Resubmissions
01-04-2023 05:34
230401-f9mbsahe9v 801-04-2023 05:33
230401-f83blsgb87 601-04-2023 05:30
230401-f699fahe7x 1001-04-2023 05:26
230401-f4ttnsgb52 8Analysis
-
max time kernel
127s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
01-04-2023 05:30
Static task
static1
Behavioral task
behavioral1
Sample
JJSploit_7.1.3_x86_en-US.msi
Resource
win7-20230220-en
windows7-x64
4 signatures
150 seconds
General
-
Target
JJSploit_7.1.3_x86_en-US.msi
-
Size
5.8MB
-
MD5
89b39aafa577686ce2890ff00a22f7d6
-
SHA1
1259bb1962d23f242ebe340f359b3825a31989d4
-
SHA256
dfdb140d98307146cbdbc726cc1f4897acc14288c95fd8bfc5ab29f91c895fa3
-
SHA512
59d7ee87354f01c9bcaf438086a730f56c671f75815be696b07107d54f886b48a7217a7c4138e690a6c0670b7c39dd564650b63e6e12743d46b3bd65824ad70d
-
SSDEEP
98304:oni7F600rU+xmX0VumSuS2eaYbC8wSKyWatyiGoMNjbLmf19+I3NlNi3bywir:Gi7F6MiVVBS2e3bC8wS+QGZNYpi2
Score
6/10
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
msiexec.exedescription ioc process File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Q: msiexec.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
msiexec.exepid process 1408 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 34 IoCs
Processes:
msiexec.exemsiexec.exedescription pid process Token: SeShutdownPrivilege 1408 msiexec.exe Token: SeIncreaseQuotaPrivilege 1408 msiexec.exe Token: SeRestorePrivilege 1420 msiexec.exe Token: SeTakeOwnershipPrivilege 1420 msiexec.exe Token: SeSecurityPrivilege 1420 msiexec.exe Token: SeCreateTokenPrivilege 1408 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1408 msiexec.exe Token: SeLockMemoryPrivilege 1408 msiexec.exe Token: SeIncreaseQuotaPrivilege 1408 msiexec.exe Token: SeMachineAccountPrivilege 1408 msiexec.exe Token: SeTcbPrivilege 1408 msiexec.exe Token: SeSecurityPrivilege 1408 msiexec.exe Token: SeTakeOwnershipPrivilege 1408 msiexec.exe Token: SeLoadDriverPrivilege 1408 msiexec.exe Token: SeSystemProfilePrivilege 1408 msiexec.exe Token: SeSystemtimePrivilege 1408 msiexec.exe Token: SeProfSingleProcessPrivilege 1408 msiexec.exe Token: SeIncBasePriorityPrivilege 1408 msiexec.exe Token: SeCreatePagefilePrivilege 1408 msiexec.exe Token: SeCreatePermanentPrivilege 1408 msiexec.exe Token: SeBackupPrivilege 1408 msiexec.exe Token: SeRestorePrivilege 1408 msiexec.exe Token: SeShutdownPrivilege 1408 msiexec.exe Token: SeDebugPrivilege 1408 msiexec.exe Token: SeAuditPrivilege 1408 msiexec.exe Token: SeSystemEnvironmentPrivilege 1408 msiexec.exe Token: SeChangeNotifyPrivilege 1408 msiexec.exe Token: SeRemoteShutdownPrivilege 1408 msiexec.exe Token: SeUndockPrivilege 1408 msiexec.exe Token: SeSyncAgentPrivilege 1408 msiexec.exe Token: SeEnableDelegationPrivilege 1408 msiexec.exe Token: SeManageVolumePrivilege 1408 msiexec.exe Token: SeImpersonatePrivilege 1408 msiexec.exe Token: SeCreateGlobalPrivilege 1408 msiexec.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
msiexec.exepid process 1408 msiexec.exe
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\JJSploit_7.1.3_x86_en-US.msi1⤵
- Enumerates connected drives
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken