3a5d3a1e64612ee7d7dda35761f983a1d3b7bcd42afe32ee67e9438a4e96aceb

General

Target

3a5d3a1e64612ee7d7dda35761f983a1d3b7bcd42afe32ee67e9438a4e96aceb.exe
Size

322KB
MD5

91f4c8526869f34f38b8eed628b557a1
SHA1

5757818e4bbcce1a481c70f1370578f190b676cb
SHA256

3a5d3a1e64612ee7d7dda35761f983a1d3b7bcd42afe32ee67e9438a4e96aceb
SHA512

b141483fed0ba742a2778659a1f7f28d969014c4016524e4bb478964c73755de4ccbd8815eec725573ba6fc40164955c97a77e4ed6979532695fb6a6ad824e87
SSDEEP

6144:ukuP43GMaCXZgY9jYYp5fp1VNB0acuz0dqy1jQS:ukuP43GCXdjjpBVNBVfzBy1sS

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
1032	3a5d3a1e64612ee7d7dda35761f983a1d3b7bcd42afe32ee67e9438a4e96aceb.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run	3a5d3a1e64612ee7d7dda35761f983a1d3b7bcd42afe32ee67e9438a4e96aceb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\jxavmdt = "regsvr32.exe \"C:\\ProgramData\\jxavmdt.dat\""	3a5d3a1e64612ee7d7dda35761f983a1d3b7bcd42afe32ee67e9438a4e96aceb.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\jxavmdt = "regsvr32.exe \"C:\\ProgramData\\jxavmdt.dat\""	Explorer.EXE

Modifies Internet Explorer Protected Mode 1 TTPs 1 IoCs

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3"	Explorer.EXE

Modifies Internet Explorer Protected Mode Banner 1 TTPs 1 IoCs

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\NoProtectedModeBanner = "1"	Explorer.EXE

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\TabProcGrowth = "0"	Explorer.EXE

Modifies registry class 7 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\CLSID\{47963012-44C5-4CAA-91AC-40843E8F4829}\{75DD4C29-2E40-4F7A-B1FE-21CD0E7D0D7F} = 4b05918d	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Wow6432Node\CLSID\{22E50231-69C3-451A-959B-727D4EDF4608}	3a5d3a1e64612ee7d7dda35761f983a1d3b7bcd42afe32ee67e9438a4e96aceb.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Wow6432Node	3a5d3a1e64612ee7d7dda35761f983a1d3b7bcd42afe32ee67e9438a4e96aceb.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Wow6432Node\CLSID	3a5d3a1e64612ee7d7dda35761f983a1d3b7bcd42afe32ee67e9438a4e96aceb.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Wow6432Node\CLSID\{22E50231-69C3-451A-959B-727D4EDF4608}\#sd = 433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c54656d705c336135643361316536343631326565376437646461333537363166393833613164336237626364343261666533326565363765393433386134653936616365622e65786500	3a5d3a1e64612ee7d7dda35761f983a1d3b7bcd42afe32ee67e9438a4e96aceb.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\CLSID\{22E50231-69C3-451A-959B-727D4EDF4608}	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\CLSID\{47963012-44C5-4CAA-91AC-40843E8F4829}	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1032	3a5d3a1e64612ee7d7dda35761f983a1d3b7bcd42afe32ee67e9438a4e96aceb.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	1224	Explorer.EXE
Token: SeShutdownPrivilege	1224	Explorer.EXE
Token: SeDebugPrivilege	1224	Explorer.EXE
Token: SeShutdownPrivilege	1224	Explorer.EXE
Token: SeShutdownPrivilege	1224	Explorer.EXE

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1032 wrote to memory of 1224	1032	3a5d3a1e64612ee7d7dda35761f983a1d3b7bcd42afe32ee67e9438a4e96aceb.exe	16
PID 1032 wrote to memory of 1224	1032	3a5d3a1e64612ee7d7dda35761f983a1d3b7bcd42afe32ee67e9438a4e96aceb.exe	16

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Adds Run key to start application
- Modifies Internet Explorer Protected Mode
- Modifies Internet Explorer Protected Mode Banner
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1224
- C:\Users\Admin\AppData\Local\Temp\3a5d3a1e64612ee7d7dda35761f983a1d3b7bcd42afe32ee67e9438a4e96aceb.exe
  "C:\Users\Admin\AppData\Local\Temp\3a5d3a1e64612ee7d7dda35761f983a1d3b7bcd42afe32ee67e9438a4e96aceb.exe"
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1032

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

4

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\jxavmdt.dat

Filesize
244KB

MD5
be297f52018cebfad9af9b432a53af29

SHA1
5111aa620f29b77048b5da629336923ff1e3cf25

SHA256
fb99ca1d7e660b909e35801658ee556eb1e39b5b65c2d09f4824de332c0085fb

SHA512
4bae920dd7fbce22284749c38812f15d97fee6d3ca66288d875a72922586c032f9cc80d236c64687b1c495972870109e73be5ca5ad313b98aedabe5d357c054c

Download Submit
\ProgramData\jxavmdt.dat

Filesize
244KB

MD5
be297f52018cebfad9af9b432a53af29

SHA1
5111aa620f29b77048b5da629336923ff1e3cf25

SHA256
fb99ca1d7e660b909e35801658ee556eb1e39b5b65c2d09f4824de332c0085fb

SHA512
4bae920dd7fbce22284749c38812f15d97fee6d3ca66288d875a72922586c032f9cc80d236c64687b1c495972870109e73be5ca5ad313b98aedabe5d357c054c

Download Submit
memory/1032-54-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/1032-55-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/1032-56-0x0000000075501000-0x0000000075503000-memory.dmp

Filesize
8KB

Download
memory/1032-58-0x0000000010000000-0x000000001002E000-memory.dmp

Filesize
184KB

Download
memory/1032-65-0x0000000010000000-0x000000001004C000-memory.dmp

Filesize
304KB

Download
memory/1032-68-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/1032-69-0x0000000010000000-0x000000001002E000-memory.dmp

Filesize
184KB

Download
memory/1224-60-0x0000000002AE0000-0x0000000002B2D000-memory.dmp

Filesize
308KB

Download
memory/1224-67-0x0000000003930000-0x0000000003998000-memory.dmp

Filesize
416KB

Download
memory/1224-66-0x0000000002AE0000-0x0000000002B2D000-memory.dmp

Filesize
308KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads