96fe5acd0229bb1d5522eab6a868264dcc653a9a94161cd7418d0649d3f54cb5

General

Target

96fe5acd0229bb1d5522eab6a868264dcc653a9a94161cd7418d0649d3f54cb5.exe
Size

304KB
MD5

5db5bd47665ad678e83ab42ac4fdea20
SHA1

22ebfde845fcba04e0476ef8f6a1a0f5ccdc98e2
SHA256

96fe5acd0229bb1d5522eab6a868264dcc653a9a94161cd7418d0649d3f54cb5
SHA512

f1dc34267a9da47d695279fe14af96852ce15c6b543bc1132cc00dc847fd7c1a74108be9b7d05a7fbe591f96ab2a697c1f6761b8709a53570571af2e42f9d589
SSDEEP

6144:OUrqA3AheuswyPnBTJVDyiM4bTir9dEcWe4IQvIBiDlUvtym9JbqoBZ5XbH9OFQ2:OUWA3AheuswyVDpYuu3Qw9vF9Jb9bH2

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5000	mjisaio.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	96fe5acd0229bb1d5522eab6a868264dcc653a9a94161cd7418d0649d3f54cb5.exe

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\mjisaio	96fe5acd0229bb1d5522eab6a868264dcc653a9a94161cd7418d0649d3f54cb5.exe
File created	C:\Program Files (x86)\mjisaio\__tmp_rar_sfx_access_check_240597390	96fe5acd0229bb1d5522eab6a868264dcc653a9a94161cd7418d0649d3f54cb5.exe
File created	C:\Program Files (x86)\mjisaio\mjisaio.exe	96fe5acd0229bb1d5522eab6a868264dcc653a9a94161cd7418d0649d3f54cb5.exe
File opened for modification	C:\Program Files (x86)\mjisaio\mjisaio.exe	96fe5acd0229bb1d5522eab6a868264dcc653a9a94161cd7418d0649d3f54cb5.exe
File created	C:\Program Files (x86)\mjisaio\odfox32.dll	96fe5acd0229bb1d5522eab6a868264dcc653a9a94161cd7418d0649d3f54cb5.exe
File opened for modification	C:\Program Files (x86)\mjisaio\odfox32.dll	96fe5acd0229bb1d5522eab6a868264dcc653a9a94161cd7418d0649d3f54cb5.exe
File created	C:\Program Files (x86)\mjisaio\uepw.exe	mjisaio.exe
File created	C:\Program Files (x86)\mjisaio\nksoiio.bat	mjisaio.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 7 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet explorer\Main	mjisaio.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet explorer\Main	mjisaio.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\SearchScopes\baidu	mjisaio.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\baidu\DisplayName = "°Ù¶ÈËÑË÷"	mjisaio.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\baidu\URL = "http://www.baidu.com/baidu?tn=flstudios_cb&word={searchTerms}&cl=3&ie=utf-8"	mjisaio.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\SearchScopes	mjisaio.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\DefaultScope = "baidu"	mjisaio.exe

Modifies Internet Explorer start page 1 TTPs 2 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://hao.6360.info"	mjisaio.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Start Page = "http://hao.6360.info"	mjisaio.exe

Modifies registry class 12 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command	mjisaio.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	mjisaio.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}	mjisaio.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell	mjisaio.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\WOW6432Node\CLSID	mjisaio.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}	mjisaio.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage	mjisaio.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command\ = "\"C:\\Program Files\\Internet Explorer\\iexplore.exe\" http://hao.6360.info"	mjisaio.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage	mjisaio.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command	mjisaio.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\WOW6432Node	mjisaio.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell	mjisaio.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5000	mjisaio.exe
5000	mjisaio.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2888 wrote to memory of 5000	2888	96fe5acd0229bb1d5522eab6a868264dcc653a9a94161cd7418d0649d3f54cb5.exe	83
PID 2888 wrote to memory of 5000	2888	96fe5acd0229bb1d5522eab6a868264dcc653a9a94161cd7418d0649d3f54cb5.exe	83
PID 2888 wrote to memory of 5000	2888	96fe5acd0229bb1d5522eab6a868264dcc653a9a94161cd7418d0649d3f54cb5.exe	83
PID 5000 wrote to memory of 4388	5000	mjisaio.exe	86
PID 5000 wrote to memory of 4388	5000	mjisaio.exe	86
PID 5000 wrote to memory of 4388	5000	mjisaio.exe	86

C:\Users\Admin\AppData\Local\Temp\96fe5acd0229bb1d5522eab6a868264dcc653a9a94161cd7418d0649d3f54cb5.exe
"C:\Users\Admin\AppData\Local\Temp\96fe5acd0229bb1d5522eab6a868264dcc653a9a94161cd7418d0649d3f54cb5.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2888
- C:\Program Files (x86)\mjisaio\mjisaio.exe
  "C:\Program Files (x86)\mjisaio\mjisaio.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5000
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\mjisaio\nksoiio.bat""
    3⤵
    PID:4388

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\mjisaio\mjisaio.exe

Filesize
561KB

MD5
a078bdd2e09458d49ea4961052aa78f0

SHA1
6f4d76a8ef375ae1674592554c03e8160656bbe4

SHA256
5289686af0a135be243d937ebb47ca2952a5d55af8a0282480852c85b8df464f

SHA512
e7bb38f09c1b6980cb65392baf9171e2aaac804dc2dfbcc0664cd60b4adfee4dbaa0cf91ab5218972df49558909cc126ef09f0022b415d1c5e30ecf428a53a0d

Download Submit
C:\Program Files (x86)\mjisaio\mjisaio.exe

Filesize
561KB

MD5
a078bdd2e09458d49ea4961052aa78f0

SHA1
6f4d76a8ef375ae1674592554c03e8160656bbe4

SHA256
5289686af0a135be243d937ebb47ca2952a5d55af8a0282480852c85b8df464f

SHA512
e7bb38f09c1b6980cb65392baf9171e2aaac804dc2dfbcc0664cd60b4adfee4dbaa0cf91ab5218972df49558909cc126ef09f0022b415d1c5e30ecf428a53a0d

Download Submit
C:\Program Files (x86)\mjisaio\nksoiio.bat

Filesize
128B

MD5
236d93fa241341a7f5fd0e5f8a332ade

SHA1
8394841686bfec31d318c4c9edd2adf0fbd961a2

SHA256
3eea30019b9d8363b9c20d687a702e7cd440ebae5e7c2ab4d5183e3f4c6b6569

SHA512
d022e179ade9e47b31c387da13a16770c210090cf2f9c25d5d2a27e6e17c2f96d8c9e3c374a65a4d154058bdc9b25128bd59094efd231b52b4289115eac495fa

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads