Analysis
-
max time kernel
154s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
30/10/2022, 20:26
Static task
static1
Behavioral task
behavioral1
Sample
50b8f349f5e266b70fbbe2c17db3b4e57fd783b523c73e27bcb6366d05fa1b15.exe
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral2
Sample
50b8f349f5e266b70fbbe2c17db3b4e57fd783b523c73e27bcb6366d05fa1b15.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
General
-
Target
50b8f349f5e266b70fbbe2c17db3b4e57fd783b523c73e27bcb6366d05fa1b15.exe
-
Size
203KB
-
MD5
9192b556adf076467f5d06f855a757f8
-
SHA1
67ec2aea3f8d525b99debea95bf3805c50f8e252
-
SHA256
50b8f349f5e266b70fbbe2c17db3b4e57fd783b523c73e27bcb6366d05fa1b15
-
SHA512
6e46b5631d96855d8198b8d58c8720dad17da207a13e3bd5dd22ae25b521b72296ad2d1e9d78a905418e3987eeee3790c69cccb0fd55cbc3b002bbdc8717e124
-
SSDEEP
3072:Wo9Bfs4rUPb1WpXVxAaGBvbNvNbNJkvmhyPQbaDTUXGIDbwKDqCtrwdAxaVTtVHy:9n04eoIDbByGPMsMP
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" jixef.exe -
Executes dropped EXE 1 IoCs
pid Process 1320 jixef.exe -
Loads dropped DLL 2 IoCs
pid Process 1960 50b8f349f5e266b70fbbe2c17db3b4e57fd783b523c73e27bcb6366d05fa1b15.exe 1960 50b8f349f5e266b70fbbe2c17db3b4e57fd783b523c73e27bcb6366d05fa1b15.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ jixef.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\jixef = "C:\\Users\\Admin\\jixef.exe" jixef.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1320 jixef.exe 1320 jixef.exe 1320 jixef.exe 1320 jixef.exe 1320 jixef.exe 1320 jixef.exe 1320 jixef.exe 1320 jixef.exe 1320 jixef.exe 1320 jixef.exe 1320 jixef.exe 1320 jixef.exe 1320 jixef.exe 1320 jixef.exe 1320 jixef.exe 1320 jixef.exe 1320 jixef.exe 1320 jixef.exe 1320 jixef.exe 1320 jixef.exe 1320 jixef.exe 1320 jixef.exe 1320 jixef.exe 1320 jixef.exe 1320 jixef.exe 1320 jixef.exe 1320 jixef.exe 1320 jixef.exe 1320 jixef.exe 1320 jixef.exe 1320 jixef.exe 1320 jixef.exe 1320 jixef.exe 1320 jixef.exe 1320 jixef.exe 1320 jixef.exe 1320 jixef.exe 1320 jixef.exe 1320 jixef.exe 1320 jixef.exe 1320 jixef.exe 1320 jixef.exe 1320 jixef.exe 1320 jixef.exe 1320 jixef.exe 1320 jixef.exe 1320 jixef.exe 1320 jixef.exe 1320 jixef.exe 1320 jixef.exe 1320 jixef.exe 1320 jixef.exe 1320 jixef.exe 1320 jixef.exe 1320 jixef.exe 1320 jixef.exe 1320 jixef.exe 1320 jixef.exe 1320 jixef.exe 1320 jixef.exe 1320 jixef.exe 1320 jixef.exe 1320 jixef.exe 1320 jixef.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1960 50b8f349f5e266b70fbbe2c17db3b4e57fd783b523c73e27bcb6366d05fa1b15.exe 1320 jixef.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1960 wrote to memory of 1320 1960 50b8f349f5e266b70fbbe2c17db3b4e57fd783b523c73e27bcb6366d05fa1b15.exe 28 PID 1960 wrote to memory of 1320 1960 50b8f349f5e266b70fbbe2c17db3b4e57fd783b523c73e27bcb6366d05fa1b15.exe 28 PID 1960 wrote to memory of 1320 1960 50b8f349f5e266b70fbbe2c17db3b4e57fd783b523c73e27bcb6366d05fa1b15.exe 28 PID 1960 wrote to memory of 1320 1960 50b8f349f5e266b70fbbe2c17db3b4e57fd783b523c73e27bcb6366d05fa1b15.exe 28 PID 1320 wrote to memory of 1960 1320 jixef.exe 15 PID 1320 wrote to memory of 1960 1320 jixef.exe 15 PID 1320 wrote to memory of 1960 1320 jixef.exe 15 PID 1320 wrote to memory of 1960 1320 jixef.exe 15 PID 1320 wrote to memory of 1960 1320 jixef.exe 15 PID 1320 wrote to memory of 1960 1320 jixef.exe 15 PID 1320 wrote to memory of 1960 1320 jixef.exe 15 PID 1320 wrote to memory of 1960 1320 jixef.exe 15 PID 1320 wrote to memory of 1960 1320 jixef.exe 15 PID 1320 wrote to memory of 1960 1320 jixef.exe 15 PID 1320 wrote to memory of 1960 1320 jixef.exe 15 PID 1320 wrote to memory of 1960 1320 jixef.exe 15 PID 1320 wrote to memory of 1960 1320 jixef.exe 15 PID 1320 wrote to memory of 1960 1320 jixef.exe 15 PID 1320 wrote to memory of 1960 1320 jixef.exe 15 PID 1320 wrote to memory of 1960 1320 jixef.exe 15 PID 1320 wrote to memory of 1960 1320 jixef.exe 15 PID 1320 wrote to memory of 1960 1320 jixef.exe 15 PID 1320 wrote to memory of 1960 1320 jixef.exe 15 PID 1320 wrote to memory of 1960 1320 jixef.exe 15 PID 1320 wrote to memory of 1960 1320 jixef.exe 15 PID 1320 wrote to memory of 1960 1320 jixef.exe 15 PID 1320 wrote to memory of 1960 1320 jixef.exe 15 PID 1320 wrote to memory of 1960 1320 jixef.exe 15 PID 1320 wrote to memory of 1960 1320 jixef.exe 15 PID 1320 wrote to memory of 1960 1320 jixef.exe 15 PID 1320 wrote to memory of 1960 1320 jixef.exe 15 PID 1320 wrote to memory of 1960 1320 jixef.exe 15 PID 1320 wrote to memory of 1960 1320 jixef.exe 15 PID 1320 wrote to memory of 1960 1320 jixef.exe 15 PID 1320 wrote to memory of 1960 1320 jixef.exe 15 PID 1320 wrote to memory of 1960 1320 jixef.exe 15 PID 1320 wrote to memory of 1960 1320 jixef.exe 15 PID 1320 wrote to memory of 1960 1320 jixef.exe 15 PID 1320 wrote to memory of 1960 1320 jixef.exe 15 PID 1320 wrote to memory of 1960 1320 jixef.exe 15 PID 1320 wrote to memory of 1960 1320 jixef.exe 15 PID 1320 wrote to memory of 1960 1320 jixef.exe 15 PID 1320 wrote to memory of 1960 1320 jixef.exe 15 PID 1320 wrote to memory of 1960 1320 jixef.exe 15 PID 1320 wrote to memory of 1960 1320 jixef.exe 15 PID 1320 wrote to memory of 1960 1320 jixef.exe 15 PID 1320 wrote to memory of 1960 1320 jixef.exe 15 PID 1320 wrote to memory of 1960 1320 jixef.exe 15 PID 1320 wrote to memory of 1960 1320 jixef.exe 15 PID 1320 wrote to memory of 1960 1320 jixef.exe 15 PID 1320 wrote to memory of 1960 1320 jixef.exe 15 PID 1320 wrote to memory of 1960 1320 jixef.exe 15 PID 1320 wrote to memory of 1960 1320 jixef.exe 15 PID 1320 wrote to memory of 1960 1320 jixef.exe 15 PID 1320 wrote to memory of 1960 1320 jixef.exe 15 PID 1320 wrote to memory of 1960 1320 jixef.exe 15 PID 1320 wrote to memory of 1960 1320 jixef.exe 15 PID 1320 wrote to memory of 1960 1320 jixef.exe 15 PID 1320 wrote to memory of 1960 1320 jixef.exe 15 PID 1320 wrote to memory of 1960 1320 jixef.exe 15 PID 1320 wrote to memory of 1960 1320 jixef.exe 15 PID 1320 wrote to memory of 1960 1320 jixef.exe 15 PID 1320 wrote to memory of 1960 1320 jixef.exe 15 PID 1320 wrote to memory of 1960 1320 jixef.exe 15
Processes
-
C:\Users\Admin\AppData\Local\Temp\50b8f349f5e266b70fbbe2c17db3b4e57fd783b523c73e27bcb6366d05fa1b15.exe"C:\Users\Admin\AppData\Local\Temp\50b8f349f5e266b70fbbe2c17db3b4e57fd783b523c73e27bcb6366d05fa1b15.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Users\Admin\jixef.exe"C:\Users\Admin\jixef.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1320
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
203KB
MD5f550c2061a6f755ba1696baccc971ce5
SHA1142adacbc558571b269f027d22283637c6df5b83
SHA25644ea3c2108a7c7f2dc08afb8961495dfb964e00fd4be55556e0dd9c93120539f
SHA512944ff9b4e582ef2918961acddbecd1ebd28572f5f85ce666a46a319fba8fa9d6929bb389dfbc38372bca94b5cbd7effcd178222f51781d4a703e00f55df373cc
-
Filesize
203KB
MD5f550c2061a6f755ba1696baccc971ce5
SHA1142adacbc558571b269f027d22283637c6df5b83
SHA25644ea3c2108a7c7f2dc08afb8961495dfb964e00fd4be55556e0dd9c93120539f
SHA512944ff9b4e582ef2918961acddbecd1ebd28572f5f85ce666a46a319fba8fa9d6929bb389dfbc38372bca94b5cbd7effcd178222f51781d4a703e00f55df373cc
-
Filesize
203KB
MD5f550c2061a6f755ba1696baccc971ce5
SHA1142adacbc558571b269f027d22283637c6df5b83
SHA25644ea3c2108a7c7f2dc08afb8961495dfb964e00fd4be55556e0dd9c93120539f
SHA512944ff9b4e582ef2918961acddbecd1ebd28572f5f85ce666a46a319fba8fa9d6929bb389dfbc38372bca94b5cbd7effcd178222f51781d4a703e00f55df373cc
-
Filesize
203KB
MD5f550c2061a6f755ba1696baccc971ce5
SHA1142adacbc558571b269f027d22283637c6df5b83
SHA25644ea3c2108a7c7f2dc08afb8961495dfb964e00fd4be55556e0dd9c93120539f
SHA512944ff9b4e582ef2918961acddbecd1ebd28572f5f85ce666a46a319fba8fa9d6929bb389dfbc38372bca94b5cbd7effcd178222f51781d4a703e00f55df373cc