3f254afebac05901cbf13abf469b87a7dad28873c7f4ed65921d153fade92892

Analysis

max time kernel
134s
max time network
137s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
26-11-2022 19:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3f254afebac05901cbf13abf469b87a7dad28873c7f4ed65921d153fade92892.exe
Size

597KB
MD5

b7cd1c29f4a7f8bbc1b146fee208219f
SHA1

4416ab99b383fbf28516c0476285391f033c305b
SHA256

3f254afebac05901cbf13abf469b87a7dad28873c7f4ed65921d153fade92892
SHA512

02800f466f4a4baaecbac85a7e3a154cd102ee3b872b3f511a703a9c41f83cc1ddac90764a15053e90c29c25663758158fd64cebe9e8c1bb462331f041a65014
SSDEEP

12288:Jat0EAH49n8Bu0s4q8xGc55FnU1zRu14+2J1WJeJ+zHn1cS5eS7lU2HzFqz7UEh:4t24r4qU5M1zx/WJSOn1c3OXzFqkEh

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

Processes:

jordan.exejordan.exe

pid process

1224 jordan.exe
1692 jordan.exe

pid	process
1224	jordan.exe
1692	jordan.exe

Loads dropped DLL 5 IoCs

Processes:

3f254afebac05901cbf13abf469b87a7dad28873c7f4ed65921d153fade92892.exejordan.exe

pid	process
1528	3f254afebac05901cbf13abf469b87a7dad28873c7f4ed65921d153fade92892.exe
1528	3f254afebac05901cbf13abf469b87a7dad28873c7f4ed65921d153fade92892.exe
1528	3f254afebac05901cbf13abf469b87a7dad28873c7f4ed65921d153fade92892.exe
1528	3f254afebac05901cbf13abf469b87a7dad28873c7f4ed65921d153fade92892.exe
1224	jordan.exe

AutoIT Executable 8 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
\Users\Admin\rAx89Jl\jordan.exe	autoit_exe
\Users\Admin\rAx89Jl\jordan.exe	autoit_exe
\Users\Admin\rAx89Jl\jordan.exe	autoit_exe
\Users\Admin\rAx89Jl\jordan.exe	autoit_exe
C:\Users\Admin\rAx89Jl\jordan.exe	autoit_exe
C:\Users\Admin\rAx89Jl\jordan.exe	autoit_exe
\Users\Admin\rAx89Jl\jordan.exe	autoit_exe
C:\Users\Admin\rAx89Jl\jordan.exe	autoit_exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

jordan.exe

description pid process target process

PID 1224 set thread context of 1692 1224 jordan.exe jordan.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	pid	process	target process
PID 1224 set thread context of 1692	1224	jordan.exe	jordan.exe

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{810780F1-6E49-11ED-9681-FAF5FAF3A79A} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 2034c45e5602d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376314727"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f36729a017f7f64db3423749cb3a4efa000000000200000000001066000000010000200000002a239839a8ff6a7b5bbb331962930bfd1d439d590f62bfa42126aa1f80830033000000000e80000000020000200000005358c32b396c142c10184af3b1000fe7aab6e9cda7119dadfbf82c6e9d305e0c20000000b22e54e8b793804168947eba5788bb14cb010f3e38b1b7b45370d0c076611fab40000000b0161725142363f1ed9179a6515680f33d05e08c3af32eeabdf1491d9a7cf0922987bfa61dee70bd72c8108f1364430917ea514a2ac343c9148f982e37623e96	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f36729a017f7f64db3423749cb3a4efa00000000020000000000106600000001000020000000769c41df4f5c321f064a7526c5e3edd7a1039b6ca9d8652d37d33c3f6a07bad1000000000e80000000020000200000008d1d80015ef2c0a82abd6a3490f968c817540db75d6105db56aa467b432dd31f900000003e63be7ad22f92f09c32552829d8aa52605a57837a764f3510184daec5c4c76baa1cb746a80d11ff710403d2ba53ea36dacbfe36833cbda6f0fcc5fa7041b5df4e49ebf3c6731f7ccbb762014371e33bde3be25ef741cc743ac9dc0203324efcb2d984471afcef573749451b5ef16712b56080583fb3b7a6b270270f502057710d204f939b5a365f2ceffd26eec38e6f40000000010d09adceb0fe39774b3c2cf4d93d247a607a047e90a2a3d9232bc9bc2186fc4258eaff33f60235e30e4c09704eab385490fa18aecac40bfe321a63204266db	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

jordan.exe

pid process

1224 jordan.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

860 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

860 iexplore.exe
860 iexplore.exe
1396 IEXPLORE.EXE
1396 IEXPLORE.EXE
1396 IEXPLORE.EXE
1396 IEXPLORE.EXE

pid	process
1224	jordan.exe

pid	process
860	iexplore.exe

pid	process
860	iexplore.exe
860	iexplore.exe
1396	IEXPLORE.EXE
1396	IEXPLORE.EXE
1396	IEXPLORE.EXE
1396	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 30 IoCs

Processes:

3f254afebac05901cbf13abf469b87a7dad28873c7f4ed65921d153fade92892.exejordan.exejordan.exeiexplore.exe

description	pid	process	target process
PID 1528 wrote to memory of 1224	1528	3f254afebac05901cbf13abf469b87a7dad28873c7f4ed65921d153fade92892.exe	jordan.exe
PID 1528 wrote to memory of 1224	1528	3f254afebac05901cbf13abf469b87a7dad28873c7f4ed65921d153fade92892.exe	jordan.exe
PID 1528 wrote to memory of 1224	1528	3f254afebac05901cbf13abf469b87a7dad28873c7f4ed65921d153fade92892.exe	jordan.exe
PID 1528 wrote to memory of 1224	1528	3f254afebac05901cbf13abf469b87a7dad28873c7f4ed65921d153fade92892.exe	jordan.exe
PID 1528 wrote to memory of 1224	1528	3f254afebac05901cbf13abf469b87a7dad28873c7f4ed65921d153fade92892.exe	jordan.exe
PID 1528 wrote to memory of 1224	1528	3f254afebac05901cbf13abf469b87a7dad28873c7f4ed65921d153fade92892.exe	jordan.exe
PID 1528 wrote to memory of 1224	1528	3f254afebac05901cbf13abf469b87a7dad28873c7f4ed65921d153fade92892.exe	jordan.exe
PID 1224 wrote to memory of 1692	1224	jordan.exe	jordan.exe
PID 1224 wrote to memory of 1692	1224	jordan.exe	jordan.exe
PID 1224 wrote to memory of 1692	1224	jordan.exe	jordan.exe
PID 1224 wrote to memory of 1692	1224	jordan.exe	jordan.exe
PID 1224 wrote to memory of 1692	1224	jordan.exe	jordan.exe
PID 1224 wrote to memory of 1692	1224	jordan.exe	jordan.exe
PID 1224 wrote to memory of 1692	1224	jordan.exe	jordan.exe
PID 1224 wrote to memory of 1692	1224	jordan.exe	jordan.exe
PID 1224 wrote to memory of 1692	1224	jordan.exe	jordan.exe
PID 1224 wrote to memory of 1692	1224	jordan.exe	jordan.exe
PID 1224 wrote to memory of 1692	1224	jordan.exe	jordan.exe
PID 1224 wrote to memory of 1692	1224	jordan.exe	jordan.exe
PID 1692 wrote to memory of 860	1692	jordan.exe	iexplore.exe
PID 1692 wrote to memory of 860	1692	jordan.exe	iexplore.exe
PID 1692 wrote to memory of 860	1692	jordan.exe	iexplore.exe
PID 1692 wrote to memory of 860	1692	jordan.exe	iexplore.exe
PID 860 wrote to memory of 1396	860	iexplore.exe	IEXPLORE.EXE
PID 860 wrote to memory of 1396	860	iexplore.exe	IEXPLORE.EXE
PID 860 wrote to memory of 1396	860	iexplore.exe	IEXPLORE.EXE
PID 860 wrote to memory of 1396	860	iexplore.exe	IEXPLORE.EXE
PID 860 wrote to memory of 1396	860	iexplore.exe	IEXPLORE.EXE
PID 860 wrote to memory of 1396	860	iexplore.exe	IEXPLORE.EXE
PID 860 wrote to memory of 1396	860	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\3f254afebac05901cbf13abf469b87a7dad28873c7f4ed65921d153fade92892.exe
"C:\Users\Admin\AppData\Local\Temp\3f254afebac05901cbf13abf469b87a7dad28873c7f4ed65921d153fade92892.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1528

C:\Users\Admin\rAx89Jl\jordan.exe
"C:\Users\Admin\rAx89Jl\jordan.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1224

C:\Users\Admin\rAx89Jl\jordan.exe
"C:\Users\Admin\rAx89Jl\jordan.exe"
3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1692

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=jordan.exe&platform=0009&osver=5&isServer=0&shimver=4.0.30319.0
4⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:860

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:860 CREDAT:275457 /prefetch:2
5⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1396

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\R88AVPER.txt
Filesize
608B

MD5
3f4d0edf608e6824053988544c3bab5f

SHA1
3cc702bbd2063d5674e5cdb246f7780886183e5e

SHA256
4531c52224d5bb52dd8f503435bba9c7425b1944689aa59e6f436245ec03d685

SHA512
ca1f210c01d366882ed70054776d8517720cb4bb5a34ba4834a8f24671ec7ab14334817eaabd7c0fe7095bf59a9e8e25529e647e5281b1060b3754ee479b83f5

Download Submit
C:\Users\Admin\rAx89Jl\jordan.exe
Filesize
828KB

MD5
afa681ce030fef9af07285c9f651d899

SHA1
3a1e638ff0afb1ff1d0a6a0a0c687489f022f178

SHA256
5f2e75ddc668a9eaba07b623af266df193bcb9e21fb511a3f54c017b2eb67504

SHA512
6653f011dafe602994d246556d9f0bf2f60919ae0c7072b9513ce8499ca0cb93e3874104f546716dce5213645db0f474deb158a237aeab3d6df78908f54a8406

Download Submit
C:\Users\Admin\rAx89Jl\jordan.exe
Filesize
828KB

MD5
afa681ce030fef9af07285c9f651d899

SHA1
3a1e638ff0afb1ff1d0a6a0a0c687489f022f178

SHA256
5f2e75ddc668a9eaba07b623af266df193bcb9e21fb511a3f54c017b2eb67504

SHA512
6653f011dafe602994d246556d9f0bf2f60919ae0c7072b9513ce8499ca0cb93e3874104f546716dce5213645db0f474deb158a237aeab3d6df78908f54a8406

Download Submit
C:\Users\Admin\rAx89Jl\jordan.exe
Filesize
828KB

MD5
afa681ce030fef9af07285c9f651d899

SHA1
3a1e638ff0afb1ff1d0a6a0a0c687489f022f178

SHA256
5f2e75ddc668a9eaba07b623af266df193bcb9e21fb511a3f54c017b2eb67504

SHA512
6653f011dafe602994d246556d9f0bf2f60919ae0c7072b9513ce8499ca0cb93e3874104f546716dce5213645db0f474deb158a237aeab3d6df78908f54a8406

Download Submit
\Users\Admin\rAx89Jl\jordan.exe
Filesize
828KB

MD5
afa681ce030fef9af07285c9f651d899

SHA1
3a1e638ff0afb1ff1d0a6a0a0c687489f022f178

SHA256
5f2e75ddc668a9eaba07b623af266df193bcb9e21fb511a3f54c017b2eb67504

SHA512
6653f011dafe602994d246556d9f0bf2f60919ae0c7072b9513ce8499ca0cb93e3874104f546716dce5213645db0f474deb158a237aeab3d6df78908f54a8406

Download Submit
\Users\Admin\rAx89Jl\jordan.exe
Filesize
828KB

MD5
afa681ce030fef9af07285c9f651d899

SHA1
3a1e638ff0afb1ff1d0a6a0a0c687489f022f178

SHA256
5f2e75ddc668a9eaba07b623af266df193bcb9e21fb511a3f54c017b2eb67504

SHA512
6653f011dafe602994d246556d9f0bf2f60919ae0c7072b9513ce8499ca0cb93e3874104f546716dce5213645db0f474deb158a237aeab3d6df78908f54a8406

Download Submit
\Users\Admin\rAx89Jl\jordan.exe
Filesize
828KB

MD5
afa681ce030fef9af07285c9f651d899

SHA1
3a1e638ff0afb1ff1d0a6a0a0c687489f022f178

SHA256
5f2e75ddc668a9eaba07b623af266df193bcb9e21fb511a3f54c017b2eb67504

SHA512
6653f011dafe602994d246556d9f0bf2f60919ae0c7072b9513ce8499ca0cb93e3874104f546716dce5213645db0f474deb158a237aeab3d6df78908f54a8406

Download Submit
\Users\Admin\rAx89Jl\jordan.exe
Filesize
828KB

MD5
afa681ce030fef9af07285c9f651d899

SHA1
3a1e638ff0afb1ff1d0a6a0a0c687489f022f178

SHA256
5f2e75ddc668a9eaba07b623af266df193bcb9e21fb511a3f54c017b2eb67504

SHA512
6653f011dafe602994d246556d9f0bf2f60919ae0c7072b9513ce8499ca0cb93e3874104f546716dce5213645db0f474deb158a237aeab3d6df78908f54a8406

Download Submit
\Users\Admin\rAx89Jl\jordan.exe
Filesize
828KB

MD5
afa681ce030fef9af07285c9f651d899

SHA1
3a1e638ff0afb1ff1d0a6a0a0c687489f022f178

SHA256
5f2e75ddc668a9eaba07b623af266df193bcb9e21fb511a3f54c017b2eb67504

SHA512
6653f011dafe602994d246556d9f0bf2f60919ae0c7072b9513ce8499ca0cb93e3874104f546716dce5213645db0f474deb158a237aeab3d6df78908f54a8406

Download Submit
memory/1224-59-0x0000000000000000-mapping.dmp

Download
memory/1528-54-0x0000000075021000-0x0000000075023000-memory.dmp

Filesize
8KB

Download
memory/1692-68-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1692-67-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1692-65-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1692-64-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1692-69-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1692-70-0x000000000040C50E-mapping.dmp

Download
memory/1692-74-0x0000000000402000-0x000000000040C600-memory.dmp

Filesize
41KB

Download
memory/1692-73-0x0000000000402000-0x000000000040C600-memory.dmp

Filesize
41KB

Download