235fdfc643d535f89da.exe sc.exe PID 1036 wrote to memory of 748 1036 aff9ab5bd7309235fdfc643d535f89da.exe sc.exe PID 1036 wrote to memory of 748 1036 aff9ab5bd7309235fdfc643d535f89da.exe sc.exe PID 1036 wrote to memory of 864 1036 aff9ab5bd7309235fdfc643d535f89da.exe sc.exe PID 1036 wrote to memory of 864 1036 aff9ab5bd7309235fdfc643d535f89da.exe sc.exe PID 1036 wrote to memory of 864 1036 aff9ab5bd7309235fdfc643d535f89da.exe sc.exe PID 1036 wrote to memory of 864 1036 aff9ab5bd7309235fdfc643d535f89da.exe sc.exe PID 1036 wrote to memory of 932 1036 aff9ab5bd7309235fdfc643d535f89da.exe netsh.exe PID 1036 wrote to memory of 932 1036 aff9ab5bd7309235fdfc643d535f89da.exe netsh.exe PID 1036 wrote to memory of 932 1036 aff9ab5bd7309235fdfc643d535f89da.exe netsh.exe PID 1036 wrote to memory of 932 1036 aff9ab5bd7309235fdfc643d535f89da.exe netsh.exe PID 1092 wrote to memory of 1588 1092 jiwymjkc.exe svchost.exe PID 1092 wrote to memory of 1588 1092 jiwymjkc.exe svchost.exe PID 1092 wrote to memory of 1588 1092 jiwymjkc.exe svchost.exe PID 1092 wrote to memory of 1588 1092 jiwymjkc.exe svchost.exe PID 1092 wrote to memory of 1588 1092 jiwymjkc.exe svchost.exe PID 1092 wrote to memory of 1588 1092 jiwymjkc.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\aff9ab5bd7309235fdfc643d535f89da.exe"C:\Users\Admin\AppData\Local\Temp\aff9ab5bd7309235fdfc643d535f89da.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\jnjmaugx\2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\jiwymjkc.exe" C:\Windows\SysWOW64\jnjmaugx\2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create jnjmaugx binPath= "C:\Windows\SysWOW64\jnjmaugx\jiwymjkc.exe /d\"C:\Users\Admin\AppData\Local\Temp\aff9ab5bd7309235fdfc643d535f89da.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description jnjmaugx "wifi internet conection"2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start jnjmaugx2⤵
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
-
C:\Windows\SysWOW64\jnjmaugx\jiwymjkc.exeC:\Windows\SysWOW64\jnjmaugx\jiwymjkc.exe /d"C:\Users\Admin\AppData\Local\Temp\aff9ab5bd7309235fdfc643d535f89da.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\jiwymjkc.exeMD5
51788a91f00c75ab2005ea4ae8861fee
SHA108d78c98b544ed972b870c589c2e1b03f13ed3cd
SHA2565e5b8d6729d3e0d8227f5543f389431740b0dfb9265527952b870a9aece71b1f
SHA512ab3679d8a3071f2438289f705b6b2d9a75bbb216ea28f1208e88ea075537e755c40414f925ce3b355b041698f77d6725126d3548ef4dfec3a860572e20b02135
-
C:\Windows\SysWOW64\jnjmaugx\jiwymjkc.exeMD5
51788a91f00c75ab2005ea4ae8861fee
SHA108d78c98b544ed972b870c589c2e1b03f13ed3cd
SHA2565e5b8d6729d3e0d8227f5543f389431740b0dfb9265527952b870a9aece71b1f
SHA512ab3679d8a3071f2438289f705b6b2d9a75bbb216ea28f1208e88ea075537e755c40414f925ce3b355b041698f77d6725126d3548ef4dfec3a860572e20b02135
-
memory/748-8-0x0000000000000000-mapping.dmp
-
memory/864-9-0x0000000000000000-mapping.dmp
-
memory/932-11-0x0000000000000000-mapping.dmp
-
memory/1036-3-0x0000000003C80000-0x0000000003C91000-memory.dmpFilesize
68KB
-
memory/1036-2-0x000000000245D000-0x000000000245E000-memory.dmpFilesize
4KB
-
memory/1092-12-0x00000000023DF000-0x00000000023E0000-memory.dmpFilesize
4KB
-
memory/1092-13-0x00000000029E0000-0x00000000029F1000-memory.dmpFilesize
68KB
-
memory/1516-7-0x0000000000000000-mapping.dmp
-
memory/1588-14-0x00000000000D0000-0x00000000000E5000-memory.dmpFilesize
84KB
-
memory/1588-15-0x00000000000D9A6B-mapping.dmp
-
memory/1668-5-0x0000000000000000-mapping.dmp
-
memory/1768-4-0x0000000000000000-mapping.dmp