Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
02/12/2022, 17:15
Static task
static1
Behavioral task
behavioral1
Sample
a9234dff8a64328461cb1f63d0402dc8b31c9f6e3cbbf51a1e677060e8403f27.exe
Resource
win7-20220812-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
a9234dff8a64328461cb1f63d0402dc8b31c9f6e3cbbf51a1e677060e8403f27.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
a9234dff8a64328461cb1f63d0402dc8b31c9f6e3cbbf51a1e677060e8403f27.exe
-
Size
156KB
-
MD5
50b9619b10bfd211b07c4c14416d0821
-
SHA1
a5d63cc14648854847612fd5935949d606906748
-
SHA256
a9234dff8a64328461cb1f63d0402dc8b31c9f6e3cbbf51a1e677060e8403f27
-
SHA512
55fe2495b7a36e66ed7558025a795b307c26a93590f0df7261fa9aaabf8c7353efba8924957f34dce3fbf3f237d8c35ddff9f7a06828d9bf744997d573eb9f17
-
SSDEEP
3072:qiFKQjNziEAphCjG8G3GbGVGBGfGuGxGWYcrf6KadE:qiMQJiEeAYcD6Kad
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" jiuuro.exe -
Executes dropped EXE 1 IoCs
pid Process 3068 jiuuro.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation a9234dff8a64328461cb1f63d0402dc8b31c9f6e3cbbf51a1e677060e8403f27.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run\ jiuuro.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jiuuro = "C:\\Users\\Admin\\jiuuro.exe" jiuuro.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3068 jiuuro.exe 3068 jiuuro.exe 3068 jiuuro.exe 3068 jiuuro.exe 3068 jiuuro.exe 3068 jiuuro.exe 3068 jiuuro.exe 3068 jiuuro.exe 3068 jiuuro.exe 3068 jiuuro.exe 3068 jiuuro.exe 3068 jiuuro.exe 3068 jiuuro.exe 3068 jiuuro.exe 3068 jiuuro.exe 3068 jiuuro.exe 3068 jiuuro.exe 3068 jiuuro.exe 3068 jiuuro.exe 3068 jiuuro.exe 3068 jiuuro.exe 3068 jiuuro.exe 3068 jiuuro.exe 3068 jiuuro.exe 3068 jiuuro.exe 3068 jiuuro.exe 3068 jiuuro.exe 3068 jiuuro.exe 3068 jiuuro.exe 3068 jiuuro.exe 3068 jiuuro.exe 3068 jiuuro.exe 3068 jiuuro.exe 3068 jiuuro.exe 3068 jiuuro.exe 3068 jiuuro.exe 3068 jiuuro.exe 3068 jiuuro.exe 3068 jiuuro.exe 3068 jiuuro.exe 3068 jiuuro.exe 3068 jiuuro.exe 3068 jiuuro.exe 3068 jiuuro.exe 3068 jiuuro.exe 3068 jiuuro.exe 3068 jiuuro.exe 3068 jiuuro.exe 3068 jiuuro.exe 3068 jiuuro.exe 3068 jiuuro.exe 3068 jiuuro.exe 3068 jiuuro.exe 3068 jiuuro.exe 3068 jiuuro.exe 3068 jiuuro.exe 3068 jiuuro.exe 3068 jiuuro.exe 3068 jiuuro.exe 3068 jiuuro.exe 3068 jiuuro.exe 3068 jiuuro.exe 3068 jiuuro.exe 3068 jiuuro.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2220 a9234dff8a64328461cb1f63d0402dc8b31c9f6e3cbbf51a1e677060e8403f27.exe 3068 jiuuro.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2220 wrote to memory of 3068 2220 a9234dff8a64328461cb1f63d0402dc8b31c9f6e3cbbf51a1e677060e8403f27.exe 80 PID 2220 wrote to memory of 3068 2220 a9234dff8a64328461cb1f63d0402dc8b31c9f6e3cbbf51a1e677060e8403f27.exe 80 PID 2220 wrote to memory of 3068 2220 a9234dff8a64328461cb1f63d0402dc8b31c9f6e3cbbf51a1e677060e8403f27.exe 80 PID 3068 wrote to memory of 2220 3068 jiuuro.exe 79 PID 3068 wrote to memory of 2220 3068 jiuuro.exe 79 PID 3068 wrote to memory of 2220 3068 jiuuro.exe 79 PID 3068 wrote to memory of 2220 3068 jiuuro.exe 79 PID 3068 wrote to memory of 2220 3068 jiuuro.exe 79 PID 3068 wrote to memory of 2220 3068 jiuuro.exe 79 PID 3068 wrote to memory of 2220 3068 jiuuro.exe 79 PID 3068 wrote to memory of 2220 3068 jiuuro.exe 79 PID 3068 wrote to memory of 2220 3068 jiuuro.exe 79 PID 3068 wrote to memory of 2220 3068 jiuuro.exe 79 PID 3068 wrote to memory of 2220 3068 jiuuro.exe 79 PID 3068 wrote to memory of 2220 3068 jiuuro.exe 79 PID 3068 wrote to memory of 2220 3068 jiuuro.exe 79 PID 3068 wrote to memory of 2220 3068 jiuuro.exe 79 PID 3068 wrote to memory of 2220 3068 jiuuro.exe 79 PID 3068 wrote to memory of 2220 3068 jiuuro.exe 79 PID 3068 wrote to memory of 2220 3068 jiuuro.exe 79 PID 3068 wrote to memory of 2220 3068 jiuuro.exe 79 PID 3068 wrote to memory of 2220 3068 jiuuro.exe 79 PID 3068 wrote to memory of 2220 3068 jiuuro.exe 79 PID 3068 wrote to memory of 2220 3068 jiuuro.exe 79 PID 3068 wrote to memory of 2220 3068 jiuuro.exe 79 PID 3068 wrote to memory of 2220 3068 jiuuro.exe 79 PID 3068 wrote to memory of 2220 3068 jiuuro.exe 79 PID 3068 wrote to memory of 2220 3068 jiuuro.exe 79 PID 3068 wrote to memory of 2220 3068 jiuuro.exe 79 PID 3068 wrote to memory of 2220 3068 jiuuro.exe 79 PID 3068 wrote to memory of 2220 3068 jiuuro.exe 79 PID 3068 wrote to memory of 2220 3068 jiuuro.exe 79 PID 3068 wrote to memory of 2220 3068 jiuuro.exe 79 PID 3068 wrote to memory of 2220 3068 jiuuro.exe 79 PID 3068 wrote to memory of 2220 3068 jiuuro.exe 79 PID 3068 wrote to memory of 2220 3068 jiuuro.exe 79 PID 3068 wrote to memory of 2220 3068 jiuuro.exe 79 PID 3068 wrote to memory of 2220 3068 jiuuro.exe 79 PID 3068 wrote to memory of 2220 3068 jiuuro.exe 79 PID 3068 wrote to memory of 2220 3068 jiuuro.exe 79 PID 3068 wrote to memory of 2220 3068 jiuuro.exe 79 PID 3068 wrote to memory of 2220 3068 jiuuro.exe 79 PID 3068 wrote to memory of 2220 3068 jiuuro.exe 79 PID 3068 wrote to memory of 2220 3068 jiuuro.exe 79 PID 3068 wrote to memory of 2220 3068 jiuuro.exe 79 PID 3068 wrote to memory of 2220 3068 jiuuro.exe 79 PID 3068 wrote to memory of 2220 3068 jiuuro.exe 79 PID 3068 wrote to memory of 2220 3068 jiuuro.exe 79 PID 3068 wrote to memory of 2220 3068 jiuuro.exe 79 PID 3068 wrote to memory of 2220 3068 jiuuro.exe 79 PID 3068 wrote to memory of 2220 3068 jiuuro.exe 79 PID 3068 wrote to memory of 2220 3068 jiuuro.exe 79 PID 3068 wrote to memory of 2220 3068 jiuuro.exe 79 PID 3068 wrote to memory of 2220 3068 jiuuro.exe 79 PID 3068 wrote to memory of 2220 3068 jiuuro.exe 79 PID 3068 wrote to memory of 2220 3068 jiuuro.exe 79 PID 3068 wrote to memory of 2220 3068 jiuuro.exe 79 PID 3068 wrote to memory of 2220 3068 jiuuro.exe 79 PID 3068 wrote to memory of 2220 3068 jiuuro.exe 79 PID 3068 wrote to memory of 2220 3068 jiuuro.exe 79 PID 3068 wrote to memory of 2220 3068 jiuuro.exe 79 PID 3068 wrote to memory of 2220 3068 jiuuro.exe 79 PID 3068 wrote to memory of 2220 3068 jiuuro.exe 79 PID 3068 wrote to memory of 2220 3068 jiuuro.exe 79
Processes
-
C:\Users\Admin\AppData\Local\Temp\a9234dff8a64328461cb1f63d0402dc8b31c9f6e3cbbf51a1e677060e8403f27.exe"C:\Users\Admin\AppData\Local\Temp\a9234dff8a64328461cb1f63d0402dc8b31c9f6e3cbbf51a1e677060e8403f27.exe"1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Users\Admin\jiuuro.exe"C:\Users\Admin\jiuuro.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3068
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
156KB
MD517b47e35950373cac20e52e1124a3065
SHA161f1e24cf0eb0ba5117abf3e980767bf72022dbf
SHA256f7f457dc81ee1ff322790dc5d52138cecabd77c46debecee3f0991c021e40317
SHA512c291757d00fdac9de1a01ed07e69f353fa63644b1c72e04bcb8eb115d90f488937d21705c4316439ca301e87ca0b7ac7f2f4c5eac0feb5d8db3e6b9f9680bf7a
-
Filesize
156KB
MD517b47e35950373cac20e52e1124a3065
SHA161f1e24cf0eb0ba5117abf3e980767bf72022dbf
SHA256f7f457dc81ee1ff322790dc5d52138cecabd77c46debecee3f0991c021e40317
SHA512c291757d00fdac9de1a01ed07e69f353fa63644b1c72e04bcb8eb115d90f488937d21705c4316439ca301e87ca0b7ac7f2f4c5eac0feb5d8db3e6b9f9680bf7a