3eb6246ec8323313ba907fe1af668ed90ccba9e08185d8dfcccc7e5f5d04d4ca

General

Target

3eb6246ec8323313ba907fe1af668ed90ccba9e08185d8dfcccc7e5f5d04d4ca.exe
Size

260KB
MD5

587b62c75a5e59edcc4f453bbdcc7060
SHA1

b8a0cde96ed38eddf2af02c1bbc82c1a6a97afee
SHA256

3eb6246ec8323313ba907fe1af668ed90ccba9e08185d8dfcccc7e5f5d04d4ca
SHA512

94f86aab5e91eac68d461413dee0785ad3d46a04221c97e075396aa73eeefefda951208f3aefa38b0c2718ae6405bafb123a686d49da0635dd9f8da5e9470b28
SSDEEP

6144:hxUaKrjOsVnJi8Z2W7U/qmpHd68KW5/D6qurNmKzksc:hmqCJb0rsc

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

3eb6246ec8323313ba907fe1af668ed90ccba9e08185d8dfcccc7e5f5d04d4ca.exejeiole.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	3eb6246ec8323313ba907fe1af668ed90ccba9e08185d8dfcccc7e5f5d04d4ca.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	jeiole.exe

Executes dropped EXE 1 IoCs

Processes:

jeiole.exe

pid process

2168 jeiole.exe

pid	process
2168	jeiole.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

3eb6246ec8323313ba907fe1af668ed90ccba9e08185d8dfcccc7e5f5d04d4ca.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	3eb6246ec8323313ba907fe1af668ed90ccba9e08185d8dfcccc7e5f5d04d4ca.exe

Adds Run key to start application 2 TTPs 55 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

jeiole.exe3eb6246ec8323313ba907fe1af668ed90ccba9e08185d8dfcccc7e5f5d04d4ca.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jeiole = "C:\\Users\\Admin\\jeiole.exe /l"	jeiole.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jeiole = "C:\\Users\\Admin\\jeiole.exe /w"	jeiole.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jeiole = "C:\\Users\\Admin\\jeiole.exe /s"	jeiole.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jeiole = "C:\\Users\\Admin\\jeiole.exe /S"	jeiole.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jeiole = "C:\\Users\\Admin\\jeiole.exe /o"	jeiole.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jeiole = "C:\\Users\\Admin\\jeiole.exe /P"	jeiole.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jeiole = "C:\\Users\\Admin\\jeiole.exe /h"	jeiole.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jeiole = "C:\\Users\\Admin\\jeiole.exe /r"	jeiole.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jeiole = "C:\\Users\\Admin\\jeiole.exe /v"	jeiole.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jeiole = "C:\\Users\\Admin\\jeiole.exe /e"	jeiole.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jeiole = "C:\\Users\\Admin\\jeiole.exe /Q"	jeiole.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jeiole = "C:\\Users\\Admin\\jeiole.exe /Z"	jeiole.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jeiole = "C:\\Users\\Admin\\jeiole.exe /c"	jeiole.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jeiole = "C:\\Users\\Admin\\jeiole.exe /f"	jeiole.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run\	jeiole.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jeiole = "C:\\Users\\Admin\\jeiole.exe /J"	jeiole.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jeiole = "C:\\Users\\Admin\\jeiole.exe /z"	jeiole.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jeiole = "C:\\Users\\Admin\\jeiole.exe /L"	jeiole.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jeiole = "C:\\Users\\Admin\\jeiole.exe /u"	jeiole.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jeiole = "C:\\Users\\Admin\\jeiole.exe /D"	jeiole.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jeiole = "C:\\Users\\Admin\\jeiole.exe /b"	jeiole.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jeiole = "C:\\Users\\Admin\\jeiole.exe /H"	jeiole.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jeiole = "C:\\Users\\Admin\\jeiole.exe /t"	jeiole.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jeiole = "C:\\Users\\Admin\\jeiole.exe /Y"	jeiole.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jeiole = "C:\\Users\\Admin\\jeiole.exe /N"	jeiole.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jeiole = "C:\\Users\\Admin\\jeiole.exe /X"	jeiole.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jeiole = "C:\\Users\\Admin\\jeiole.exe /T"	jeiole.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jeiole = "C:\\Users\\Admin\\jeiole.exe /W"	jeiole.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jeiole = "C:\\Users\\Admin\\jeiole.exe /i"	jeiole.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jeiole = "C:\\Users\\Admin\\jeiole.exe /O"	jeiole.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jeiole = "C:\\Users\\Admin\\jeiole.exe /R"	jeiole.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jeiole = "C:\\Users\\Admin\\jeiole.exe /q"	jeiole.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jeiole = "C:\\Users\\Admin\\jeiole.exe /K"	jeiole.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jeiole = "C:\\Users\\Admin\\jeiole.exe /M"	jeiole.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jeiole = "C:\\Users\\Admin\\jeiole.exe /A"	jeiole.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jeiole = "C:\\Users\\Admin\\jeiole.exe /U"	jeiole.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jeiole = "C:\\Users\\Admin\\jeiole.exe /V"	jeiole.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jeiole = "C:\\Users\\Admin\\jeiole.exe /B"	jeiole.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jeiole = "C:\\Users\\Admin\\jeiole.exe /x"	jeiole.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jeiole = "C:\\Users\\Admin\\jeiole.exe /g"	jeiole.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jeiole = "C:\\Users\\Admin\\jeiole.exe /F"	jeiole.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jeiole = "C:\\Users\\Admin\\jeiole.exe /G"	3eb6246ec8323313ba907fe1af668ed90ccba9e08185d8dfcccc7e5f5d04d4ca.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jeiole = "C:\\Users\\Admin\\jeiole.exe /k"	jeiole.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run\	3eb6246ec8323313ba907fe1af668ed90ccba9e08185d8dfcccc7e5f5d04d4ca.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jeiole = "C:\\Users\\Admin\\jeiole.exe /a"	jeiole.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jeiole = "C:\\Users\\Admin\\jeiole.exe /E"	jeiole.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jeiole = "C:\\Users\\Admin\\jeiole.exe /j"	jeiole.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jeiole = "C:\\Users\\Admin\\jeiole.exe /d"	jeiole.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jeiole = "C:\\Users\\Admin\\jeiole.exe /m"	jeiole.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jeiole = "C:\\Users\\Admin\\jeiole.exe /p"	jeiole.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jeiole = "C:\\Users\\Admin\\jeiole.exe /I"	jeiole.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jeiole = "C:\\Users\\Admin\\jeiole.exe /G"	jeiole.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jeiole = "C:\\Users\\Admin\\jeiole.exe /n"	jeiole.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jeiole = "C:\\Users\\Admin\\jeiole.exe /y"	jeiole.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jeiole = "C:\\Users\\Admin\\jeiole.exe /C"	jeiole.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

3eb6246ec8323313ba907fe1af668ed90ccba9e08185d8dfcccc7e5f5d04d4ca.exejeiole.exe

pid	process
4848	3eb6246ec8323313ba907fe1af668ed90ccba9e08185d8dfcccc7e5f5d04d4ca.exe
4848	3eb6246ec8323313ba907fe1af668ed90ccba9e08185d8dfcccc7e5f5d04d4ca.exe
2168	jeiole.exe
2168	jeiole.exe
2168	jeiole.exe
2168	jeiole.exe
2168	jeiole.exe
2168	jeiole.exe
2168	jeiole.exe
2168	jeiole.exe
2168	jeiole.exe
2168	jeiole.exe
2168	jeiole.exe
2168	jeiole.exe
2168	jeiole.exe
2168	jeiole.exe
2168	jeiole.exe
2168	jeiole.exe
2168	jeiole.exe
2168	jeiole.exe
2168	jeiole.exe
2168	jeiole.exe
2168	jeiole.exe
2168	jeiole.exe
2168	jeiole.exe
2168	jeiole.exe
2168	jeiole.exe
2168	jeiole.exe
2168	jeiole.exe
2168	jeiole.exe
2168	jeiole.exe
2168	jeiole.exe
2168	jeiole.exe
2168	jeiole.exe
2168	jeiole.exe
2168	jeiole.exe
2168	jeiole.exe
2168	jeiole.exe
2168	jeiole.exe
2168	jeiole.exe
2168	jeiole.exe
2168	jeiole.exe
2168	jeiole.exe
2168	jeiole.exe
2168	jeiole.exe
2168	jeiole.exe
2168	jeiole.exe
2168	jeiole.exe
2168	jeiole.exe
2168	jeiole.exe
2168	jeiole.exe
2168	jeiole.exe
2168	jeiole.exe
2168	jeiole.exe
2168	jeiole.exe
2168	jeiole.exe
2168	jeiole.exe
2168	jeiole.exe
2168	jeiole.exe
2168	jeiole.exe
2168	jeiole.exe
2168	jeiole.exe
2168	jeiole.exe
2168	jeiole.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

3eb6246ec8323313ba907fe1af668ed90ccba9e08185d8dfcccc7e5f5d04d4ca.exejeiole.exe

pid process

4848 3eb6246ec8323313ba907fe1af668ed90ccba9e08185d8dfcccc7e5f5d04d4ca.exe
2168 jeiole.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

3eb6246ec8323313ba907fe1af668ed90ccba9e08185d8dfcccc7e5f5d04d4ca.exe

description	pid	process	target process
PID 4848 wrote to memory of 2168	4848	3eb6246ec8323313ba907fe1af668ed90ccba9e08185d8dfcccc7e5f5d04d4ca.exe	jeiole.exe
PID 4848 wrote to memory of 2168	4848	3eb6246ec8323313ba907fe1af668ed90ccba9e08185d8dfcccc7e5f5d04d4ca.exe	jeiole.exe
PID 4848 wrote to memory of 2168	4848	3eb6246ec8323313ba907fe1af668ed90ccba9e08185d8dfcccc7e5f5d04d4ca.exe	jeiole.exe

C:\Users\Admin\AppData\Local\Temp\3eb6246ec8323313ba907fe1af668ed90ccba9e08185d8dfcccc7e5f5d04d4ca.exe
"C:\Users\Admin\AppData\Local\Temp\3eb6246ec8323313ba907fe1af668ed90ccba9e08185d8dfcccc7e5f5d04d4ca.exe"
1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4848

C:\Users\Admin\jeiole.exe
"C:\Users\Admin\jeiole.exe"
2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2168

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1

T1158

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

1

T1158

Modify Registry

2

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\jeiole.exe
Filesize
260KB

MD5
32f74fc361b3bd6c964277d6ab3ff28f

SHA1
f1e2c2ad9b7d41df3468eed3d2e8db8e40eeb075

SHA256
6278d430382e471f91018b0968a4264b441440da0d55edda863d0886a2a61f86

SHA512
1a12cd5b57d6104364809c38a8605108fd789074f30fe26db7b1d31ca14745d91b48159b268afcc32870114ea4242bff3913daa67836f599302fad966d94d8f1

Download Submit
C:\Users\Admin\jeiole.exe
Filesize
260KB

MD5
32f74fc361b3bd6c964277d6ab3ff28f

SHA1
f1e2c2ad9b7d41df3468eed3d2e8db8e40eeb075

SHA256
6278d430382e471f91018b0968a4264b441440da0d55edda863d0886a2a61f86

SHA512
1a12cd5b57d6104364809c38a8605108fd789074f30fe26db7b1d31ca14745d91b48159b268afcc32870114ea4242bff3913daa67836f599302fad966d94d8f1

Download Submit
memory/2168-134-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads