Overview

overview

9

Static

static

jitsi-2.10...64.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    602s
  • max time network
    570s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-11-2022 15:38

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    jitsi-2.10.5550-x64.exe

  • Size

    64.8MB

  • MD5

    546ef502e1e1584a610515c0ac9c9f3a

  • SHA1

    ba59d021517a7cde948510994fb3e9626c1b7376

  • SHA256

    4e5aa2e40cdf2dbba7a53b3aca2bfec7645a5ecef5e38cb6edcd27fb58539552

  • SHA512

    c754c45f7b3a545a65f1e98c3aa0bd1a94c9bc8770c189e3f4cde02d225064b217e569768f255bdcf1fb66d84d1814da6ec2ee9ace2c5b158f48087a98d86220

  • SSDEEP

    1572864:fhr4diBG/dW5zueUx12uFv6AW0RFKQM6MRoVZHWXDuIGHZSkVn:ZX4MueUH2mijIFSzGZuD0Sa

Score
9/10

Malware Config

Signatures

  • Detect jar appended to MSI 1 IoCs
  • Blocklisted process makes network request 7 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 1 IoCs
  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 10 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 3 IoCs
  • Modifies registry class 51 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\jitsi-2.10.5550-x64.exe
    "C:\Users\Admin\AppData\Local\Temp\jitsi-2.10.5550-x64.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:1436
    • C:\Windows\System32\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\jitsi-2.10.5550-x64.msi" REINSTALLMODE=amus
      2⤵
      • Blocklisted process makes network request
      • Enumerates connected drives
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      PID:1472
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4612
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 25CA49C73B89AEFA437F9F23D78AD4C4 C
      2⤵
      • Loads dropped DLL
      PID:4636
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:4364
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Checks SCSI registry key(s)
      PID:1824

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\68FAF71AF355126BCA00CE2E73CC7374_1151833BB5788BDCAD7971E54EA7B930
      Filesize

      1KB

      MD5

      7b890e5d2af242037643de9c1c79b63c

      SHA1

      698d4dc6aa16fd7ea958f4192e037dec849d9cbc

      SHA256

      c5b783dd4cae87575d560cb46f13962c195e32389f7164485deb83683f74e3d5

      SHA512

      767601dfd173d6f5bf2a9aecde54ed0308ae874156be5844a7ec4761cadf5a348e2f76a6877285b0b23524d8a5e60dd397acf3b55f71721d92e39f68269898cf

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A242DAB82C3A2C6C33F27A249ED66F9B_3CECA90131B87816FB42DB83A02B5E98
      Filesize

      1KB

      MD5

      e231fa8d00f34db3579139c6d96a8305

      SHA1

      61ab062b6aa918b413a7eba853b370fd9e64886d

      SHA256

      5570c1e7ce5426df1adcb1e472006bc3726f79c821009bbd513dde2ae1ca4fe7

      SHA512

      aaebe54cbbfe4816ecf5410d396cab226c014ca8b25ae151c00d3758ba42d075adf4598cfbfd2d091e80cbc95f4cc3670132e2c6642310d13db7c6d8fcaa1106

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\68FAF71AF355126BCA00CE2E73CC7374_1151833BB5788BDCAD7971E54EA7B930
      Filesize

      412B

      MD5

      b24b0d7f683c339035f288acfab58e92

      SHA1

      480e6f4aaeabe679f5ce92e1e4e4f42bf6ba1075

      SHA256

      6ed3d747bdb7c70b8d89e7a2504723303468309a792e9228be1e51092433e623

      SHA512

      42826cf1050980a79645542122b5e7362f66ca45040d4a9f92055c12dbb6d12af02c2a4de5886fe42db5083ff35246416914e907ff266a74d45c076197ef53b1

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A242DAB82C3A2C6C33F27A249ED66F9B_3CECA90131B87816FB42DB83A02B5E98
      Filesize

      422B

      MD5

      41b2fd99566c2bed3ed18d3833d795e8

      SHA1

      4d1d27bb9e1d3c60c61a9c24a69b2b31bb97fb24

      SHA256

      28700733c608ddcbe911b18bcea840a3db1f53d2d290745d054ffc5968a45956

      SHA512

      8cf5fb0daacb54ef0d9be8d9592d18f293b14dbbf0fa7ebee7713a16e68d7ac537384535148fa1d40c39145726c038e59bfef81d2c9fc0f2c3cdf055927d9ef1

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\MSI6FE7.tmp
      Filesize

      64KB

      MD5

      5ea7455a71a9b481d0d9402c4e4e19d7

      SHA1

      4630e3d9788c445812ae7f3a5436b809c6cda09e

      SHA256

      428c16fad8a8190a6090fa940c2ef2d5c13168f721d958750a874ff8c13c5a85

      SHA512

      124b8cc4590eb31fbd336031ff4dc86987ca320a768cf8d6350f1d1628761d4099e8f4baf5b25bb9587afb903a4911efa950c15dcdae3aedfdd56b7ac2199370

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\MSI6FE7.tmp
      Filesize

      64KB

      MD5

      5ea7455a71a9b481d0d9402c4e4e19d7

      SHA1

      4630e3d9788c445812ae7f3a5436b809c6cda09e

      SHA256

      428c16fad8a8190a6090fa940c2ef2d5c13168f721d958750a874ff8c13c5a85

      SHA512

      124b8cc4590eb31fbd336031ff4dc86987ca320a768cf8d6350f1d1628761d4099e8f4baf5b25bb9587afb903a4911efa950c15dcdae3aedfdd56b7ac2199370

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\jitsi-2.10.5550-x64.msi
      Filesize

      182.3MB

      MD5

      383544e80bcdf2bffca253c6e0d950f5

      SHA1

      1b0a6129379485b144f5b2ff5ea640f64de9183d

      SHA256

      56599f2bf7cba67a08a29ade3b11068a706d24634f20f54d5d96483c4f1e9aa7

      SHA512

      71aa29e3129320e62d769f47fda30859fb57e69b6d7b3c9e8bb9130fa556686f7fb1429b1eb392e5f7759e7d251d106b351dfdbdf5ede4d6611398b02015dd4d

      Download Submit

    • \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
      Filesize

      23.0MB

      MD5

      ad7d330faec13761a6a644c60d3eb7b7

      SHA1

      7a56ad4a081fc036ebf5851725916085b8fc8964

      SHA256

      1f18772ff54843b78c3a20080c8c5c3b785ca527c8e6f08eacbce7edb505d91c

      SHA512

      95b1a74d318a9daca94494c76c42d8d382de1ac657a7548dd3c5226621bb1120e3daf2c0c4a0ec125a67e4ef69795319f010cd9e8b64507028746ad8809e007d

      Download Submit

    • \??\Volume{2fb4ccdc-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{f9e7bce2-ce9d-406c-a90f-35f22ef94eaa}_OnDiskSnapshotProp
      Filesize

      5KB

      MD5

      3611d9558bfd8c89fab4db17da4523e1

      SHA1

      80907d28053c228f4bf1bba22488e9d4b7ded674

      SHA256

      6198688c9f6735d5c9f8629b5f45c9f6137e609e53e93789ba8e7d57ce40bbf7

      SHA512

      b87d43d5cf5f70d886163f93c09cd33c61a4cef39161646fd1174524cc8a4d4663d23f18e8a518dad659dbe3d179e0ed2e363803d3341ada4f15ae003501fb2b

      Download Submit

    • memory/1472-132-0x0000000000000000-mapping.dmp

      Download

    • memory/4364-137-0x0000000000000000-mapping.dmp

      Download

    • memory/4636-134-0x0000000000000000-mapping.dmp

      Download