4dc31ace3241285ee96cfe65f54dc600e8d76473f889d914ca763e2f77c5dcd9

General

Target

4dc31ace3241285ee96cfe65f54dc600e8d76473f889d914ca763e2f77c5dcd9.exe
Size

376KB
MD5

9c458c07ecf18ce7e1c87f4b58e064b9
SHA1

e068bc5ea6978d9292326376edade2ff3e82991a
SHA256

4dc31ace3241285ee96cfe65f54dc600e8d76473f889d914ca763e2f77c5dcd9
SHA512

b76d4fa04d50907669426773a347304631d07511a4dff1a8495e2ba30ef7c7446b87d72d45771dcd6072c42f02238e3ca06f48061920a5a5da0c96acb7a5297c
SSDEEP

6144:LD1U5qcLBstYzutk0s82UpRt8yQXs38gdq:LD1NgX0s82Upk0Jd

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
1764	4dc31ace3241285ee96cfe65f54dc600e8d76473f889d914ca763e2f77c5dcd9.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run	4dc31ace3241285ee96cfe65f54dc600e8d76473f889d914ca763e2f77c5dcd9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\JenwAjyi = "regsvr32.exe \"C:\\ProgramData\\JenwAjyi\\JenwAjyi.dat\""	4dc31ace3241285ee96cfe65f54dc600e8d76473f889d914ca763e2f77c5dcd9.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\JenwAjyi = "regsvr32.exe \"C:\\ProgramData\\JenwAjyi\\JenwAjyi.dat\""	Explorer.EXE

Modifies Internet Explorer Protected Mode 1 TTPs 1 IoCs

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3"	Explorer.EXE

Modifies Internet Explorer Protected Mode Banner 1 TTPs 1 IoCs

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\NoProtectedModeBanner = "1"	Explorer.EXE

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\TabProcGrowth = "0"	Explorer.EXE

Modifies registry class 6 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\CLSID\{26021A00-471A-463C-9070-4A37462C5F1E}\#cert = 31	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\CLSID\{26021A00-471A-463C-9070-4A37462C5F1E}	4dc31ace3241285ee96cfe65f54dc600e8d76473f889d914ca763e2f77c5dcd9.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\CLSID\{26021A00-471A-463C-9070-4A37462C5F1E}\#sd = 433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c54656d705c346463333161636533323431323835656539366366653635663534646336303065386437363437336638383964393134636137363365326637376335646364392e65786500	4dc31ace3241285ee96cfe65f54dc600e8d76473f889d914ca763e2f77c5dcd9.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\CLSID\{26021A00-471A-463C-9070-4A37462C5F1E}	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\CLSID\{19D41DC9-6C78-4871-9566-411826C06A44}	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\CLSID\{19D41DC9-6C78-4871-9566-411826C06A44}\{76337323-6D8A-4064-8098-78E37BBD3CAC} = 4caf08d7	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
1764	4dc31ace3241285ee96cfe65f54dc600e8d76473f889d914ca763e2f77c5dcd9.exe
1988	wmiprvse.exe
1988	wmiprvse.exe
1988	wmiprvse.exe
1988	wmiprvse.exe
1988	wmiprvse.exe
1988	wmiprvse.exe
1988	wmiprvse.exe
1988	wmiprvse.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1212	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	1764	4dc31ace3241285ee96cfe65f54dc600e8d76473f889d914ca763e2f77c5dcd9.exe
Token: SeDebugPrivilege	1764	4dc31ace3241285ee96cfe65f54dc600e8d76473f889d914ca763e2f77c5dcd9.exe
Token: SeCreateGlobalPrivilege	1212	Explorer.EXE
Token: SeShutdownPrivilege	1212	Explorer.EXE
Token: SeDebugPrivilege	1212	Explorer.EXE
Token: SeShutdownPrivilege	1212	Explorer.EXE
Token: SeShutdownPrivilege	1212	Explorer.EXE
Token: SeShutdownPrivilege	1212	Explorer.EXE
Token: SeShutdownPrivilege	1212	Explorer.EXE

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
1764	4dc31ace3241285ee96cfe65f54dc600e8d76473f889d914ca763e2f77c5dcd9.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1764 wrote to memory of 656	1764	4dc31ace3241285ee96cfe65f54dc600e8d76473f889d914ca763e2f77c5dcd9.exe	20
PID 1764 wrote to memory of 656	1764	4dc31ace3241285ee96cfe65f54dc600e8d76473f889d914ca763e2f77c5dcd9.exe	20
PID 1764 wrote to memory of 1212	1764	4dc31ace3241285ee96cfe65f54dc600e8d76473f889d914ca763e2f77c5dcd9.exe	16
PID 1764 wrote to memory of 1212	1764	4dc31ace3241285ee96cfe65f54dc600e8d76473f889d914ca763e2f77c5dcd9.exe	16
PID 1764 wrote to memory of 1996	1764	4dc31ace3241285ee96cfe65f54dc600e8d76473f889d914ca763e2f77c5dcd9.exe	14
PID 1764 wrote to memory of 1996	1764	4dc31ace3241285ee96cfe65f54dc600e8d76473f889d914ca763e2f77c5dcd9.exe	14
PID 1764 wrote to memory of 1328	1764	4dc31ace3241285ee96cfe65f54dc600e8d76473f889d914ca763e2f77c5dcd9.exe	13
PID 1764 wrote to memory of 1328	1764	4dc31ace3241285ee96cfe65f54dc600e8d76473f889d914ca763e2f77c5dcd9.exe	13
PID 1764 wrote to memory of 1988	1764	4dc31ace3241285ee96cfe65f54dc600e8d76473f889d914ca763e2f77c5dcd9.exe	12
PID 1764 wrote to memory of 1988	1764	4dc31ace3241285ee96cfe65f54dc600e8d76473f889d914ca763e2f77c5dcd9.exe	12

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1988

\\?\C:\Windows\system32\wbem\WMIADAP.EXE
wmiadap.exe /F /T /R
1⤵
PID:1328

C:\Windows\system32\sppsvc.exe
C:\Windows\system32\sppsvc.exe
1⤵
PID:1996

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Adds Run key to start application
- Modifies Internet Explorer Protected Mode
- Modifies Internet Explorer Protected Mode Banner
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1212
- C:\Users\Admin\AppData\Local\Temp\4dc31ace3241285ee96cfe65f54dc600e8d76473f889d914ca763e2f77c5dcd9.exe
  "C:\Users\Admin\AppData\Local\Temp\4dc31ace3241285ee96cfe65f54dc600e8d76473f889d914ca763e2f77c5dcd9.exe"
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of UnmapMainImage
  - Suspicious use of WriteProcessMemory
  PID:1764

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:656

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

4

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\JenwAjyi\JenwAjyi.dat

Filesize
250KB

MD5
db4efe1ecefb18857187379778d999d9

SHA1
7967e2c6cf0804b3ff324c7b027d18230de07bcb

SHA256
c74a9746ddb5ea2d63d3169d1569a5d89a27a0e9332ecfb94a0888d0fb1409ab

SHA512
023f8dbf08153bb46e8b92e47064c6a349893ae1f1bc5f3dfba5977517927d9cf716994a0791e9fb1d53120610306fc07254a34e8a0991245641996b5b887b34

Download Submit
\ProgramData\JenwAjyi\JenwAjyi.dat

Filesize
250KB

MD5
db4efe1ecefb18857187379778d999d9

SHA1
7967e2c6cf0804b3ff324c7b027d18230de07bcb

SHA256
c74a9746ddb5ea2d63d3169d1569a5d89a27a0e9332ecfb94a0888d0fb1409ab

SHA512
023f8dbf08153bb46e8b92e47064c6a349893ae1f1bc5f3dfba5977517927d9cf716994a0791e9fb1d53120610306fc07254a34e8a0991245641996b5b887b34

Download Submit
memory/656-61-0x0000000001CA0000-0x0000000001CF4000-memory.dmp

Filesize
336KB

Download
memory/1212-75-0x0000000002A10000-0x0000000002A64000-memory.dmp

Filesize
336KB

Download
memory/1212-76-0x0000000002B40000-0x0000000002BAB000-memory.dmp

Filesize
428KB

Download
memory/1764-54-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/1764-55-0x0000000076261000-0x0000000076263000-memory.dmp

Filesize
8KB

Download
memory/1764-56-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1764-59-0x0000000010000000-0x0000000010032000-memory.dmp

Filesize
200KB

Download
memory/1764-74-0x0000000010000000-0x0000000010042000-memory.dmp

Filesize
264KB

Download
memory/1764-77-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1764-78-0x0000000010000000-0x0000000010032000-memory.dmp

Filesize
200KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads