Analysis

  • max time kernel
    110s
  • max time network
    144s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    19/04/2023, 02:04

General

  • Target

    JJSploit_7.1.3_x86_en-US.msi

  • Size

    5.8MB

  • MD5

    89b39aafa577686ce2890ff00a22f7d6

  • SHA1

    1259bb1962d23f242ebe340f359b3825a31989d4

  • SHA256

    dfdb140d98307146cbdbc726cc1f4897acc14288c95fd8bfc5ab29f91c895fa3

  • SHA512

    59d7ee87354f01c9bcaf438086a730f56c671f75815be696b07107d54f886b48a7217a7c4138e690a6c0670b7c39dd564650b63e6e12743d46b3bd65824ad70d

  • SSDEEP

    98304:oni7F600rU+xmX0VumSuS2eaYbC8wSKyWatyiGoMNjbLmf19+I3NlNi3bywir:Gi7F6MiVVBS2e3bC8wS+QGZNYpi2

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 23 IoCs
  • Drops file in Windows directory 12 IoCs
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 46 IoCs
  • Modifies registry class 35 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 37 IoCs
  • Suspicious use of SendNotifyMessage 32 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\JJSploit_7.1.3_x86_en-US.msi
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:1376
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2024
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 1BFC27BAB2179643C920D7A78105C0B2 C
      2⤵
      • Loads dropped DLL
      PID:564
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -windowstyle hidden try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 } catch {}; Invoke-WebRequest -Uri "https://go.microsoft.com/fwlink/p/?LinkId=2124703" -OutFile "$env:TEMP\MicrosoftEdgeWebview2Setup.exe" ; Start-Process -FilePath "$env:TEMP\MicrosoftEdgeWebview2Setup.exe" -ArgumentList ('/silent', '/install') -Wait
      2⤵
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      PID:952
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
      PID:1488
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "000000000000049C" "00000000000002DC"
      1⤵
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      PID:1960
    • C:\Windows\system32\pcwrun.exe
      C:\Windows\system32\pcwrun.exe ""
      1⤵
        PID:1960
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        1⤵
        • Enumerates system info in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:1952
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6a39758,0x7fef6a39768,0x7fef6a39778
          2⤵
            PID:1900
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=284 --field-trial-handle=1192,i,16451137506413001823,9976817089803792854,131072 /prefetch:2
            2⤵
              PID:1216
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1524 --field-trial-handle=1192,i,16451137506413001823,9976817089803792854,131072 /prefetch:8
              2⤵
                PID:1140
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1620 --field-trial-handle=1192,i,16451137506413001823,9976817089803792854,131072 /prefetch:8
                2⤵
                  PID:1684
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2228 --field-trial-handle=1192,i,16451137506413001823,9976817089803792854,131072 /prefetch:1
                  2⤵
                    PID:2176
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2120 --field-trial-handle=1192,i,16451137506413001823,9976817089803792854,131072 /prefetch:1
                    2⤵
                      PID:2168
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1360 --field-trial-handle=1192,i,16451137506413001823,9976817089803792854,131072 /prefetch:2
                      2⤵
                        PID:2552
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1464 --field-trial-handle=1192,i,16451137506413001823,9976817089803792854,131072 /prefetch:1
                        2⤵
                          PID:2648
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3864 --field-trial-handle=1192,i,16451137506413001823,9976817089803792854,131072 /prefetch:8
                          2⤵
                            PID:2668
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3936 --field-trial-handle=1192,i,16451137506413001823,9976817089803792854,131072 /prefetch:8
                            2⤵
                              PID:2684
                          • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                            "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                            1⤵
                              PID:2224
                            • C:\Windows\helppane.exe
                              C:\Windows\helppane.exe -Embedding
                              1⤵
                                PID:2912

                              Network

                              MITRE ATT&CK Enterprise v6

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              • C:\Program Files (x86)\JJSploit\JJSploit.exe

                                Filesize

                                9.9MB

                                MD5

                                7b0cd24f6573f45f707381896445dc20

                                SHA1

                                bd49edd9bf4536324f71effa53c0ecac53e074e0

                                SHA256

                                5caab958fde69fbae9bd0f3dbee8398ef616c0dc1245cd2c0f17ac9e15c8c777

                                SHA512

                                9f76f91edece4c67a956971b803d53a437ea4c4ee8cdb46d21ca6d45ea8e1fec71d77446c864cbdb2310fda1b7ea73d0720d238a3647288a737debc588d7b513

                              • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\JJSploit\JJSploit.lnk

                                Filesize

                                2KB

                                MD5

                                f068536b5f52a414259ef8494396cd3a

                                SHA1

                                bb7e57cf2618cf04fd620dd7c36e2d0c55d646b4

                                SHA256

                                7ad6289e51fdbd18fa9d9e4ce69016edda15d128ae5391d59f4cbd65b2ff53f0

                                SHA512

                                305e4b899d8b40ef4608e720f7c0bb6070b17adea0af82a761bce9546978ac01c104d95bbe0f80a40bf3a8af049a37a5d86b23081b603cafad134cb9e850016e

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

                                Filesize

                                264KB

                                MD5

                                f50f89a0a91564d0b8a211f8921aa7de

                                SHA1

                                112403a17dd69d5b9018b8cede023cb3b54eab7d

                                SHA256

                                b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                                SHA512

                                bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                Filesize

                                4KB

                                MD5

                                4fd26cddaa669a090e26d5fcd85c48fd

                                SHA1

                                625c1599d8140740c30dc1a79bbdecaec62ecd6a

                                SHA256

                                a162c31af53a16c7923d93960192c907b5fe89534022ee7a2f01c6474021759c

                                SHA512

                                8be92723280321af379bd6eb9f875b605bb054928e5835a08d6bd87bd73194fc95abdcb28c0f90cd457cfb9cbf2962e93d7c95a47af0ac7fbca757044674a098

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000004.dbtmp

                                Filesize

                                16B

                                MD5

                                6752a1d65b201c13b62ea44016eb221f

                                SHA1

                                58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                SHA256

                                0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                SHA512

                                9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                              • C:\Users\Admin\AppData\Local\Temp\MSI3766.tmp

                                Filesize

                                113KB

                                MD5

                                4fdd16752561cf585fed1506914d73e0

                                SHA1

                                f00023b9ae3c8ce5b7bb92f25011eaebe6f9d424

                                SHA256

                                aecd2d2fe766f6d439acc2bbf1346930ecc535012cf5ad7b3273d2875237b7e7

                                SHA512

                                3695e7eb1e35ec959243a91ab5b4454eb59aeef0f2699aa5de8e03de8fbb89f756a89130526da5c08815408cb700284a17936522ad2cad594c3e6e9d18a3f600

                              • C:\Windows\Installer\6c93a9.msi

                                Filesize

                                5.8MB

                                MD5

                                89b39aafa577686ce2890ff00a22f7d6

                                SHA1

                                1259bb1962d23f242ebe340f359b3825a31989d4

                                SHA256

                                dfdb140d98307146cbdbc726cc1f4897acc14288c95fd8bfc5ab29f91c895fa3

                                SHA512

                                59d7ee87354f01c9bcaf438086a730f56c671f75815be696b07107d54f886b48a7217a7c4138e690a6c0670b7c39dd564650b63e6e12743d46b3bd65824ad70d

                              • \Users\Admin\AppData\Local\Temp\MSI3766.tmp

                                Filesize

                                113KB

                                MD5

                                4fdd16752561cf585fed1506914d73e0

                                SHA1

                                f00023b9ae3c8ce5b7bb92f25011eaebe6f9d424

                                SHA256

                                aecd2d2fe766f6d439acc2bbf1346930ecc535012cf5ad7b3273d2875237b7e7

                                SHA512

                                3695e7eb1e35ec959243a91ab5b4454eb59aeef0f2699aa5de8e03de8fbb89f756a89130526da5c08815408cb700284a17936522ad2cad594c3e6e9d18a3f600

                              • memory/952-112-0x000000001B370000-0x000000001B652000-memory.dmp

                                Filesize

                                2.9MB

                              • memory/952-117-0x00000000027EB000-0x0000000002822000-memory.dmp

                                Filesize

                                220KB

                              • memory/952-116-0x00000000027E0000-0x0000000002860000-memory.dmp

                                Filesize

                                512KB

                              • memory/952-115-0x00000000027E0000-0x0000000002860000-memory.dmp

                                Filesize

                                512KB

                              • memory/952-114-0x0000000001D70000-0x0000000001D78000-memory.dmp

                                Filesize

                                32KB

                              • memory/952-113-0x00000000027E0000-0x0000000002860000-memory.dmp

                                Filesize

                                512KB

                              • memory/2912-237-0x00000000002B0000-0x00000000002B1000-memory.dmp

                                Filesize

                                4KB