Analysis
-
max time kernel
151s -
max time network
44s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
03/12/2022, 19:39
Static task
static1
Behavioral task
behavioral1
Sample
6bab4dcbf5bf1ae5bbef358a357113c5a64702fd19b49cd262629378b70edc62.exe
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral2
Sample
6bab4dcbf5bf1ae5bbef358a357113c5a64702fd19b49cd262629378b70edc62.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
General
-
Target
6bab4dcbf5bf1ae5bbef358a357113c5a64702fd19b49cd262629378b70edc62.exe
-
Size
80KB
-
MD5
72baa7d0ca83ccd952b7dc60afc09462
-
SHA1
70013923926b49fd18f3fb9f0020f975205637cc
-
SHA256
6bab4dcbf5bf1ae5bbef358a357113c5a64702fd19b49cd262629378b70edc62
-
SHA512
d16f9ef00728d0f95686b6f0073a942a367892495b39c94bbd081b30ebf9e85f78b183bff6e78cfcfedf77f2ae1c732cd4ec154c7b14e44383dd202d5ed5eab8
-
SSDEEP
768:FNHVPFz9ApubI3f0mq/6/Q/9NF0+LEc8af3ts0E9q+CTmR+QdwC7/K6ya0nX7+CW:Fhz1kdq2oS+Ljb3ts0E9Ieier
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" jsneq.exe -
Executes dropped EXE 1 IoCs
pid Process 1320 jsneq.exe -
Loads dropped DLL 2 IoCs
pid Process 1488 6bab4dcbf5bf1ae5bbef358a357113c5a64702fd19b49cd262629378b70edc62.exe 1488 6bab4dcbf5bf1ae5bbef358a357113c5a64702fd19b49cd262629378b70edc62.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\jsneq = "C:\\Users\\Admin\\jsneq.exe" jsneq.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ jsneq.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1320 jsneq.exe 1320 jsneq.exe 1320 jsneq.exe 1320 jsneq.exe 1320 jsneq.exe 1320 jsneq.exe 1320 jsneq.exe 1320 jsneq.exe 1320 jsneq.exe 1320 jsneq.exe 1320 jsneq.exe 1320 jsneq.exe 1320 jsneq.exe 1320 jsneq.exe 1320 jsneq.exe 1320 jsneq.exe 1320 jsneq.exe 1320 jsneq.exe 1320 jsneq.exe 1320 jsneq.exe 1320 jsneq.exe 1320 jsneq.exe 1320 jsneq.exe 1320 jsneq.exe 1320 jsneq.exe 1320 jsneq.exe 1320 jsneq.exe 1320 jsneq.exe 1320 jsneq.exe 1320 jsneq.exe 1320 jsneq.exe 1320 jsneq.exe 1320 jsneq.exe 1320 jsneq.exe 1320 jsneq.exe 1320 jsneq.exe 1320 jsneq.exe 1320 jsneq.exe 1320 jsneq.exe 1320 jsneq.exe 1320 jsneq.exe 1320 jsneq.exe 1320 jsneq.exe 1320 jsneq.exe 1320 jsneq.exe 1320 jsneq.exe 1320 jsneq.exe 1320 jsneq.exe 1320 jsneq.exe 1320 jsneq.exe 1320 jsneq.exe 1320 jsneq.exe 1320 jsneq.exe 1320 jsneq.exe 1320 jsneq.exe 1320 jsneq.exe 1320 jsneq.exe 1320 jsneq.exe 1320 jsneq.exe 1320 jsneq.exe 1320 jsneq.exe 1320 jsneq.exe 1320 jsneq.exe 1320 jsneq.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1488 6bab4dcbf5bf1ae5bbef358a357113c5a64702fd19b49cd262629378b70edc62.exe 1320 jsneq.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1488 wrote to memory of 1320 1488 6bab4dcbf5bf1ae5bbef358a357113c5a64702fd19b49cd262629378b70edc62.exe 26 PID 1488 wrote to memory of 1320 1488 6bab4dcbf5bf1ae5bbef358a357113c5a64702fd19b49cd262629378b70edc62.exe 26 PID 1488 wrote to memory of 1320 1488 6bab4dcbf5bf1ae5bbef358a357113c5a64702fd19b49cd262629378b70edc62.exe 26 PID 1488 wrote to memory of 1320 1488 6bab4dcbf5bf1ae5bbef358a357113c5a64702fd19b49cd262629378b70edc62.exe 26 PID 1320 wrote to memory of 1488 1320 jsneq.exe 25 PID 1320 wrote to memory of 1488 1320 jsneq.exe 25 PID 1320 wrote to memory of 1488 1320 jsneq.exe 25 PID 1320 wrote to memory of 1488 1320 jsneq.exe 25 PID 1320 wrote to memory of 1488 1320 jsneq.exe 25 PID 1320 wrote to memory of 1488 1320 jsneq.exe 25 PID 1320 wrote to memory of 1488 1320 jsneq.exe 25 PID 1320 wrote to memory of 1488 1320 jsneq.exe 25 PID 1320 wrote to memory of 1488 1320 jsneq.exe 25 PID 1320 wrote to memory of 1488 1320 jsneq.exe 25 PID 1320 wrote to memory of 1488 1320 jsneq.exe 25 PID 1320 wrote to memory of 1488 1320 jsneq.exe 25 PID 1320 wrote to memory of 1488 1320 jsneq.exe 25 PID 1320 wrote to memory of 1488 1320 jsneq.exe 25 PID 1320 wrote to memory of 1488 1320 jsneq.exe 25 PID 1320 wrote to memory of 1488 1320 jsneq.exe 25 PID 1320 wrote to memory of 1488 1320 jsneq.exe 25 PID 1320 wrote to memory of 1488 1320 jsneq.exe 25 PID 1320 wrote to memory of 1488 1320 jsneq.exe 25 PID 1320 wrote to memory of 1488 1320 jsneq.exe 25 PID 1320 wrote to memory of 1488 1320 jsneq.exe 25 PID 1320 wrote to memory of 1488 1320 jsneq.exe 25 PID 1320 wrote to memory of 1488 1320 jsneq.exe 25 PID 1320 wrote to memory of 1488 1320 jsneq.exe 25 PID 1320 wrote to memory of 1488 1320 jsneq.exe 25 PID 1320 wrote to memory of 1488 1320 jsneq.exe 25 PID 1320 wrote to memory of 1488 1320 jsneq.exe 25 PID 1320 wrote to memory of 1488 1320 jsneq.exe 25 PID 1320 wrote to memory of 1488 1320 jsneq.exe 25 PID 1320 wrote to memory of 1488 1320 jsneq.exe 25 PID 1320 wrote to memory of 1488 1320 jsneq.exe 25 PID 1320 wrote to memory of 1488 1320 jsneq.exe 25 PID 1320 wrote to memory of 1488 1320 jsneq.exe 25 PID 1320 wrote to memory of 1488 1320 jsneq.exe 25 PID 1320 wrote to memory of 1488 1320 jsneq.exe 25 PID 1320 wrote to memory of 1488 1320 jsneq.exe 25 PID 1320 wrote to memory of 1488 1320 jsneq.exe 25 PID 1320 wrote to memory of 1488 1320 jsneq.exe 25 PID 1320 wrote to memory of 1488 1320 jsneq.exe 25 PID 1320 wrote to memory of 1488 1320 jsneq.exe 25 PID 1320 wrote to memory of 1488 1320 jsneq.exe 25 PID 1320 wrote to memory of 1488 1320 jsneq.exe 25 PID 1320 wrote to memory of 1488 1320 jsneq.exe 25 PID 1320 wrote to memory of 1488 1320 jsneq.exe 25 PID 1320 wrote to memory of 1488 1320 jsneq.exe 25 PID 1320 wrote to memory of 1488 1320 jsneq.exe 25 PID 1320 wrote to memory of 1488 1320 jsneq.exe 25 PID 1320 wrote to memory of 1488 1320 jsneq.exe 25 PID 1320 wrote to memory of 1488 1320 jsneq.exe 25 PID 1320 wrote to memory of 1488 1320 jsneq.exe 25 PID 1320 wrote to memory of 1488 1320 jsneq.exe 25 PID 1320 wrote to memory of 1488 1320 jsneq.exe 25 PID 1320 wrote to memory of 1488 1320 jsneq.exe 25 PID 1320 wrote to memory of 1488 1320 jsneq.exe 25 PID 1320 wrote to memory of 1488 1320 jsneq.exe 25 PID 1320 wrote to memory of 1488 1320 jsneq.exe 25 PID 1320 wrote to memory of 1488 1320 jsneq.exe 25 PID 1320 wrote to memory of 1488 1320 jsneq.exe 25 PID 1320 wrote to memory of 1488 1320 jsneq.exe 25 PID 1320 wrote to memory of 1488 1320 jsneq.exe 25
Processes
-
C:\Users\Admin\AppData\Local\Temp\6bab4dcbf5bf1ae5bbef358a357113c5a64702fd19b49cd262629378b70edc62.exe"C:\Users\Admin\AppData\Local\Temp\6bab4dcbf5bf1ae5bbef358a357113c5a64702fd19b49cd262629378b70edc62.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Users\Admin\jsneq.exe"C:\Users\Admin\jsneq.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1320
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
80KB
MD57151663a7404b9bbbffe7c78d86f51dd
SHA1872b03e9ab17e6aeacd30fca8aeadb7b00e72c57
SHA256d07da9348cde02e3aa950852b0daafa5d94bfe0620c09f30420fdcd4e541ed3d
SHA512eceb5578bb8d9019ad84eebd662c3ced5d67951275637b143a657d2a50562b2e4b60c7aec89da863177b9984b4cbc6b8460b7adde956e0ba8f393212731502cf
-
Filesize
80KB
MD57151663a7404b9bbbffe7c78d86f51dd
SHA1872b03e9ab17e6aeacd30fca8aeadb7b00e72c57
SHA256d07da9348cde02e3aa950852b0daafa5d94bfe0620c09f30420fdcd4e541ed3d
SHA512eceb5578bb8d9019ad84eebd662c3ced5d67951275637b143a657d2a50562b2e4b60c7aec89da863177b9984b4cbc6b8460b7adde956e0ba8f393212731502cf
-
Filesize
80KB
MD57151663a7404b9bbbffe7c78d86f51dd
SHA1872b03e9ab17e6aeacd30fca8aeadb7b00e72c57
SHA256d07da9348cde02e3aa950852b0daafa5d94bfe0620c09f30420fdcd4e541ed3d
SHA512eceb5578bb8d9019ad84eebd662c3ced5d67951275637b143a657d2a50562b2e4b60c7aec89da863177b9984b4cbc6b8460b7adde956e0ba8f393212731502cf
-
Filesize
80KB
MD57151663a7404b9bbbffe7c78d86f51dd
SHA1872b03e9ab17e6aeacd30fca8aeadb7b00e72c57
SHA256d07da9348cde02e3aa950852b0daafa5d94bfe0620c09f30420fdcd4e541ed3d
SHA512eceb5578bb8d9019ad84eebd662c3ced5d67951275637b143a657d2a50562b2e4b60c7aec89da863177b9984b4cbc6b8460b7adde956e0ba8f393212731502cf