a0430ed68d4e0b5218cff297976d82849c2c2dc579f31ea7551f815336d4871e

Analysis

max time kernel
151s
max time network
197s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
04-12-2022 11:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a0430ed68d4e0b5218cff297976d82849c2c2dc579f31ea7551f815336d4871e.exe
Size

496KB
MD5

240e040b8fadcb7e1a637b1c8a8c90df
SHA1

240e611b891b010a1c48bd046596410d010e96f6
SHA256

a0430ed68d4e0b5218cff297976d82849c2c2dc579f31ea7551f815336d4871e
SHA512

de99b2bf1024d964cebae7b375fe17440bd99874be6c4e2d4438408644d8fd34022bedd8babb756a651ebd277e607faa260314c2b04f93ccae399df3b64b6e15
SSDEEP

12288:/pVMEfwlfHhv3P3UAOTBz3y+KWos4xSbZDnwsLGk+A8t7:X5fwlfHhffUAAIbBs4xkZrLl+p7

Score

10^/10

evasion persistence upx

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 8 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\a0430ed68d4e0b5218cff297976d82849c2c2dc579f31ea7551f815336d4871e.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\a0430ed68d4e0b5218cff297976d82849c2c2dc579f31ea7551f815336d4871e.exe:*:Enabled:Windows Messanger"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\jinx.exe = "C:\\Users\\Admin\\AppData\\Roaming\\jinx.exe:*:Enabled:Windows Messanger"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run	a0430ed68d4e0b5218cff297976d82849c2c2dc579f31ea7551f815336d4871e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\rtyu = "C:\\Users\\Admin\\AppData\\Roaming\\jinx.exe"	a0430ed68d4e0b5218cff297976d82849c2c2dc579f31ea7551f815336d4871e.exe

Executes dropped EXE 1 IoCs

pid	Process
1168	tmpopen.exe

Modifies Installed Components in the registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{BDE8D4CA-A88D-A354-CFAD-6C9FE3B4EFFF}	a0430ed68d4e0b5218cff297976d82849c2c2dc579f31ea7551f815336d4871e.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Active Setup\Installed Components\{BDE8D4CA-A88D-A354-CFAD-6C9FE3B4EFFF}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\jinx.exe"	a0430ed68d4e0b5218cff297976d82849c2c2dc579f31ea7551f815336d4871e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{BDE8D4CA-A88D-A354-CFAD-6C9FE3B4EFFF}	a0430ed68d4e0b5218cff297976d82849c2c2dc579f31ea7551f815336d4871e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{BDE8D4CA-A88D-A354-CFAD-6C9FE3B4EFFF}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\jinx.exe"	a0430ed68d4e0b5218cff297976d82849c2c2dc579f31ea7551f815336d4871e.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000b0000000122ef-57.dat	upx
behavioral1/files/0x000b0000000122ef-58.dat	upx
behavioral1/files/0x000b0000000122ef-60.dat	upx
behavioral1/memory/1168-76-0x0000000000400000-0x000000000040F000-memory.dmp	upx

Loads dropped DLL 2 IoCs

pid	Process
1616	a0430ed68d4e0b5218cff297976d82849c2c2dc579f31ea7551f815336d4871e.exe
1616	a0430ed68d4e0b5218cff297976d82849c2c2dc579f31ea7551f815336d4871e.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	a0430ed68d4e0b5218cff297976d82849c2c2dc579f31ea7551f815336d4871e.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\rtyu = "C:\\Users\\Admin\\AppData\\Roaming\\jinx.exe"	a0430ed68d4e0b5218cff297976d82849c2c2dc579f31ea7551f815336d4871e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	a0430ed68d4e0b5218cff297976d82849c2c2dc579f31ea7551f815336d4871e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\rtyu = "C:\\Users\\Admin\\AppData\\Roaming\\jinx.exe"	a0430ed68d4e0b5218cff297976d82849c2c2dc579f31ea7551f815336d4871e.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1616 set thread context of 308	1616	a0430ed68d4e0b5218cff297976d82849c2c2dc579f31ea7551f815336d4871e.exe	29

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry key 1 TTPs 4 IoCs

Modify Registry

T1112

pid	Process
1528	reg.exe
1780	reg.exe
892	reg.exe
1536	reg.exe

Suspicious use of AdjustPrivilegeToken 35 IoCs

description	pid	Process
Token: 1	308	a0430ed68d4e0b5218cff297976d82849c2c2dc579f31ea7551f815336d4871e.exe
Token: SeCreateTokenPrivilege	308	a0430ed68d4e0b5218cff297976d82849c2c2dc579f31ea7551f815336d4871e.exe
Token: SeAssignPrimaryTokenPrivilege	308	a0430ed68d4e0b5218cff297976d82849c2c2dc579f31ea7551f815336d4871e.exe
Token: SeLockMemoryPrivilege	308	a0430ed68d4e0b5218cff297976d82849c2c2dc579f31ea7551f815336d4871e.exe
Token: SeIncreaseQuotaPrivilege	308	a0430ed68d4e0b5218cff297976d82849c2c2dc579f31ea7551f815336d4871e.exe
Token: SeMachineAccountPrivilege	308	a0430ed68d4e0b5218cff297976d82849c2c2dc579f31ea7551f815336d4871e.exe
Token: SeTcbPrivilege	308	a0430ed68d4e0b5218cff297976d82849c2c2dc579f31ea7551f815336d4871e.exe
Token: SeSecurityPrivilege	308	a0430ed68d4e0b5218cff297976d82849c2c2dc579f31ea7551f815336d4871e.exe
Token: SeTakeOwnershipPrivilege	308	a0430ed68d4e0b5218cff297976d82849c2c2dc579f31ea7551f815336d4871e.exe
Token: SeLoadDriverPrivilege	308	a0430ed68d4e0b5218cff297976d82849c2c2dc579f31ea7551f815336d4871e.exe
Token: SeSystemProfilePrivilege	308	a0430ed68d4e0b5218cff297976d82849c2c2dc579f31ea7551f815336d4871e.exe
Token: SeSystemtimePrivilege	308	a0430ed68d4e0b5218cff297976d82849c2c2dc579f31ea7551f815336d4871e.exe
Token: SeProfSingleProcessPrivilege	308	a0430ed68d4e0b5218cff297976d82849c2c2dc579f31ea7551f815336d4871e.exe
Token: SeIncBasePriorityPrivilege	308	a0430ed68d4e0b5218cff297976d82849c2c2dc579f31ea7551f815336d4871e.exe
Token: SeCreatePagefilePrivilege	308	a0430ed68d4e0b5218cff297976d82849c2c2dc579f31ea7551f815336d4871e.exe
Token: SeCreatePermanentPrivilege	308	a0430ed68d4e0b5218cff297976d82849c2c2dc579f31ea7551f815336d4871e.exe
Token: SeBackupPrivilege	308	a0430ed68d4e0b5218cff297976d82849c2c2dc579f31ea7551f815336d4871e.exe
Token: SeRestorePrivilege	308	a0430ed68d4e0b5218cff297976d82849c2c2dc579f31ea7551f815336d4871e.exe
Token: SeShutdownPrivilege	308	a0430ed68d4e0b5218cff297976d82849c2c2dc579f31ea7551f815336d4871e.exe
Token: SeDebugPrivilege	308	a0430ed68d4e0b5218cff297976d82849c2c2dc579f31ea7551f815336d4871e.exe
Token: SeAuditPrivilege	308	a0430ed68d4e0b5218cff297976d82849c2c2dc579f31ea7551f815336d4871e.exe
Token: SeSystemEnvironmentPrivilege	308	a0430ed68d4e0b5218cff297976d82849c2c2dc579f31ea7551f815336d4871e.exe
Token: SeChangeNotifyPrivilege	308	a0430ed68d4e0b5218cff297976d82849c2c2dc579f31ea7551f815336d4871e.exe
Token: SeRemoteShutdownPrivilege	308	a0430ed68d4e0b5218cff297976d82849c2c2dc579f31ea7551f815336d4871e.exe
Token: SeUndockPrivilege	308	a0430ed68d4e0b5218cff297976d82849c2c2dc579f31ea7551f815336d4871e.exe
Token: SeSyncAgentPrivilege	308	a0430ed68d4e0b5218cff297976d82849c2c2dc579f31ea7551f815336d4871e.exe
Token: SeEnableDelegationPrivilege	308	a0430ed68d4e0b5218cff297976d82849c2c2dc579f31ea7551f815336d4871e.exe
Token: SeManageVolumePrivilege	308	a0430ed68d4e0b5218cff297976d82849c2c2dc579f31ea7551f815336d4871e.exe
Token: SeImpersonatePrivilege	308	a0430ed68d4e0b5218cff297976d82849c2c2dc579f31ea7551f815336d4871e.exe
Token: SeCreateGlobalPrivilege	308	a0430ed68d4e0b5218cff297976d82849c2c2dc579f31ea7551f815336d4871e.exe
Token: 31	308	a0430ed68d4e0b5218cff297976d82849c2c2dc579f31ea7551f815336d4871e.exe
Token: 32	308	a0430ed68d4e0b5218cff297976d82849c2c2dc579f31ea7551f815336d4871e.exe
Token: 33	308	a0430ed68d4e0b5218cff297976d82849c2c2dc579f31ea7551f815336d4871e.exe
Token: 34	308	a0430ed68d4e0b5218cff297976d82849c2c2dc579f31ea7551f815336d4871e.exe
Token: 35	308	a0430ed68d4e0b5218cff297976d82849c2c2dc579f31ea7551f815336d4871e.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1616	a0430ed68d4e0b5218cff297976d82849c2c2dc579f31ea7551f815336d4871e.exe
308	a0430ed68d4e0b5218cff297976d82849c2c2dc579f31ea7551f815336d4871e.exe
308	a0430ed68d4e0b5218cff297976d82849c2c2dc579f31ea7551f815336d4871e.exe
308	a0430ed68d4e0b5218cff297976d82849c2c2dc579f31ea7551f815336d4871e.exe

Suspicious use of WriteProcessMemory 46 IoCs

description	pid	Process	procid_target
PID 1616 wrote to memory of 1168	1616	a0430ed68d4e0b5218cff297976d82849c2c2dc579f31ea7551f815336d4871e.exe	28
PID 1616 wrote to memory of 1168	1616	a0430ed68d4e0b5218cff297976d82849c2c2dc579f31ea7551f815336d4871e.exe	28
PID 1616 wrote to memory of 1168	1616	a0430ed68d4e0b5218cff297976d82849c2c2dc579f31ea7551f815336d4871e.exe	28
PID 1616 wrote to memory of 1168	1616	a0430ed68d4e0b5218cff297976d82849c2c2dc579f31ea7551f815336d4871e.exe	28
PID 1616 wrote to memory of 308	1616	a0430ed68d4e0b5218cff297976d82849c2c2dc579f31ea7551f815336d4871e.exe	29
PID 1616 wrote to memory of 308	1616	a0430ed68d4e0b5218cff297976d82849c2c2dc579f31ea7551f815336d4871e.exe	29
PID 1616 wrote to memory of 308	1616	a0430ed68d4e0b5218cff297976d82849c2c2dc579f31ea7551f815336d4871e.exe	29
PID 1616 wrote to memory of 308	1616	a0430ed68d4e0b5218cff297976d82849c2c2dc579f31ea7551f815336d4871e.exe	29
PID 1616 wrote to memory of 308	1616	a0430ed68d4e0b5218cff297976d82849c2c2dc579f31ea7551f815336d4871e.exe	29
PID 1616 wrote to memory of 308	1616	a0430ed68d4e0b5218cff297976d82849c2c2dc579f31ea7551f815336d4871e.exe	29
PID 1616 wrote to memory of 308	1616	a0430ed68d4e0b5218cff297976d82849c2c2dc579f31ea7551f815336d4871e.exe	29
PID 1616 wrote to memory of 308	1616	a0430ed68d4e0b5218cff297976d82849c2c2dc579f31ea7551f815336d4871e.exe	29
PID 1616 wrote to memory of 308	1616	a0430ed68d4e0b5218cff297976d82849c2c2dc579f31ea7551f815336d4871e.exe	29
PID 1616 wrote to memory of 308	1616	a0430ed68d4e0b5218cff297976d82849c2c2dc579f31ea7551f815336d4871e.exe	29
PID 308 wrote to memory of 268	308	a0430ed68d4e0b5218cff297976d82849c2c2dc579f31ea7551f815336d4871e.exe	30
PID 308 wrote to memory of 268	308	a0430ed68d4e0b5218cff297976d82849c2c2dc579f31ea7551f815336d4871e.exe	30
PID 308 wrote to memory of 268	308	a0430ed68d4e0b5218cff297976d82849c2c2dc579f31ea7551f815336d4871e.exe	30
PID 308 wrote to memory of 268	308	a0430ed68d4e0b5218cff297976d82849c2c2dc579f31ea7551f815336d4871e.exe	30
PID 308 wrote to memory of 856	308	a0430ed68d4e0b5218cff297976d82849c2c2dc579f31ea7551f815336d4871e.exe	32
PID 308 wrote to memory of 856	308	a0430ed68d4e0b5218cff297976d82849c2c2dc579f31ea7551f815336d4871e.exe	32
PID 308 wrote to memory of 856	308	a0430ed68d4e0b5218cff297976d82849c2c2dc579f31ea7551f815336d4871e.exe	32
PID 308 wrote to memory of 856	308	a0430ed68d4e0b5218cff297976d82849c2c2dc579f31ea7551f815336d4871e.exe	32
PID 308 wrote to memory of 1416	308	a0430ed68d4e0b5218cff297976d82849c2c2dc579f31ea7551f815336d4871e.exe	34
PID 308 wrote to memory of 1416	308	a0430ed68d4e0b5218cff297976d82849c2c2dc579f31ea7551f815336d4871e.exe	34
PID 308 wrote to memory of 1416	308	a0430ed68d4e0b5218cff297976d82849c2c2dc579f31ea7551f815336d4871e.exe	34
PID 308 wrote to memory of 1416	308	a0430ed68d4e0b5218cff297976d82849c2c2dc579f31ea7551f815336d4871e.exe	34
PID 308 wrote to memory of 808	308	a0430ed68d4e0b5218cff297976d82849c2c2dc579f31ea7551f815336d4871e.exe	35
PID 308 wrote to memory of 808	308	a0430ed68d4e0b5218cff297976d82849c2c2dc579f31ea7551f815336d4871e.exe	35
PID 308 wrote to memory of 808	308	a0430ed68d4e0b5218cff297976d82849c2c2dc579f31ea7551f815336d4871e.exe	35
PID 308 wrote to memory of 808	308	a0430ed68d4e0b5218cff297976d82849c2c2dc579f31ea7551f815336d4871e.exe	35
PID 268 wrote to memory of 1528	268	cmd.exe	38
PID 268 wrote to memory of 1528	268	cmd.exe	38
PID 268 wrote to memory of 1528	268	cmd.exe	38
PID 268 wrote to memory of 1528	268	cmd.exe	38
PID 1416 wrote to memory of 1780	1416	cmd.exe	39
PID 1416 wrote to memory of 1780	1416	cmd.exe	39
PID 1416 wrote to memory of 1780	1416	cmd.exe	39
PID 1416 wrote to memory of 1780	1416	cmd.exe	39
PID 856 wrote to memory of 1536	856	cmd.exe	41
PID 856 wrote to memory of 1536	856	cmd.exe	41
PID 856 wrote to memory of 1536	856	cmd.exe	41
PID 856 wrote to memory of 1536	856	cmd.exe	41
PID 808 wrote to memory of 892	808	cmd.exe	40
PID 808 wrote to memory of 892	808	cmd.exe	40
PID 808 wrote to memory of 892	808	cmd.exe	40
PID 808 wrote to memory of 892	808	cmd.exe	40

C:\Users\Admin\AppData\Local\Temp\a0430ed68d4e0b5218cff297976d82849c2c2dc579f31ea7551f815336d4871e.exe
"C:\Users\Admin\AppData\Local\Temp\a0430ed68d4e0b5218cff297976d82849c2c2dc579f31ea7551f815336d4871e.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1616
- C:\Users\Admin\AppData\Local\Temp\tmpopen.exe
  "C:\Users\Admin\AppData\Local\Temp\tmpopen.exe"
  2⤵
  - Executes dropped EXE
  PID:1168
- C:\Users\Admin\AppData\Local\Temp\a0430ed68d4e0b5218cff297976d82849c2c2dc579f31ea7551f815336d4871e.exe
  C:\Users\Admin\AppData\Local\Temp\a0430ed68d4e0b5218cff297976d82849c2c2dc579f31ea7551f815336d4871e.exe
  2⤵
  - Adds policy Run key to start application
  - Modifies Installed Components in the registry
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:308
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:268
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
      4⤵
      Modifies firewall policy service
      Modifies registry key
      PID:1528
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\a0430ed68d4e0b5218cff297976d82849c2c2dc579f31ea7551f815336d4871e.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\a0430ed68d4e0b5218cff297976d82849c2c2dc579f31ea7551f815336d4871e.exe:*:Enabled:Windows Messanger" /f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:856
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\a0430ed68d4e0b5218cff297976d82849c2c2dc579f31ea7551f815336d4871e.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\a0430ed68d4e0b5218cff297976d82849c2c2dc579f31ea7551f815336d4871e.exe:*:Enabled:Windows Messanger" /f
      4⤵
      Modifies firewall policy service
      Modifies registry key
      PID:1536
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1416
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
      4⤵
      Modifies firewall policy service
      Modifies registry key
      PID:1780
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\jinx.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\jinx.exe:*:Enabled:Windows Messanger" /f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:808
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\jinx.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\jinx.exe:*:Enabled:Windows Messanger" /f
      4⤵
      Modifies firewall policy service
      Modifies registry key
      PID:892

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpopen.exe

Filesize
16KB

MD5
9b578fd26c3fbe4b720c9ab2e3556924

SHA1
7e4395344a02ffa469bac8cbbd82ccd1d7f5f7ba

SHA256
1fb4df7d07ed8e55b10da166f28dd493a08ff6cf43ef5ca56693e252c4369deb

SHA512
dca17c52d9d76d51e11b819e7ac09de12a823415a8bb7fae32d101cc86516c4da3c07aa863181d490e33e5b43668f1b986f6d22840c12d21d60882cb942e7b25

Download Submit
\Users\Admin\AppData\Local\Temp\tmpopen.exe

Filesize
16KB

MD5
9b578fd26c3fbe4b720c9ab2e3556924

SHA1
7e4395344a02ffa469bac8cbbd82ccd1d7f5f7ba

SHA256
1fb4df7d07ed8e55b10da166f28dd493a08ff6cf43ef5ca56693e252c4369deb

SHA512
dca17c52d9d76d51e11b819e7ac09de12a823415a8bb7fae32d101cc86516c4da3c07aa863181d490e33e5b43668f1b986f6d22840c12d21d60882cb942e7b25

Download Submit
\Users\Admin\AppData\Local\Temp\tmpopen.exe

Filesize
16KB

MD5
9b578fd26c3fbe4b720c9ab2e3556924

SHA1
7e4395344a02ffa469bac8cbbd82ccd1d7f5f7ba

SHA256
1fb4df7d07ed8e55b10da166f28dd493a08ff6cf43ef5ca56693e252c4369deb

SHA512
dca17c52d9d76d51e11b819e7ac09de12a823415a8bb7fae32d101cc86516c4da3c07aa863181d490e33e5b43668f1b986f6d22840c12d21d60882cb942e7b25

Download Submit
memory/268-68-0x0000000000000000-mapping.dmp

Download
memory/308-78-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/308-62-0x00000000004013BC-mapping.dmp

Download
memory/308-63-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/308-77-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/808-71-0x0000000000000000-mapping.dmp

Download
memory/856-69-0x0000000000000000-mapping.dmp

Download
memory/892-75-0x0000000000000000-mapping.dmp

Download
memory/1168-76-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/1168-59-0x0000000000000000-mapping.dmp

Download
memory/1416-70-0x0000000000000000-mapping.dmp

Download
memory/1528-72-0x0000000000000000-mapping.dmp

Download
memory/1536-74-0x0000000000000000-mapping.dmp

Download
memory/1616-56-0x0000000075C81000-0x0000000075C83000-memory.dmp

Filesize
8KB

Download
memory/1780-73-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads