Analysis
-
max time kernel
151s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 17:20
Static task
static1
Behavioral task
behavioral1
Sample
e921e8f4ff4306a3e67493b831c46591a4b4e16fe3b305d8d53bfbb1572d78c6.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
e921e8f4ff4306a3e67493b831c46591a4b4e16fe3b305d8d53bfbb1572d78c6.exe
Resource
win10v2004-20220901-en
General
-
Target
e921e8f4ff4306a3e67493b831c46591a4b4e16fe3b305d8d53bfbb1572d78c6.exe
-
Size
88KB
-
MD5
445f590129ab3578a25406e13bf59676
-
SHA1
b31b91185600c836b00fa11e5a9917d330b28fb8
-
SHA256
e921e8f4ff4306a3e67493b831c46591a4b4e16fe3b305d8d53bfbb1572d78c6
-
SHA512
0678760652a5fdd6797138997ae5bace62dc2776679685de163d906fd908d7ccf29f339ad6d0653f2fb2f70734637da19e5dbeebe2529aa374b44679a23e9dac
-
SSDEEP
1536:tKKs7bYXLLXH0qKPY/jLVTB7GhbO5dnT0LmXub31WLSDYYtw/s:3eE3XHdKQXFNx5omXub3QLKtw
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
Processes:
e921e8f4ff4306a3e67493b831c46591a4b4e16fe3b305d8d53bfbb1572d78c6.exejdruoz.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" e921e8f4ff4306a3e67493b831c46591a4b4e16fe3b305d8d53bfbb1572d78c6.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" jdruoz.exe -
Executes dropped EXE 2 IoCs
Processes:
jdruoz.exejdruoz.exepid process 564 jdruoz.exe 1532 jdruoz.exe -
Loads dropped DLL 2 IoCs
Processes:
e921e8f4ff4306a3e67493b831c46591a4b4e16fe3b305d8d53bfbb1572d78c6.exepid process 948 e921e8f4ff4306a3e67493b831c46591a4b4e16fe3b305d8d53bfbb1572d78c6.exe 948 e921e8f4ff4306a3e67493b831c46591a4b4e16fe3b305d8d53bfbb1572d78c6.exe -
Adds Run key to start application 2 TTPs 26 IoCs
Processes:
jdruoz.exee921e8f4ff4306a3e67493b831c46591a4b4e16fe3b305d8d53bfbb1572d78c6.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\jdruoz = "C:\\Users\\Admin\\jdruoz.exe /u" jdruoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\jdruoz = "C:\\Users\\Admin\\jdruoz.exe /b" jdruoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\jdruoz = "C:\\Users\\Admin\\jdruoz.exe /w" jdruoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\jdruoz = "C:\\Users\\Admin\\jdruoz.exe /i" jdruoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\jdruoz = "C:\\Users\\Admin\\jdruoz.exe /a" jdruoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\jdruoz = "C:\\Users\\Admin\\jdruoz.exe /e" jdruoz.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\ e921e8f4ff4306a3e67493b831c46591a4b4e16fe3b305d8d53bfbb1572d78c6.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\jdruoz = "C:\\Users\\Admin\\jdruoz.exe /t" jdruoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\jdruoz = "C:\\Users\\Admin\\jdruoz.exe /k" jdruoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\jdruoz = "C:\\Users\\Admin\\jdruoz.exe /x" jdruoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\jdruoz = "C:\\Users\\Admin\\jdruoz.exe /p" jdruoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\jdruoz = "C:\\Users\\Admin\\jdruoz.exe /n" jdruoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\jdruoz = "C:\\Users\\Admin\\jdruoz.exe /d" jdruoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\jdruoz = "C:\\Users\\Admin\\jdruoz.exe /m" jdruoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\jdruoz = "C:\\Users\\Admin\\jdruoz.exe /c" jdruoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\jdruoz = "C:\\Users\\Admin\\jdruoz.exe /j" jdruoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\jdruoz = "C:\\Users\\Admin\\jdruoz.exe /y" jdruoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\jdruoz = "C:\\Users\\Admin\\jdruoz.exe /v" jdruoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\jdruoz = "C:\\Users\\Admin\\jdruoz.exe /r" e921e8f4ff4306a3e67493b831c46591a4b4e16fe3b305d8d53bfbb1572d78c6.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\jdruoz = "C:\\Users\\Admin\\jdruoz.exe /s" jdruoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\jdruoz = "C:\\Users\\Admin\\jdruoz.exe /q" jdruoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\jdruoz = "C:\\Users\\Admin\\jdruoz.exe /z" jdruoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\jdruoz = "C:\\Users\\Admin\\jdruoz.exe /r" jdruoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\jdruoz = "C:\\Users\\Admin\\jdruoz.exe /l" jdruoz.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\ jdruoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\jdruoz = "C:\\Users\\Admin\\jdruoz.exe /g" jdruoz.exe -
Maps connected drives based on registry 3 TTPs 4 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
jdruoz.exee921e8f4ff4306a3e67493b831c46591a4b4e16fe3b305d8d53bfbb1572d78c6.exedescription ioc process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 jdruoz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum e921e8f4ff4306a3e67493b831c46591a4b4e16fe3b305d8d53bfbb1572d78c6.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 e921e8f4ff4306a3e67493b831c46591a4b4e16fe3b305d8d53bfbb1572d78c6.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum jdruoz.exe -
Drops autorun.inf file 1 TTPs 1 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
Processes:
jdruoz.exedescription ioc process File opened for modification C:\Users\Admin\c\autorun.inf jdruoz.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
e921e8f4ff4306a3e67493b831c46591a4b4e16fe3b305d8d53bfbb1572d78c6.exejdruoz.exedescription pid process target process PID 1780 set thread context of 948 1780 e921e8f4ff4306a3e67493b831c46591a4b4e16fe3b305d8d53bfbb1572d78c6.exe e921e8f4ff4306a3e67493b831c46591a4b4e16fe3b305d8d53bfbb1572d78c6.exe PID 564 set thread context of 1532 564 jdruoz.exe jdruoz.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
e921e8f4ff4306a3e67493b831c46591a4b4e16fe3b305d8d53bfbb1572d78c6.exejdruoz.exepid process 948 e921e8f4ff4306a3e67493b831c46591a4b4e16fe3b305d8d53bfbb1572d78c6.exe 1532 jdruoz.exe 1532 jdruoz.exe 1532 jdruoz.exe 1532 jdruoz.exe 1532 jdruoz.exe 1532 jdruoz.exe 1532 jdruoz.exe 1532 jdruoz.exe 1532 jdruoz.exe 1532 jdruoz.exe 1532 jdruoz.exe 1532 jdruoz.exe 1532 jdruoz.exe 1532 jdruoz.exe 1532 jdruoz.exe 1532 jdruoz.exe 1532 jdruoz.exe 1532 jdruoz.exe 1532 jdruoz.exe 1532 jdruoz.exe 1532 jdruoz.exe 1532 jdruoz.exe 1532 jdruoz.exe 1532 jdruoz.exe 1532 jdruoz.exe 1532 jdruoz.exe 1532 jdruoz.exe 1532 jdruoz.exe 1532 jdruoz.exe 1532 jdruoz.exe 1532 jdruoz.exe 1532 jdruoz.exe 1532 jdruoz.exe 1532 jdruoz.exe 1532 jdruoz.exe 1532 jdruoz.exe 1532 jdruoz.exe 1532 jdruoz.exe 1532 jdruoz.exe 1532 jdruoz.exe 1532 jdruoz.exe 1532 jdruoz.exe 1532 jdruoz.exe 1532 jdruoz.exe 1532 jdruoz.exe 1532 jdruoz.exe 1532 jdruoz.exe 1532 jdruoz.exe 1532 jdruoz.exe 1532 jdruoz.exe 1532 jdruoz.exe 1532 jdruoz.exe 1532 jdruoz.exe 1532 jdruoz.exe 1532 jdruoz.exe 1532 jdruoz.exe 1532 jdruoz.exe 1532 jdruoz.exe 1532 jdruoz.exe 1532 jdruoz.exe 1532 jdruoz.exe 1532 jdruoz.exe 1532 jdruoz.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
e921e8f4ff4306a3e67493b831c46591a4b4e16fe3b305d8d53bfbb1572d78c6.exee921e8f4ff4306a3e67493b831c46591a4b4e16fe3b305d8d53bfbb1572d78c6.exejdruoz.exejdruoz.exepid process 1780 e921e8f4ff4306a3e67493b831c46591a4b4e16fe3b305d8d53bfbb1572d78c6.exe 948 e921e8f4ff4306a3e67493b831c46591a4b4e16fe3b305d8d53bfbb1572d78c6.exe 564 jdruoz.exe 1532 jdruoz.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
e921e8f4ff4306a3e67493b831c46591a4b4e16fe3b305d8d53bfbb1572d78c6.exee921e8f4ff4306a3e67493b831c46591a4b4e16fe3b305d8d53bfbb1572d78c6.exejdruoz.exedescription pid process target process PID 1780 wrote to memory of 948 1780 e921e8f4ff4306a3e67493b831c46591a4b4e16fe3b305d8d53bfbb1572d78c6.exe e921e8f4ff4306a3e67493b831c46591a4b4e16fe3b305d8d53bfbb1572d78c6.exe PID 1780 wrote to memory of 948 1780 e921e8f4ff4306a3e67493b831c46591a4b4e16fe3b305d8d53bfbb1572d78c6.exe e921e8f4ff4306a3e67493b831c46591a4b4e16fe3b305d8d53bfbb1572d78c6.exe PID 1780 wrote to memory of 948 1780 e921e8f4ff4306a3e67493b831c46591a4b4e16fe3b305d8d53bfbb1572d78c6.exe e921e8f4ff4306a3e67493b831c46591a4b4e16fe3b305d8d53bfbb1572d78c6.exe PID 1780 wrote to memory of 948 1780 e921e8f4ff4306a3e67493b831c46591a4b4e16fe3b305d8d53bfbb1572d78c6.exe e921e8f4ff4306a3e67493b831c46591a4b4e16fe3b305d8d53bfbb1572d78c6.exe PID 1780 wrote to memory of 948 1780 e921e8f4ff4306a3e67493b831c46591a4b4e16fe3b305d8d53bfbb1572d78c6.exe e921e8f4ff4306a3e67493b831c46591a4b4e16fe3b305d8d53bfbb1572d78c6.exe PID 1780 wrote to memory of 948 1780 e921e8f4ff4306a3e67493b831c46591a4b4e16fe3b305d8d53bfbb1572d78c6.exe e921e8f4ff4306a3e67493b831c46591a4b4e16fe3b305d8d53bfbb1572d78c6.exe PID 1780 wrote to memory of 948 1780 e921e8f4ff4306a3e67493b831c46591a4b4e16fe3b305d8d53bfbb1572d78c6.exe e921e8f4ff4306a3e67493b831c46591a4b4e16fe3b305d8d53bfbb1572d78c6.exe PID 1780 wrote to memory of 948 1780 e921e8f4ff4306a3e67493b831c46591a4b4e16fe3b305d8d53bfbb1572d78c6.exe e921e8f4ff4306a3e67493b831c46591a4b4e16fe3b305d8d53bfbb1572d78c6.exe PID 1780 wrote to memory of 948 1780 e921e8f4ff4306a3e67493b831c46591a4b4e16fe3b305d8d53bfbb1572d78c6.exe e921e8f4ff4306a3e67493b831c46591a4b4e16fe3b305d8d53bfbb1572d78c6.exe PID 1780 wrote to memory of 948 1780 e921e8f4ff4306a3e67493b831c46591a4b4e16fe3b305d8d53bfbb1572d78c6.exe e921e8f4ff4306a3e67493b831c46591a4b4e16fe3b305d8d53bfbb1572d78c6.exe PID 948 wrote to memory of 564 948 e921e8f4ff4306a3e67493b831c46591a4b4e16fe3b305d8d53bfbb1572d78c6.exe jdruoz.exe PID 948 wrote to memory of 564 948 e921e8f4ff4306a3e67493b831c46591a4b4e16fe3b305d8d53bfbb1572d78c6.exe jdruoz.exe PID 948 wrote to memory of 564 948 e921e8f4ff4306a3e67493b831c46591a4b4e16fe3b305d8d53bfbb1572d78c6.exe jdruoz.exe PID 948 wrote to memory of 564 948 e921e8f4ff4306a3e67493b831c46591a4b4e16fe3b305d8d53bfbb1572d78c6.exe jdruoz.exe PID 564 wrote to memory of 1532 564 jdruoz.exe jdruoz.exe PID 564 wrote to memory of 1532 564 jdruoz.exe jdruoz.exe PID 564 wrote to memory of 1532 564 jdruoz.exe jdruoz.exe PID 564 wrote to memory of 1532 564 jdruoz.exe jdruoz.exe PID 564 wrote to memory of 1532 564 jdruoz.exe jdruoz.exe PID 564 wrote to memory of 1532 564 jdruoz.exe jdruoz.exe PID 564 wrote to memory of 1532 564 jdruoz.exe jdruoz.exe PID 564 wrote to memory of 1532 564 jdruoz.exe jdruoz.exe PID 564 wrote to memory of 1532 564 jdruoz.exe jdruoz.exe PID 564 wrote to memory of 1532 564 jdruoz.exe jdruoz.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e921e8f4ff4306a3e67493b831c46591a4b4e16fe3b305d8d53bfbb1572d78c6.exe"C:\Users\Admin\AppData\Local\Temp\e921e8f4ff4306a3e67493b831c46591a4b4e16fe3b305d8d53bfbb1572d78c6.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e921e8f4ff4306a3e67493b831c46591a4b4e16fe3b305d8d53bfbb1572d78c6.exe742⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\jdruoz.exe"C:\Users\Admin\jdruoz.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\jdruoz.exe744⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Maps connected drives based on registry
- Drops autorun.inf file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\jdruoz.exeFilesize
88KB
MD5445f590129ab3578a25406e13bf59676
SHA1b31b91185600c836b00fa11e5a9917d330b28fb8
SHA256e921e8f4ff4306a3e67493b831c46591a4b4e16fe3b305d8d53bfbb1572d78c6
SHA5120678760652a5fdd6797138997ae5bace62dc2776679685de163d906fd908d7ccf29f339ad6d0653f2fb2f70734637da19e5dbeebe2529aa374b44679a23e9dac
-
C:\Users\Admin\jdruoz.exeFilesize
88KB
MD5445f590129ab3578a25406e13bf59676
SHA1b31b91185600c836b00fa11e5a9917d330b28fb8
SHA256e921e8f4ff4306a3e67493b831c46591a4b4e16fe3b305d8d53bfbb1572d78c6
SHA5120678760652a5fdd6797138997ae5bace62dc2776679685de163d906fd908d7ccf29f339ad6d0653f2fb2f70734637da19e5dbeebe2529aa374b44679a23e9dac
-
C:\Users\Admin\jdruoz.exeFilesize
88KB
MD5445f590129ab3578a25406e13bf59676
SHA1b31b91185600c836b00fa11e5a9917d330b28fb8
SHA256e921e8f4ff4306a3e67493b831c46591a4b4e16fe3b305d8d53bfbb1572d78c6
SHA5120678760652a5fdd6797138997ae5bace62dc2776679685de163d906fd908d7ccf29f339ad6d0653f2fb2f70734637da19e5dbeebe2529aa374b44679a23e9dac
-
\Users\Admin\jdruoz.exeFilesize
88KB
MD5445f590129ab3578a25406e13bf59676
SHA1b31b91185600c836b00fa11e5a9917d330b28fb8
SHA256e921e8f4ff4306a3e67493b831c46591a4b4e16fe3b305d8d53bfbb1572d78c6
SHA5120678760652a5fdd6797138997ae5bace62dc2776679685de163d906fd908d7ccf29f339ad6d0653f2fb2f70734637da19e5dbeebe2529aa374b44679a23e9dac
-
\Users\Admin\jdruoz.exeFilesize
88KB
MD5445f590129ab3578a25406e13bf59676
SHA1b31b91185600c836b00fa11e5a9917d330b28fb8
SHA256e921e8f4ff4306a3e67493b831c46591a4b4e16fe3b305d8d53bfbb1572d78c6
SHA5120678760652a5fdd6797138997ae5bace62dc2776679685de163d906fd908d7ccf29f339ad6d0653f2fb2f70734637da19e5dbeebe2529aa374b44679a23e9dac
-
memory/564-67-0x0000000000000000-mapping.dmp
-
memory/948-63-0x0000000074F01000-0x0000000074F03000-memory.dmpFilesize
8KB
-
memory/948-64-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/948-56-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/948-62-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/948-59-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/948-57-0x00000000004010E4-mapping.dmp
-
memory/1532-73-0x00000000004010E4-mapping.dmp
-
memory/1532-79-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/1532-81-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB