Analysis
-
max time kernel
90s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
17-10-2022 15:58
Static task
static1
Behavioral task
behavioral1
Sample
jetsoff7785645.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
jetsoff7785645.exe
Resource
win10v2004-20220812-en
General
-
Target
jetsoff7785645.exe
-
Size
1.3MB
-
MD5
e490f6c7cd9da30e00552d99d40a67d5
-
SHA1
303aa4cecd54421ada7ae26d4e226cdd7272bff7
-
SHA256
03df164dae575c2017f7e03af8a2fab8635366e6eca3db93501233ed641d022e
-
SHA512
7094940fa63a295b42d880d1d2badf4f9afad0d95db37f77432124f6d2571f224093603a65e4c81d02ce7cbdf4550b33ab262853e4d259e9d4ec0e26896e341e
-
SSDEEP
24576:iAOcZXp0NBVQVxjvhGYux6V7xRF2UkjPV99npuezy71oporahu:ohHQVVvhJI43YUkj9fZe6GH
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
lporbpo.pifpid process 2296 lporbpo.pif -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
jetsoff7785645.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation jetsoff7785645.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
lporbpo.pifdescription pid process target process PID 2296 set thread context of 3632 2296 lporbpo.pif RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4028 3632 WerFault.exe RegSvcs.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
jetsoff7785645.exelporbpo.pifdescription pid process target process PID 2256 wrote to memory of 2296 2256 jetsoff7785645.exe lporbpo.pif PID 2256 wrote to memory of 2296 2256 jetsoff7785645.exe lporbpo.pif PID 2256 wrote to memory of 2296 2256 jetsoff7785645.exe lporbpo.pif PID 2296 wrote to memory of 4264 2296 lporbpo.pif RegSvcs.exe PID 2296 wrote to memory of 4264 2296 lporbpo.pif RegSvcs.exe PID 2296 wrote to memory of 4264 2296 lporbpo.pif RegSvcs.exe PID 2296 wrote to memory of 3632 2296 lporbpo.pif RegSvcs.exe PID 2296 wrote to memory of 3632 2296 lporbpo.pif RegSvcs.exe PID 2296 wrote to memory of 3632 2296 lporbpo.pif RegSvcs.exe PID 2296 wrote to memory of 3632 2296 lporbpo.pif RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\jetsoff7785645.exe"C:\Users\Admin\AppData\Local\Temp\jetsoff7785645.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\6_64\lporbpo.pif"C:\Users\Admin\AppData\Local\Temp\6_64\lporbpo.pif" fwouagex.osh2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3632 -s 804⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3632 -ip 36321⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\6_64\bdoiapgxat.jbvFilesize
370KB
MD5face4060089272f6ae3596e0fd074dfb
SHA17297224ceb6ca4e91eb34c916adc27d78f9fcca4
SHA256d2aba9392dd810d9146f5ddce3c061d59424baf4513aa735c6495564de0fc242
SHA512a4b12e86d964b69c26100382563f936b959b028023629146f5119b6560e34cd4bfdfc1247136466fb348d34c057b7bbc7839d402efac311e8125f3e733537702
-
C:\Users\Admin\AppData\Local\Temp\6_64\fwouagex.oshFilesize
185.3MB
MD5d8f85f88960bad8c833918af514305d5
SHA162cb58d3d7c26e98be9a2d94706ff4e35158948d
SHA256c5fe9515dc7eb87ddb5ec6382ca9ac12f393dff0040bd20e92c060ff07413fe7
SHA5129ddd3cc4f634f8b1c3fb2ffd8671763809106c66a8fbdb96f6b12204970261f8de096ae55aecf44f3888422659c1c01c1c1bcdeb4120fc6c189bafebe2b0f59d
-
C:\Users\Admin\AppData\Local\Temp\6_64\lporbpo.pifFilesize
1.7MB
MD5dd3466f64841cf21fc31f63f03dbfd29
SHA13878c8e52203d792c6f672595f7c78ab27ce3f04
SHA2564fe3004208ed574521992dd1ba3d900b75a0f02f1d63ba1e531d309e85ffa06b
SHA512adf3fe8378f7da5ba278db9a1df4cc7b5cff12398ec39ee7037382ebf57897de8bec72be64b5e7332bdb7ed865788dcb6ef4ceda6654e1153d39fe84b011b057
-
C:\Users\Admin\AppData\Local\Temp\6_64\lporbpo.pifFilesize
1.7MB
MD5dd3466f64841cf21fc31f63f03dbfd29
SHA13878c8e52203d792c6f672595f7c78ab27ce3f04
SHA2564fe3004208ed574521992dd1ba3d900b75a0f02f1d63ba1e531d309e85ffa06b
SHA512adf3fe8378f7da5ba278db9a1df4cc7b5cff12398ec39ee7037382ebf57897de8bec72be64b5e7332bdb7ed865788dcb6ef4ceda6654e1153d39fe84b011b057
-
C:\Users\Admin\AppData\Local\Temp\6_64\uuvrscqbfj.xmlFilesize
38KB
MD5e8eeee13ee27e7f90d2b123b85b76e5f
SHA11257f205999b5f5477b43f70cc907c8e629056bf
SHA2566524c5bbb9e2cda587aa3bec11f937b2f1aaa1005c6836d0c858f0e9fbcd55a6
SHA5123e6bf380902e63675de0c20fcbc47cffc508f69caf5dac1390b83b6444d3cbafb5c6af3cd878ad4a6c7e19adbbce66a12cf1b00c6ab496e9cdfd960a6b18e26b
-
memory/2296-132-0x0000000000000000-mapping.dmp
-
memory/3632-138-0x0000000000000000-mapping.dmp