d2780446747f193948833597b296accd2f5ba6032a91da382fb8507fe7859836

Analysis

max time kernel
150s
max time network
53s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
30/10/2022, 19:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d2780446747f193948833597b296accd2f5ba6032a91da382fb8507fe7859836.exe
Size

80KB
MD5

911f0485df4ebf942351c562e93034b1
SHA1

1ff933fa431144c84b480de739ec5296223ed60b
SHA256

d2780446747f193948833597b296accd2f5ba6032a91da382fb8507fe7859836
SHA512

c234b89ec6c70baa0318421f7ebdcc43b78239a9a52abb164eb218d0b3bd45e3a25df004c7a25cdf1c96872fc2af5790f372e7ffa286319c1cb260bed02fccef
SSDEEP

1536:Q0dqr86g7LWnICOqubrzocTzFJ0T72VpGT:J6dIVqgBTzFJ0T72aT

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	d2780446747f193948833597b296accd2f5ba6032a91da382fb8507fe7859836.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	joavo.exe

Executes dropped EXE 1 IoCs

pid	Process
1232	joavo.exe

Loads dropped DLL 2 IoCs

pid	Process
1364	d2780446747f193948833597b296accd2f5ba6032a91da382fb8507fe7859836.exe
1364	d2780446747f193948833597b296accd2f5ba6032a91da382fb8507fe7859836.exe

Adds Run key to start application 2 TTPs 29 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\joavo = "C:\\Users\\Admin\\joavo.exe /j"	joavo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\joavo = "C:\\Users\\Admin\\joavo.exe /w"	joavo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\joavo = "C:\\Users\\Admin\\joavo.exe /z"	joavo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\joavo = "C:\\Users\\Admin\\joavo.exe /l"	joavo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\joavo = "C:\\Users\\Admin\\joavo.exe /s"	joavo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\joavo = "C:\\Users\\Admin\\joavo.exe /s"	d2780446747f193948833597b296accd2f5ba6032a91da382fb8507fe7859836.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\joavo = "C:\\Users\\Admin\\joavo.exe /q"	joavo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\joavo = "C:\\Users\\Admin\\joavo.exe /a"	joavo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\joavo = "C:\\Users\\Admin\\joavo.exe /t"	joavo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\joavo = "C:\\Users\\Admin\\joavo.exe /u"	joavo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\joavo = "C:\\Users\\Admin\\joavo.exe /o"	joavo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\joavo = "C:\\Users\\Admin\\joavo.exe /k"	joavo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\joavo = "C:\\Users\\Admin\\joavo.exe /r"	joavo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\joavo = "C:\\Users\\Admin\\joavo.exe /y"	joavo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\joavo = "C:\\Users\\Admin\\joavo.exe /c"	joavo.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\	d2780446747f193948833597b296accd2f5ba6032a91da382fb8507fe7859836.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\	joavo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\joavo = "C:\\Users\\Admin\\joavo.exe /n"	joavo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\joavo = "C:\\Users\\Admin\\joavo.exe /e"	joavo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\joavo = "C:\\Users\\Admin\\joavo.exe /d"	joavo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\joavo = "C:\\Users\\Admin\\joavo.exe /p"	joavo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\joavo = "C:\\Users\\Admin\\joavo.exe /g"	joavo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\joavo = "C:\\Users\\Admin\\joavo.exe /v"	joavo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\joavo = "C:\\Users\\Admin\\joavo.exe /m"	joavo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\joavo = "C:\\Users\\Admin\\joavo.exe /f"	joavo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\joavo = "C:\\Users\\Admin\\joavo.exe /h"	joavo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\joavo = "C:\\Users\\Admin\\joavo.exe /b"	joavo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\joavo = "C:\\Users\\Admin\\joavo.exe /i"	joavo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\joavo = "C:\\Users\\Admin\\joavo.exe /x"	joavo.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1364	d2780446747f193948833597b296accd2f5ba6032a91da382fb8507fe7859836.exe
1232	joavo.exe
1232	joavo.exe
1232	joavo.exe
1232	joavo.exe
1232	joavo.exe
1232	joavo.exe
1232	joavo.exe
1232	joavo.exe
1232	joavo.exe
1232	joavo.exe
1232	joavo.exe
1232	joavo.exe
1232	joavo.exe
1232	joavo.exe
1232	joavo.exe
1232	joavo.exe
1232	joavo.exe
1232	joavo.exe
1232	joavo.exe
1232	joavo.exe
1232	joavo.exe
1232	joavo.exe
1232	joavo.exe
1232	joavo.exe
1232	joavo.exe
1232	joavo.exe
1232	joavo.exe
1232	joavo.exe
1232	joavo.exe
1232	joavo.exe
1232	joavo.exe
1232	joavo.exe
1232	joavo.exe
1232	joavo.exe
1232	joavo.exe
1232	joavo.exe
1232	joavo.exe
1232	joavo.exe
1232	joavo.exe
1232	joavo.exe
1232	joavo.exe
1232	joavo.exe
1232	joavo.exe
1232	joavo.exe
1232	joavo.exe
1232	joavo.exe
1232	joavo.exe
1232	joavo.exe
1232	joavo.exe
1232	joavo.exe
1232	joavo.exe
1232	joavo.exe
1232	joavo.exe
1232	joavo.exe
1232	joavo.exe
1232	joavo.exe
1232	joavo.exe
1232	joavo.exe
1232	joavo.exe
1232	joavo.exe
1232	joavo.exe
1232	joavo.exe
1232	joavo.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1364	d2780446747f193948833597b296accd2f5ba6032a91da382fb8507fe7859836.exe
1232	joavo.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1364 wrote to memory of 1232	1364	d2780446747f193948833597b296accd2f5ba6032a91da382fb8507fe7859836.exe	26
PID 1364 wrote to memory of 1232	1364	d2780446747f193948833597b296accd2f5ba6032a91da382fb8507fe7859836.exe	26
PID 1364 wrote to memory of 1232	1364	d2780446747f193948833597b296accd2f5ba6032a91da382fb8507fe7859836.exe	26
PID 1364 wrote to memory of 1232	1364	d2780446747f193948833597b296accd2f5ba6032a91da382fb8507fe7859836.exe	26

C:\Users\Admin\AppData\Local\Temp\d2780446747f193948833597b296accd2f5ba6032a91da382fb8507fe7859836.exe
"C:\Users\Admin\AppData\Local\Temp\d2780446747f193948833597b296accd2f5ba6032a91da382fb8507fe7859836.exe"
1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1364
- C:\Users\Admin\joavo.exe
  "C:\Users\Admin\joavo.exe"
  2⤵
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:1232

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\joavo.exe

Filesize
80KB

MD5
0bbd85fb1a049b518c9ac699a9fd69d1

SHA1
51801e8c7fdff4976704b308e1edb002d09081ea

SHA256
48aef3a08b09ad38db1b46d5d1adcf53e7de3fbb90f1d79a0433660ba63dab80

SHA512
28443e2daf67a9ff7e590ca188852173e0376c1c3d8183afbd41377f66d2bde9fe8ee5f9e38168f2efcb8f7040a2d032fbcfbb826cec2de9f46d6c8b5245f383

Download Submit
C:\Users\Admin\joavo.exe

Filesize
80KB

MD5
0bbd85fb1a049b518c9ac699a9fd69d1

SHA1
51801e8c7fdff4976704b308e1edb002d09081ea

SHA256
48aef3a08b09ad38db1b46d5d1adcf53e7de3fbb90f1d79a0433660ba63dab80

SHA512
28443e2daf67a9ff7e590ca188852173e0376c1c3d8183afbd41377f66d2bde9fe8ee5f9e38168f2efcb8f7040a2d032fbcfbb826cec2de9f46d6c8b5245f383

Download Submit
\Users\Admin\joavo.exe

Filesize
80KB

MD5
0bbd85fb1a049b518c9ac699a9fd69d1

SHA1
51801e8c7fdff4976704b308e1edb002d09081ea

SHA256
48aef3a08b09ad38db1b46d5d1adcf53e7de3fbb90f1d79a0433660ba63dab80

SHA512
28443e2daf67a9ff7e590ca188852173e0376c1c3d8183afbd41377f66d2bde9fe8ee5f9e38168f2efcb8f7040a2d032fbcfbb826cec2de9f46d6c8b5245f383

Download Submit
\Users\Admin\joavo.exe

Filesize
80KB

MD5
0bbd85fb1a049b518c9ac699a9fd69d1

SHA1
51801e8c7fdff4976704b308e1edb002d09081ea

SHA256
48aef3a08b09ad38db1b46d5d1adcf53e7de3fbb90f1d79a0433660ba63dab80

SHA512
28443e2daf67a9ff7e590ca188852173e0376c1c3d8183afbd41377f66d2bde9fe8ee5f9e38168f2efcb8f7040a2d032fbcfbb826cec2de9f46d6c8b5245f383

Download Submit
memory/1232-67-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1232-72-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1364-61-0x0000000002690000-0x00000000026AD000-memory.dmp

Filesize
116KB

Download
memory/1364-57-0x0000000075091000-0x0000000075093000-memory.dmp

Filesize
8KB

Download
memory/1364-66-0x0000000002690000-0x00000000026AD000-memory.dmp

Filesize
116KB

Download
memory/1364-56-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1364-69-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1364-70-0x0000000002690000-0x00000000026AD000-memory.dmp

Filesize
116KB

Download
memory/1364-71-0x0000000002690000-0x00000000026AD000-memory.dmp

Filesize
116KB

Download