General

  • Target

    jojojo.exe

  • Size

    34KB

  • Sample

    210120-kb1wrf1kmn

  • MD5

    5bb718a52c52383cea5361519559b683

  • SHA1

    54298a1c380568d1d76b103fa267ded82d6a778a

  • SHA256

    43ae34f089374f6293998924525d9e8516c59bf2cd8150a7c01d6c565c85aa10

  • SHA512

    36ad2bbb7315f4290844cb433c081265815b69553c2fd025615e989bbf3214f16d0686e100f701db7c827d9c43f0d21f41da9b3d5648ec423b14b35ecc7d9781

Malware Config

Targets

    • Target

      jojojo.exe

    • Size

      34KB

    • MD5

      5bb718a52c52383cea5361519559b683

    • SHA1

      54298a1c380568d1d76b103fa267ded82d6a778a

    • SHA256

      43ae34f089374f6293998924525d9e8516c59bf2cd8150a7c01d6c565c85aa10

    • SHA512

      36ad2bbb7315f4290844cb433c081265815b69553c2fd025615e989bbf3214f16d0686e100f701db7c827d9c43f0d21f41da9b3d5648ec423b14b35ecc7d9781

    • Modifies WinLogon for persistence

    • Modifies Windows Defender Real-time Protection settings

    • Turns off Windows Defender SpyNet reporting

    • Windows security bypass

    • Looks for VirtualBox Guest Additions in registry

    • Looks for VMWare Tools registry key

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Drops startup file

    • Windows security modification

    • Adds Run key to start application

    • Legitimate hosting services abused for malware hosting/C2

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Enumerates physical storage devices

      Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Winlogon Helper DLL

1
T1004

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

6
T1112

Disabling Security Tools

4
T1089

Virtualization/Sandbox Evasion

2
T1497

Discovery

Query Registry

4
T1012

Virtualization/Sandbox Evasion

2
T1497

System Information Discovery

3
T1082

Peripheral Device Discovery

1
T1120

Command and Control

Web Service

1
T1102

Tasks